Ursnif Malware Targeting Italy — Incident Response (Case Lab 2/4)

Case Context

Part of a 4-lab investigation case on Threat Hunting Labs built around a single incident: a high-severity alert on a Windows workstation triggered by a signed binary loading a DLL from a user-writable path. This lab is the Incident Response angle — running the full triage → scope → contain → recover lifecycle against the same intrusion, this time with the goal of a defensible incident record rather than a hunt.

The case runs four separate investigation angles against the same incident: Threat Hunt, Incident Response, Detection Engineering, and Malware Analysis. This lab is 2 of 4 — I’ll be posting the full case once all four are complete rather than piecemeal.

Threat Hunting Labs has a strict no-public-writeup policy on active labs to protect scoring and leaderboards for other users, so this page is intentionally an overview: what I did and what I found, not the queries or the specific answers that got me there.

Techniques Encountered

Seven MITRE ATT&CK techniques surfaced across the response, spanning tool transfer, web-based C2, scripting, registry querying, remote access via VNC, and system discovery:

Prioritising Findings — Pyramid of Pain

Seven findings came out of the response, weighted by how costly each is for the attacker to change:

What I Practiced

• Triaging a live alert into a scoped incident using the IR lifecycle — triage, scope, contain, recover
• Pivoting from a single host artifact to remote-access activity (VNC) to establish how far the intrusion reached
• Separating living-off-the-land proxy execution from legitimate admin activity under time pressure
• Building a defensible incident timeline across host and network evidence for handover
• Prioritising containment actions against findings ranked by attacker cost to change (Pyramid of Pain)

Full case writeup will go up once all 4 labs are done.