Lion Cipher Lab
Characterize spyware: microphone, webcam, screenshots, and location surveillance
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Spyware is the malware category that turns a person's own computer against them: it listens on the microphone, watches through the webcam, photographs the screen every few seconds, tracks where the machine is, and quietly copies the documents — then ships all of it to whoever planted it. When a sample like this lands on your desk, the questions are human, not just technical: is this person being watched right now, since when, and what has already left the building? You answer those from behavior — the device-access calls and the upload trace — long before anyone finishes reverse-engineering…
What you'll learn
- reading a behavioral sandbox API trace to identify which peripheral a sample is capturing (microphone, webcam, screen)
- recognizing the Windows audio-input call (waveInOpen) that opens the mic for recording, and video-capture calls that open the webcam
- spotting a timer-driven screenshot loop (BitBlt / SRCCOPY into a memory DC) and measuring its capture cadence from timestamps
- identifying a geolocation lookup built from a Wi-Fi BSSID survey plus a web-geolocation request, and reading the resolved coordinates
- seeing a broad Documents-folder enumeration as bulk local-file collection
- following the staging-folder + periodic-upload pattern that ships collected audio, video, screenshots and files to a collection server
- mapping surveillance behavior to MITRE ATT&CK (T1123 Audio Capture, T1125 Video Capture, T1113 Screen Capture, T1005 Data from Local System)
- judgment: when device-access + upload artifacts characterize surveillance vs. when you must reverse the binary, and the victim-safety steps a pro takes
Steps in this lab
- The analyst's chair: what spyware is, and what you were handed
- The behavioral bundle (read it once, top to bottom)
- Artifact A, part 1 — the microphone: reading the audio-capture call
- Artifact A, part 2 — the webcam: reading the video-capture call
- Artifact B — periodic screenshots: reading the screen-capture loop and its cadence
- Artifact C — location: reading the Wi-Fi-survey geolocation lookup
- Artifact D — files: reading the Documents sweep as bulk collection
- Artifact E — staging and upload: how the take leaves the machine
- Assemble the verdict: capabilities, cadence, IOCs, and the MITRE map
- The judgment call: when behavior is enough, why mic+cam+screen is the tell, and how a pro protects the victim
- What you can now do (and how to practice it safely)