John Rawley Email and Phone Number

• Gained knowledge in the topics of Incident Coordination, Malware Analysis, Host Forensics, and Network Archaeology.• Incident Coordination: Learned how to efficiently manage and report on a cyber incident to both technical and non-technical management.• Malware Analysis: Learned how to more efficiently analyze malicious programs and safely isolate them. • Host Forensics: Learned how to capture and process forensic disc and memory images, as well as use tools such as Volatility and Autopsy. • Network Archaeology: Learned how to capture and detect abnormal network traffic and create software to decode custom network protocols. • Aided in the creation of a SunBurst DGA Decoder (https://github.com/jrawl126/ToastyDecoder). Namely contributed to the detection of which encryption scheme was used as well as handling information sent across multiple requests.

• Conducted research on the MAZE malware family • Created safe isolated virtual environment to contain the virus• Used both static and dynamic analysis to reverse engineer the cryptolocker • Circumvented anti-analysis and anti-virtual machine measures