Scribd Logo
Upload

Welcome to Scribd!

  • 40 views

    5) Basic Dynamic Analysis

    Uploaded by

    Backup G
    The document discusses tools and techniques for basic dynamic malware analysis including sandboxes, Sysinternals tools like Process Explorer and Process Monitor, and analyzing persistence mechanisms. It recommends using tools like sandboxes, Sysinternals, Regshot, INetSim, ApateDNS and Wireshark together to maximize information gathered from dynamic analysis by monitoring processes, registry, file system and network activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    5) Basic Dynamic Analysis

    Uploaded by

    Backup G
    40 views7 pages
    The document discusses tools and techniques for basic dynamic malware analysis including sandboxes, Sysinternals tools like Process Explorer and Process Monitor, and analyzing persistence mechanisms. It recommends using tools like sandboxes, Sysinternals, Regshot, INetSim, ApateDNS and Wireshark together to maximize information gathered from dynamic analysis by monitoring processes, registry, file system and network activity.

    Original Title

    5)Basic Dynamic Analysis

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses tools and techniques for basic dynamic malware analysis including sandboxes, Sysinternals tools like Process Explorer and Process Monitor, and analyzing persistence mechanisms. It recommends using tools like sandboxes, Sysinternals, Regshot, INetSim, ApateDNS and Wireshark together to maximize information gathered from dynamic analysis by monitoring processes, registry, file system and network activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    40 views7 pages

    5) Basic Dynamic Analysis

    Uploaded by

    Backup G
    The document discusses tools and techniques for basic dynamic malware analysis including sandboxes, Sysinternals tools like Process Explorer and Process Monitor, and analyzing persistence mechanisms. It recommends using tools like sandboxes, Sysinternals, Regshot, INetSim, ApateDNS and Wireshark together to maximize information gathered from dynamic analysis by monitoring processes, registry, file system and network activity.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 7

    Basic dynamic analysis

    Introducing concepts
    • Dynamic analysis is any examination performed after executing
    malware.
    • Dynamic analysis is typically performed after basic static analysis has
    reached a dead end, whether due to obfuscation, packing, or the
    analyst having exhausted the available static analysis techniques.
    • dynamic analysis lets you observe the malware’s true functionality
    tools for basic dynamic analysis
    • Sandboxes:A sandbox is a security mechanism for running untrusted
    programs in a safe environment without fear of harming “real”
    systems.
    • Sandboxes comprise virtualized environments that often simulate
    network services in some fashion to ensure that the software or
    malware being tested will function normally.
    • EXAMPLE:Norman SandBox, GFI Sandbox, Anubis, Joe Sandbox,
    ThreatExpert, BitBlaze, and Comodo Instant Malware Analysis—will
    analyze malware for free.
    Sysinternals tools

    • The SysInternals suite of tools is simply a set of Windows applications that can be
    downloaded for free from their section of the Microsoft Technet web site.
    • They are all portable
    • The tools include utilities such as Process Explorer, which is a lot like Task Manager with a
    plethora of extra features, or Process Monitor, which monitors your PC for filesystem,
    registry, or even network activity from almost any process on your system.
    • there is an entire set of tools that run from the command line to help you deal with
    processes, services, and more.
    • For example, say you have a really slow PC to troubleshoot, and you want to inspect all of
    the threads for a particular application, and then you want to see the entire stack for one
    of those threads to see exactly what DLLs and functions are being called. Process
    Explorer makes this trivial — you can simply double-click on the process, flip over to the
    Threads tab, and then click the Stack button.
    • (1) TekTip ep1 - Basic Dynamic Malware Analysis - YouTube
    Persistence techniques
    • USING registry Keys
    • Using File Systems
    • Using windows services
    • Basic Dynamic Tools in Practice
    • All the tools discussed in this chapter can be used in concert to maximize
    the amount of information gleaned during dynamic analysis. In this section,
    we’ll look at all the tools discussed in the chapter as we present a sample
    setup for malware analysis. Your setup might include the following:
    • Running procmon and setting a filter on the malware executable name and
    clearing out all events just before running.
    • Starting Process Explorer.
    • Gathering a first snapshot of the registry using Regshot.
    • Setting up your virtual network to your liking using INetSim and ApateDNS.
    • Setting up network traffic logging using Wireshark.

    You might also like