malware-dynamic-analysis · diff
git:20260412.09f91e4 to git:20260905.fd80b2a
214 added, 733 removed. Audit A to A.
---
name: malware-dynamic-analysis
- description: Execute and monitor malware in controlled sandbox environments. Use when you need to observe runtime behavior, capture network traffic, monitor process activity, analyze file/registry changes, or understand actual malware functionality beyond static analysis. Guides safe execution with Procmon, Wireshark, Process Hacker (now System Informer), Sysmon, and automated sandboxes.
+ description: Behavioral analysis of a sample executed in an isolated VM. Use after triage when runtime behavior, C2 traffic, dropped files, persistence, or injection must be observed. Claude produces a tailored VM runbook from triage predictions, then parses the exported text evidence (Procmon CSV, Sysmon JSON/CSV, tshark output, autoruns, strings) on the host to reconstruct behavior and extract IOCs. The analyst runs the VM; Claude never executes the sample.
---
# Malware Dynamic Analysis
- Safely execute and comprehensively monitor malware behavior in isolated environments for professional malware research and enterprise security operations.
+ Two halves. **Part A** is a runbook the analyst follows inside the isolated VM (REMnux / FlareVM); you tailor it from triage predictions and it ends with text-format evidence exports. **Part B** is your work: parse that evidence on the host, reconstruct what the sample did, extract behavioral IOCs, and write findings to `analysis_state.md`.
- ## When to Use This Skill
+ ## Execution Model
- Use this skill when you need to:
- - Execute malware safely in an isolated environment
- - Monitor runtime behavior (processes, files, registry, network)
- - Capture and analyze network traffic and C2 communications
- - Validate hypotheses from static analysis
- - Extract runtime-decrypted strings or configurations
- - Document actual malware functionality for reports
- - Create behavioral IOCs and detection signatures
- - Analyze process injection and code execution techniques
+ - **You never execute the sample.** The VM is network-isolated and has no Claude in it. Everything you run is on the host against exported evidence files.
+ - **Before the VM run:** read the triage findings in `analysis_state.md` and emit a runbook tailored to the predictions (which process names to filter, which Sysmon event IDs matter, expected protocol, expected persistence, expected evasion). Skip the tailoring only if triage is missing — then use the default runbook as-is.
+ - **After the VM run:** the user hands you an evidence directory. Inventory it, reject binary formats with the conversion command (see **Converting Binary Evidence**), and then work through Part B with Bash and the bundled scripts. Do not ask the user to summarize the evidence for you.
+ - **Scripts** (relative to this skill dir): `scripts/procmon_summary.py`, `scripts/sysmon_summary.py`; plus `../scripts/ioc_extract.py` at repo root. All stdlib Python 3.
+ - **Sandbox reports count as evidence.** ANY.RUN / Joe Sandbox / Hybrid Analysis / Threat.Zone (MCP) JSON or text reports go through Part B Step 6.
+ - **Large files:** `wc -l` first. Use the summary scripts and `grep`, never `cat` a 200k-line Procmon CSV.
- ## ⚠️ Safety First - Pre-Execution Checklist
+ ---
- **CRITICAL:** Never execute malware outside a properly isolated environment.
+ ## Part A — VM Runbook (analyst executes this)
- Before ANY execution:
- - [ ] Snapshot taken of clean VM state
- - [ ] Network isolated (host-only or INetSim simulation)
- - [ ] No shared folders enabled
- - [ ] No clipboard sharing
- - [ ] Time sync disabled
- - [ ] Monitoring tools ready and running
- - [ ] Analysis persona active (no personal info)
- - [ ] Emergency shutdown plan ready
+ Emit this to the user, filled in with the sample name and triage predictions. Keep the safety checklist verbatim.
- **If ANY checkbox fails - DO NOT EXECUTE**
+ ### A1. Safety checklist — all boxes or do not execute
- ## Dynamic Analysis Workflow
+ - [ ] Clean VM snapshot taken
+ - [ ] Network: host-only / internal, with INetSim or FakeNet-NG answering (never NAT to the real internet unless the engagement explicitly allows it)
+ - [ ] No shared folders, no clipboard sharing, no drag-and-drop
+ - [ ] Guest time sync disabled
+ - [ ] Monitoring tools started **before** execution (order below)
+ - [ ] Analysis persona active — no real credentials, names, or corporate artifacts on the VM
+ - [ ] Evidence transfer path decided (USB / one-way share) and a `C:\evidence\` directory created
- ### Phase 1: Environment Preparation (10 minutes)
+ Full VM hardening and anti-VM-detection countermeasures: `references/sandbox_setup.md`, `references/anti_analysis_bypass.md`.
- **1. Verify VM Isolation:**
- ```bash
- # Check network adapter settings
- # Should be: Host-only or NAT with INetSim
+ ### A2. Start monitoring (in this order)
- # Test internet connectivity (should fail or hit INetSim)
- ping 8.8.8.8
- nslookup google.com
+ 1. INetSim / FakeNet-NG (network simulation)
+ 2. Sysmon — already installed with `olafhartong/sysmon-modular` or SwiftOnSecurity config
+ 3. Procmon — clear capture (Ctrl+X), apply filters (below)
+ 4. Wireshark — capture on the VM adapter
+ 5. System Informer
+ 6. Regshot 1st shot (optional) / `autorunsc` baseline (below)
- # Verify no shared folders
- net use # Windows
- df -h # Linux
+ Tool configuration details: `references/tool_setup.md`.
- # Check time sync (should be disabled)
- w32tm /query /status # Windows
+ **Procmon filters** (tailor from triage — add predicted child processes and LOLBins):
```
-
- **2. Start Monitoring Tools:**
-
- Launch in this order:
- 1. **Procmon** (Process Monitor) - File/Registry/Process activity
- 2. **Wireshark** - Network traffic capture
- 3. **System Informer** - Process/memory monitoring
- 4. **Regshot** - Take "before" snapshot (optional)
-
- See `references/tool_setup.md` for detailed configuration.
-
- **3. Establish Baseline:**
- - Take note of running processes
- - Document open network connections
- - Record current registry state (if using Regshot)
-
- ### Phase 2: Malware Execution (Variable Duration)
-
- **Execute the Sample:**
+ Process Name is <sample.exe> Include
+ Process Name is <predicted child, e.g. powershell.exe, rundll32.exe> Include
+ Operation contains Process Include (keeps Process Create for the tree)
+ Process Name is procmon.exe / SystemInformer.exe / wireshark.exe Exclude
+ ```
+ Do **not** filter to the sample alone if injection is predicted — include the predicted target (`explorer.exe`, `svchost.exe`, `RegAsm.exe`, …).
+ **Baseline persistence snapshot** (Sysinternals Autoruns, run as admin):
```powershell
- # For PE executables
- .\sample.exe
+ autorunsc64.exe -accepteula -a * -c -h -s -nobanner | Out-File -Encoding utf8 C:\evidence\autoruns_before.csv
+ ```
- # With arguments (if required)
- .\sample.exe /install /silent
+ ### A3. Execute
- # For DLLs
+ ```powershell
+ # EXE
+ .\sample.exe # add args if triage found a required switch, e.g. /install /silent
+ # DLL — triage lists the exports; try DllMain first, then each named export
rundll32.exe sample.dll,DllMain
- rundll32.exe sample.dll,ExportedFunction
-
- # For scripts
+ rundll32.exe sample.dll,<Export>
+ # Scripts
powershell.exe -ExecutionPolicy Bypass -File sample.ps1
cscript.exe //NoLogo sample.vbs
wscript.exe sample.js
- ```
-
- **Observation Duration:**
- - **Minimum:** 5 minutes (most malware acts quickly)
- - **Standard:** 15 minutes (catch delayed execution)
- - **Extended:** 60+ minutes (for time-based evasion)
-
- **What to Watch:**
- - New processes spawned
- - Network connections initiated
- - Files created/modified/deleted
- - Registry keys modified
- - CPU/Memory usage spikes
- - Pop-ups or UI changes
- - Error messages
-
- ### Phase 3: Process Monitoring
-
- **Using System Informer:**
-
- **Track New Processes:**
- 1. Watch for new entries in process list
- 2. Note parent-child relationships
- 3. Document command-line arguments
- 4. Check process integrity levels
- 5. Monitor memory allocations
-
- **Identify Process Injection:**
- - Look for RWX (Read-Write-Execute) memory regions
- - Check for threads in unexpected processes
- - Monitor for process hollowing indicators
- - Watch for CreateRemoteThread calls
-
- **Memory Analysis:**
- ```
- Right-click process → Memory → Inspect
- Look for:
- - Suspicious memory regions (RWX permissions)
- - Injected DLLs (not in system path)
- - Decoded strings in memory
- - Configuration data
-
- Right-click process → Create Dump File
- → Save for later Volatility analysis
- ```
-
- **Handles Analysis:**
+ mshta.exe sample.hta
```
- Double-click process → Handles tab
- Look for:
- - Mutexes (process synchronization objects)
- - Named pipes (inter-process communication)
- - File handles (what files are open)
- - Registry key handles
- ```
+ Observe **15 minutes minimum**; 60+ if triage found sleep/time checks. Interact where the sample expects it (click the decoy, dismiss dialogs). Note the wall-clock time of execution — it anchors every timeline.
- ### Phase 4: File System Monitoring
+ Watch for: new processes, network attempts (INetSim log), files in `%TEMP%`, `%APPDATA%`, `C:\ProgramData`, `C:\Users\Public`, registry Run keys, new services/tasks, UI changes (ransom note, fake error), CPU spikes.
- **Using Procmon (Process Monitor):**
+ If nothing happens: see `references/anti_analysis_bypass.md` (VM checks, sleep patching, required arguments, missing parent process, locale/keyboard checks).
- **Configure Filters:**
- ```
- Filter → Add:
- - Process Name → is → sample.exe → Include
- - Operation → contains → File → Include
- - Operation → contains → Reg → Include
- - Process Name → is → explorer.exe → Exclude
- - Process Name → is → svchost.exe → Exclude (unless suspicious)
- ```
+ ### A4. Export evidence — text formats only
- **Monitor File Operations:**
+ Run these before reverting. Every file lands in `C:\evidence\` (or `/evidence` on REMnux) and must be text.
- Look for:
- - **CreateFile** - Files being created
- - **WriteFile** - Files being modified
- - **DeleteFile** - Files being deleted
- - **SetRenameInformationFile** - Files being renamed
+ | Source | Command / action | File |
+ |--------|------------------|------|
+ | Procmon | File → Save → **All events** → **CSV** (or `procmon.exe /OpenLog cap.pml /SaveAs procmon.csv`) | `procmon.csv` |
+ | Sysmon | `Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'} \| Select-Object Id,TimeCreated,Message \| ConvertTo-Json -Depth 3 \| Out-File -Encoding utf8 C:\evidence\sysmon.json` | `sysmon.json` |
+ | Wireshark → tshark | see block below | `dns.txt`, `http.txt`, `conns.txt`, `tls.txt`, `syn.txt` |
+ | Wireshark objects | File → Export Objects → HTTP → save all | `http_objects/` |
+ | INetSim | copy `/var/log/inetsim/service.log` and `report/` | `inetsim_service.log` |
+ | System Informer | File → Save → `processes.txt`; for suspicious process: right-click → Create dump file | `processes.txt`, `<proc>.dmp` |
+ | Memory dump strings | `strings -a -n 8 -e l proc.dmp > proc_strings_wide.txt; strings -a -n 8 proc.dmp > proc_strings.txt` (REMnux `strings`, or FLOSS) | `*_strings*.txt` |
+ | Persistence | `autorunsc64.exe -accepteula -a * -c -h -s -nobanner \| Out-File -Encoding utf8 C:\evidence\autoruns_after.csv` | `autoruns_after.csv` |
+ | Scheduled tasks / services / WMI | PowerShell block below | `persistence.txt` |
+ | Regshot | Compare → output **TXT** | `regshot.txt` |
+ | Dropped files | PowerShell block below; copy the files themselves into `dropped/` (they are new samples) | `dropped_hashes.csv`, `dropped/` |
+ | Screenshots | ransom notes, dialogs, anything visual | `screenshots/*.png` |
- **Key Locations to Watch:**
- ```
- C:\Users\<user>\AppData\Local\Temp\
- C:\Users\<user>\AppData\Roaming\
- C:\ProgramData\
- C:\Windows\Temp\
- C:\Users\<user>\AppData\Local\
+ **tshark exports** (run on REMnux against the saved `capture.pcapng`, or in the FlareVM Wireshark install dir):
+ ```bash
+ P=capture.pcapng
+ tshark -r $P -Y "dns.flags.response==0" -T fields -e frame.time -e ip.src -e dns.qry.name > dns.txt
+ tshark -r $P -Y "http.request" -T fields -e frame.time -e ip.dst -e http.host -e http.request.method -e http.request.uri -e http.user_agent > http.txt
+ tshark -r $P -Y "tls.handshake.type==1" -T fields -e frame.time -e ip.dst -e tcp.dstport -e tls.handshake.extensions_server_name -e tls.handshake.ja3 > tls.txt
+ tshark -r $P -q -z conv,tcp -z conv,udp > conns.txt
+ tshark -r $P -Y "tcp.flags.syn==1 && tcp.flags.ack==0" -T fields -e frame.time_epoch -e ip.dst -e tcp.dstport > syn.txt
+ tshark -r $P -Y "http.request.method==POST" -T fields -e ip.dst -e http.request.uri -e http.content_length -e http.file_data > http_post.txt
```
- **Extract Dropped Files:**
+ **Persistence and dropped files** (PowerShell, after execution):
```powershell
- # Find recently created files (last 5 minutes)
- Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue |
- Where-Object {$_.CreationTime -gt (Get-Date).AddMinutes(-5)}
-
- # Hash all dropped files
- Get-ChildItem -Path C:\Users\<user>\AppData\Local\Temp\ |
- Get-FileHash -Algorithm SHA256 |
- Format-Table Hash, Path
- ```
-
- **Save Evidence:**
- - Copy dropped files to evidence folder
- - Calculate hashes
- - Document file paths and timestamps
- - Preserve file metadata
-
- ### Phase 5: Registry Monitoring
-
- **Using Procmon:**
-
- **Filter for Registry Operations:**
- ```
- Operation → contains → Reg → Include
- ```
-
- **Common Registry Operations:**
- - **RegCreateKey** - Creating new keys
- - **RegSetValue** - Writing values
- - **RegQueryValue** - Reading values
- - **RegDeleteKey** - Deleting keys
-
- **Critical Registry Locations:**
-
- **Persistence Mechanisms:**
- ```
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run
- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKLM\System\CurrentControlSet\Services (new services)
- ```
-
- **Configuration Storage:**
- ```
- HKCU\Software\<malware_name>
- HKLM\Software\<malware_name>
- ```
-
- **Manual Registry Inspection:**
- ```cmd
- # Export specific key for analysis
- reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" run_keys.reg
-
- # Query specific value
- reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
- ```
-
- **Using Regshot (Alternative):**
- ```
- 1. Take 1st shot (before execution)
- 2. Execute malware
- 3. Take 2nd shot (after execution)
- 4. Compare → generates HTML report of all changes
- ```
-
- ### Phase 6: Network Behavior Analysis
-
- **Using Wireshark:**
+ $E = "C:\evidence"
+ Get-ScheduledTask | ? {$_.TaskPath -notlike "\Microsoft*"} | Select TaskName,TaskPath,State,@{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} | Format-List | Out-File -Encoding utf8 "$E\persistence.txt"
+ Get-CimInstance Win32_Service | ? {$_.PathName -notlike "C:\Windows\*"} | Select Name,PathName,StartMode,State | Format-List | Out-File -Encoding utf8 "$E\persistence.txt" -Append
+ Get-CimInstance -Namespace root\Subscription -Class __FilterToConsumerBinding | Format-List | Out-File -Encoding utf8 "$E\persistence.txt" -Append
+ foreach ($k in 'HKCU','HKLM') { Get-ItemProperty "${k}:\Software\Microsoft\Windows\CurrentVersion\Run*" | Out-File -Encoding utf8 "$E\persistence.txt" -Append }
- **Start Capture:**
- ```
- Capture → Options → Select network adapter → Start
+ $t = (Get-Date).AddMinutes(-90) # adjust to execution time
+ mkdir "$E\dropped" -Force | Out-Null
+ Get-ChildItem -Path $env:TEMP,$env:APPDATA,$env:LOCALAPPDATA,C:\ProgramData,C:\Users\Public,C:\Windows\Temp -Recurse -File -Force -ErrorAction SilentlyContinue |
+ ? {$_.CreationTime -gt $t} | % { Copy-Item $_.FullName "$E\dropped\" -Force -ErrorAction SilentlyContinue; $_ } |
+ Get-FileHash -Algorithm SHA256 | Export-Csv "$E\dropped_hashes.csv" -NoTypeInformation
```
- **Display Filters:**
- ```
- # DNS queries
- dns
+ Then: transfer `C:\evidence\` to the host, **revert the snapshot**, verify the revert.
- # HTTP traffic
- http
+ ### Converting Binary Evidence
- # HTTPS/TLS
- tls
+ If the user brings PML / PCAP(NG) / EVTX instead, reply with the conversion command and wait:
- # Specific IP address
- ip.addr == 192.168.1.100
+ | Got | Convert with |
+ |-----|--------------|
+ | `.pml` | Windows VM: `procmon.exe /OpenLog x.pml /SaveAs x.csv` |
+ | `.pcap` / `.pcapng` | The tshark block in A4 (tshark exists on REMnux and on any host with Wireshark) — you can run this yourself on the host if tshark is installed: `command -v tshark` |
+ | `.evtx` | Windows: `Get-WinEvent -Path sysmon.evtx \| Select Id,TimeCreated,Message \| ConvertTo-Json -Depth 3 \| Out-File -Encoding utf8 sysmon.json`. Host/REMnux: `evtx_dump --format jsonl sysmon.evtx > sysmon.jsonl` (`pip install evtx`) — `sysmon_summary.py` reads both |
+ | `.dmp` | `strings -a -n 8 x.dmp > x_strings.txt; strings -a -n 8 -e l x.dmp > x_strings_wide.txt` — run on the host, it is not executable |
- # Specific port
- tcp.port == 443 || udp.port == 443
- ```
+ PCAP and memory dumps are safe to handle on the host; the PE files in `dropped/` are new samples and go back through triage.
- **What to Capture:**
+ ---
- **DNS Queries:**
- ```bash
- # Extract all DNS queries
- tshark -r capture.pcapng -Y dns.qry.name -T fields -e dns.qry.name | sort -u
+ ## Part B — Evidence Analysis (you do this)
- Look for:
- - Domain names contacted
- - DGA (Domain Generation Algorithm) patterns
- - Fast-flux DNS indicators
- - Known C2 domains
- ```
+ ### B0. Inventory
- **HTTP/HTTPS Traffic:**
```bash
- # Extract HTTP requests
- tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri
-
- # Extract User-Agent strings
- tshark -r capture.pcapng -Y http -T fields -e http.user_agent | sort -u
-
- Look for:
- - C2 server URLs
- - Download locations
- - POST data (exfiltration)
- - Suspicious User-Agents
- - Beacon patterns (regular intervals)
- ```
-
- **TCP/UDP Connections:**
- ```powershell
- # Real-time connection monitoring
- netstat -ano | findstr ESTABLISHED
-
- # Using TCPView (Sysinternals)
- tcpview.exe
-
- Look for:
- - Destination IPs and ports
- - Connection frequency (beaconing)
- - Data transfer volumes
- - Unusual protocols
+ E=/path/to/evidence
+ ls -la "$E"; file "$E"/* | grep -v ':.*text' ; wc -l "$E"/*.csv "$E"/*.txt "$E"/*.json 2>/dev/null
+ head -2 "$E/procmon.csv" # confirm columns: Time of Day, Process Name, PID, Operation, Path, Result, Detail
```
- **Analyze Network Patterns:**
-
- **C2 Communication:**
- - Regular beacon intervals (e.g., every 60 seconds)
- - Consistent packet sizes
- - Encrypted payloads
- - Known C2 infrastructure
+ Anything that is not text → **Converting Binary Evidence**. Note the sample's process name(s) from triage/state; you will scope everything on them.
- **Data Exfiltration:**
- - Large outbound transfers
- - POST requests with encoded data
- - DNS tunneling (large TXT records)
- - Non-standard protocols
+ ### B1. Process behavior — Procmon
- **Extract Network IOCs:**
```bash
- # All contacted IPs
- tshark -r capture.pcapng -T fields -e ip.dst | sort -u | grep -v "192.168\|10.0\|127.0"
-
- # All contacted domains
- tshark -r capture.pcapng -Y dns -T fields -e dns.qry.name | sort -u
-
- # All URLs
- tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri |
- awk '{print "http://"$1$2}'
- ```
-
- ### Phase 7: Advanced Monitoring
-
- **Using Sysmon (Windows Event Logging):**
-
- **Setup:**
- ```powershell
- # Install with SwiftOnSecurity config
- sysmon64.exe -accepteula -i sysmonconfig.xml
-
- # View logs
- Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | Format-List
- ```
-
- **Key Event IDs:**
- - **Event ID 1** - Process Creation
- - **Event ID 3** - Network Connection
- - **Event ID 5** - Process Terminated
- - **Event ID 7** - Image Loaded (DLL)
- - **Event ID 8** - CreateRemoteThread (injection)
- - **Event ID 10** - Process Access
- - **Event ID 11** - File Created
- - **Event ID 12/13** - Registry Events
-
- **Query Specific Events:**
- ```powershell
- # Process creation events
- Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} |
- Format-List
-
- # Network connections
- Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=3} |
- Format-List
-
- # Export for analysis
- wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon_logs.evtx
+ python3 malware-dynamic-analysis/scripts/procmon_summary.py "$E/procmon.csv" --process sample.exe > "$E/procmon_summary.txt"
+ wc -l "$E/procmon_summary.txt"; sed -n 1,80p "$E/procmon_summary.txt"
```
- **Using Noriben (Automated Procmon):**
+ The summary gives: process tree with command lines, files created/written/renamed/deleted, registry writes with persistence keys flagged, network endpoints, DLLs loaded from outside `C:\Windows`, event counts. Read it fully (page with `sed -n`). Then drill into specifics straight from the CSV:
```bash
- # Run Noriben with automatic malware execution
- python Noriben.py --cmd sample.exe --timeout 300
-
- # Output: Noriben_<timestamp>.txt with parsed behavior summary
+ # everything one child did
+ grep -F '"powershell.exe"' "$E/procmon.csv" | cut -d, -f2,4,5 | sort | uniq -c | sort -rn | head -40
+ # a specific path or key
+ grep -iF 'CurrentVersion\Run' "$E/procmon.csv" | head
+ # timeline of process starts (first-seen order)
+ grep -F '"Process Start"' "$E/procmon.csv" | cut -d, -f1,2,3,7 | head -40
```
- Benefits:
- - Automates Procmon collection
- - Filters noise automatically
- - Generates readable report
- - Timestamps all activities
-
- ### Phase 8: Persistence Analysis
-
- **Check All Persistence Mechanisms:**
-
- **Run Keys:**
- ```powershell
- # Current User
- Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
+ Interpret against the triage predictions: confirmed, refuted, or unexpected. Injection shows up as the sample writing to another process's address space only indirectly in Procmon — cross-check with Sysmon EID 8/10 in B2. Self-deletion (`SetDispositionInformationFile` on its own path, or `cmd /c del`), decoy launches, and LOLBin chains (`rundll32`, `regsvr32`, `mshta`, `wscript`, `msiexec`, `certutil`, `bitsadmin`) are the usual tells.
- # Local Machine
- Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
+ ### B2. Process behavior — Sysmon
- # RunOnce keys
- Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
- Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
+ ```bash
+ python3 malware-dynamic-analysis/scripts/sysmon_summary.py "$E/sysmon.json" --process sample.exe > "$E/sysmon_summary.txt"
+ sed -n 1,120p "$E/sysmon_summary.txt"
```
- **Scheduled Tasks:**
- ```powershell
- Get-ScheduledTask | Where-Object {$_.TaskName -notlike "Microsoft*"} | Format-Table
-
- # Detailed task info
- Get-ScheduledTask -TaskName "SuspiciousTask" | Get-ScheduledTaskInfo
- ```
+ Sections and what they prove:
- **Services:**
- ```powershell
- # Recently created services
- Get-Service | Where-Object {$_.StartType -ne "Disabled"} | Format-Table
+ | Section (EID) | Read it for |
+ |---------------|-------------|
+ | Process tree (1) | Authoritative parent/child + full command lines + hashes of every executed image |
+ | Network (3) | Per-process destinations; `BEACON-LIKE` tag = regular intervals (coefficient of variation < 0.3 over ≥5 connections) |
+ | DNS (22) | Queried names and resolved IPs, even when the connection failed |
+ | Files (11) | Dropped files by process — the source of truth for `dropped/` |
+ | Registry (12/13/14) | `PERSISTENCE` flags: Run/RunOnce, Services, Winlogon, IFEO, TaskCache, AppInit |
+ | Remote threads (8) | `CreateRemoteThread` injection: source → target, start address |
+ | Process access (10) | `OpenProcess` with high rights (`0x1F0FFF`, `0x1FFFFF`, `0x143A`) → injection prep, LSASS access → credential theft |
+ | Image loads (7) | Unsigned DLLs from user-writable paths, sideloading |
+ | Pipes (17/18) | Named pipes = Cobalt Strike / Meterpreter / custom IPC IOCs |
+ | WMI (19/20/21) | WMI event subscription persistence |
+ | Tampering (25) | Process hollowing / herpaderping |
- # Service details
- sc query <service_name>
- sc qc <service_name>
- ```
+ Correlate B1 and B2: Procmon has more file/registry granularity, Sysmon has hashes, injection, DNS, and command lines. Where they disagree, trust Sysmon for process identity and Procmon for file operations.
- **Startup Folder:**
- ```powershell
- # Check startup folders
- dir "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
- dir "$env:PROGRAMDATA\Microsoft\Windows\Start Menu\Programs\Startup"
- ```
+ ### B3. Network
- **WMI Event Subscriptions:**
- ```powershell
- Get-WmiObject -Namespace root\Subscription -Class __EventFilter
- Get-WmiObject -Namespace root\Subscription -Class __EventConsumer
- Get-WmiObject -Namespace root\Subscription -Class __FilterToConsumerBinding
+ ```bash
+ cat "$E/dns.txt" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -30
+ cat "$E/http.txt" | head -40
+ cat "$E/tls.txt" | awk -F'\t' '{print $2":"$3, $4, $5}' | sort -u
+ sed -n 1,60p "$E/conns.txt"
+ grep -v '^$' "$E/http_post.txt" | head -20
+ grep -iE 'connect|request|GET|POST' "$E/inetsim_service.log" | head -40
```
- ### Phase 9: Artifact Collection
-
- **Export All Evidence:**
+ Beacon detection from `syn.txt` (interval regularity per destination):
- **Process Monitor:**
- ```
- File → Save → All Events → CSV format
- → Save as: procmon_output.csv
+ ```bash
+ python3 - "$E/syn.txt" <<'EOF'
+ import sys, statistics, collections
+ by = collections.defaultdict(list)
+ for line in open(sys.argv[1]):
+ p = line.split()
+ if len(p) == 3: by[(p[1], p[2])].append(float(p[0]))
+ for (ip, port), ts in by.items():
+ ts.sort(); gaps = [b-a for a, b in zip(ts, ts[1:])]
+ if len(gaps) >= 4:
+ m = statistics.mean(gaps); cv = statistics.pstdev(gaps)/m if m else 9
+ print(f"{ip}:{port} n={len(ts)} mean={m:.1f}s cv={cv:.2f} {'BEACON' if cv < 0.3 else ''}")
+ EOF
```
- **Wireshark:**
- ```
- File → Export Specified Packets → All packets
- → Save as: network_capture.pcapng
- ```
+ What to establish: C2 hosts (DNS name → IP → port → protocol), beacon interval and jitter, User-Agent and URI pattern (Suricata material), TLS SNI/JA3, download URLs and what came back (`http_objects/` — `file` them; PE payloads go back to triage), exfiltration (POST sizes, encoding), DGA signs (many NXDOMAIN, random-looking labels), and whether traffic went to INetSim or the sample gave up (matters for what you can claim).
- **System Informer:**
- ```
- File → Save All → processes.txt
- (Optional) Right-click process → Create dump file → memory_dump.dmp
- ```
+ ### B4. Persistence and system changes
- **Regshot:**
- ```
- Compare → Output to HTML
- → Save as: registry_changes.html
+ ```bash
+ cat "$E/persistence.txt"
+ # autoruns diff: entries present after but not before
+ python3 - "$E/autoruns_before.csv" "$E/autoruns_after.csv" <<'EOF'
+ import csv, sys
+ key = lambda r: (r.get('Entry Location',''), r.get('Entry',''), r.get('Image Path',''))
+ before = {key(r) for r in csv.DictReader(open(sys.argv[1], encoding='utf-8-sig', errors='replace'))}
+ for r in csv.DictReader(open(sys.argv[2], encoding='utf-8-sig', errors='replace')):
+ if key(r) not in before: print(r.get('Entry Location'), '|', r.get('Entry'), '|', r.get('Image Path'), '|', r.get('Signer',''))
+ EOF
+ grep -iE 'Run|Services|TaskCache|Winlogon' "$E/regshot.txt" | head -40
```
- **Sysmon Logs:**
- ```powershell
- wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
- ```
+ Map each mechanism to ATT&CK (T1547.001 Run keys, T1053.005 scheduled task, T1543.003 service, T1546.003 WMI, T1574.002 sideloading, …) — the detection phase needs the technique IDs.
- **Dropped Files:**
- ```powershell
- # Copy all dropped files with hashes
- $evidence = "C:\evidence\dropped_files"
- New-Item -Path $evidence -ItemType Directory -Force
+ ### B5. Dropped files and memory strings
- Get-ChildItem -Path "C:\Users\<user>\AppData\Local\Temp" |
- ForEach-Object {
- Copy-Item $_.FullName -Destination $evidence
- Get-FileHash $_.FullName -Algorithm SHA256
- }
+ ```bash
+ cat "$E/dropped_hashes.csv"
+ file "$E"/dropped/*
+ python3 scripts/ioc_extract.py "$E"/*_strings*.txt # C2, keys, paths decrypted only at runtime
+ grep -iE 'user-agent|/gate|/panel|\.php|password|token|Bearer' "$E"/*_strings*.txt | sort -u | head -40
```
- **Screenshots:**
- - Take screenshots of any visible UI
- - Capture error messages
- - Document unusual behavior
+ Every PE in `dropped/` is a new sample: add it to `analysis_state.md` and route back through `malware-triage`. Runtime strings that were absent from the static strings dump are the decrypted config — call that out explicitly, it is the strongest YARA/Suricata material.
- ### Phase 10: Cleanup and Reset
+ ### B6. Sandbox reports (if provided)
- **Before Reverting VM:**
- 1. ✅ All evidence exported and saved
- 2. ✅ Hashes calculated for all artifacts
- 3. ✅ Network captures saved
- 4. ✅ Process dumps saved (if needed)
- 5. ✅ Screenshots organized
+ ANY.RUN / Joe / Hybrid Analysis / Threat.Zone JSON: `jq` the process tree, network, dropped files, and MITRE sections; treat them as a fourth evidence source and reconcile with B1-B5. Sandbox results are weaker than your own VM run when the sample is VM-aware — say so if behaviors differ.
- **Revert to Clean Snapshot:**
- ```
- VMware: VM → Snapshot → Revert to Snapshot
- VirtualBox: Machine → Close → Restore current snapshot
+ ```bash
+ jq -r '.. | .processes? // empty' report.json | head; jq -r '.. | .network? // empty' report.json | head
```
- **Verify Clean State:**
- - Check no malware artifacts remain
- - Verify monitoring tools reset
- - Confirm network settings correct
-
- ## Automated Sandbox Analysis
-
- ### ANY.RUN (Interactive Cloud Sandbox)
-
- **When to Use:**
- - Need quick behavioral analysis
- - Want to interact with malware during execution
- - Need visual demonstration of behavior
- - Time-constrained analysis
-
- **Workflow:**
- 1. Upload sample to https://app.any.run
- 2. Select Windows version (7/8/10/11)
- 3. Choose network simulation (Internet or No connection)
- 4. Click "Run"
- 5. Interact if needed (click buttons, enter passwords)
- 6. Monitor real-time:
- - Process tree
- - Network requests
- - File operations
- - Registry changes
- 7. Download artifacts:
- - PCAP file
- - Process dumps
- - Dropped files
- - IOCs (JSON/CSV)
-
- **Advantages:**
- - Fast results (5-10 minutes)
- - Visual process tree
- - Archived for future reference
- - No local resources needed
-
- **Limitations:**
- - Sample uploaded to cloud (privacy concern)
- - VM-aware malware may not execute
- - Limited to preset Windows versions
-
- ### Joe Sandbox / Hybrid Analysis
+ ### B7. Consolidate
- **API Submission (if available):**
```bash
- # Submit to Joe Sandbox
- jbxapi submit sample.exe --systems win10x64
-
- # Check status
- jbxapi status <submission_id>
-
- # Download report
- jbxapi download <submission_id> --type html > joe_report.html
- jbxapi download <submission_id> --type json > joe_report.json
+ cat "$E/procmon_summary.txt" "$E/sysmon_summary.txt" "$E"/dns.txt "$E"/http.txt "$E"/tls.txt "$E"/persistence.txt 2>/dev/null | python3 scripts/ioc_extract.py > "$E/iocs_defanged.txt"
```
- **Report Analysis:**
- - Behavior summary
- - Network communications
- - File system changes
- - Screenshots
- - MITRE ATT&CK mapping
- - YARA rule suggestions
-
- ### Local Sandboxes (CAPE, Cuckoo)
-
- **For Enterprise/Private Analysis:**
- - Complete control over environment
- - No sample disclosure
- - Customizable VM configurations
- - Automated at scale
-
- See `references/sandbox_setup.md` for local sandbox installation.
-
- ## Common Dynamic Analysis Scenarios
-
- ### Scenario 1: Ransomware Execution
-
- **Preparation:**
- - Create test files in common locations
- - Monitor C:\Users\<user>\Documents closely
- - Watch for file extension changes
-
- **Observe:**
- - File encryption activity
- - Ransom note creation
- - Desktop wallpaper changes
- - Process names (often legitimate-sounding)
-
- **Capture:**
- - Screenshot of ransom note
- - List of encrypted file extensions
- - C2 communication (if any)
- - Bitcoin wallet addresses
-
- ### Scenario 2: Trojan/RAT Behavior
-
- **Preparation:**
- - Set up fake C2 listener (ncat)
- - Monitor for reverse shell attempts
-
- **Observe:**
- - Persistence mechanism creation
- - C2 beacon intervals
- - Command execution
- - Keylogging indicators
- - Screen capture attempts
-
- **Capture:**
- - C2 traffic (PCAP)
- - Executed commands
- - Exfiltrated data
- - Persistence registry keys
-
- ### Scenario 3: Dropper/Loader Analysis
-
- **Preparation:**
- - Monitor network for secondary payload downloads
- - Watch temp directories closely
-
- **Observe:**
- - Initial dropper execution
- - Secondary payload download
- - Payload execution
- - Cleanup of dropper
-
- **Capture:**
- - All dropped files and hashes
- - Download URLs
- - Full execution chain (parent → child processes)
-
- ### Scenario 4: Infostealer Execution
-
- **Preparation:**
- - Populate browser with test credentials
- - Create test cryptocurrency wallets
- - Add test email client
-
- **Observe:**
- - Browser profile access
- - Credential file reads
- - Data staging (zip/archive creation)
- - Exfiltration attempts
+ Remove your own lab artifacts (VM hostname, INetSim IPs, analyst username) and Windows-internal noise from the IOC list before recording it.
- **Capture:**
- - Accessed credential stores
- - Exfiltration destinations
- - Data encoding methods
+ ## Output
- ## Behavioral IOC Extraction
+ Append to `analysis_state.md` under the sample's **Analysis Findings** and **IOCs Identified**, then print the findings summary:
- **From Dynamic Analysis, Extract:**
+ ```markdown
+ ## Dynamic Analysis — [sample] (executed [UTC time], observed [n] min, VM: [FlareVM/REMnux], network: [INetSim/FakeNet/none])
- **Process IOCs:**
- ```
- Process Name: sample.exe
- Parent Process: explorer.exe
- Command Line: C:\Users\Public\sample.exe /install
- Child Processes: cmd.exe, powershell.exe
- Mutex: Global\UniqueMalwareMutex
- ```
+ ### Execution chain
+ [process tree with command lines; injection targets; LOLBins; self-deletion]
- **File IOCs:**
- ```
- Created Files:
- - C:\Users\<user>\AppData\Local\Temp\payload.exe (SHA256: abc123...)
- - C:\ProgramData\config.dat
+ ### Predictions vs observed
+ | Triage prediction | Observed | Evidence |
- Modified Files:
- - C:\Users\<user>\Documents\*.locked (ransomware)
+ ### File system
+ Created / modified / deleted, with hashes for dropped PE files
- Deleted Files:
- - %TEMP%\dropper.exe (self-deletion)
- ```
+ ### Registry & persistence
+ Mechanism → key/task/service → payload path → ATT&CK ID
- **Registry IOCs:**
- ```
- Created Keys:
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender
- Value: C:\Users\Public\malware.exe
+ ### Network
+ C2: host → IP:port, protocol, beacon interval/jitter, UA, URI pattern, TLS SNI/JA3 · Downloads · Exfil · DGA
- Modified Keys:
- HKLM\System\CurrentControlSet\Services\<new_service>
- ```
+ ### Evasion observed
+ Sleep, VM checks, debugger checks, tampering (EID 25), what was bypassed and how
- **Network IOCs:**
- ```
- DNS Queries:
- - malicious-c2[.]com
- - backup-server[.]tk
+ ### Behavioral IOCs (defanged)
+ Process (names, cmdlines, mutexes, pipes) · File (paths, hashes) · Registry · Network
- HTTP Requests:
- - hxxp://malicious-c2[.]com/api/checkin
- User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
+ ### MITRE ATT&CK
+ Technique IDs with the observation that supports each
- IP Connections:
- - 192.168.1.100:443 (C2 server)
- - 10.0.0.50:8080 (data exfiltration)
+ ### Not observed / limitations
+ [network to real C2 blocked; sample exited after VM check; only 15 min observed …]
```
- ## Quality Checklist
-
- Before concluding dynamic analysis:
-
- **Execution Environment:**
- - [ ] VM properly isolated (verified)
- - [ ] All monitoring tools captured data
- - [ ] Execution time sufficient (15+ minutes minimum)
- - [ ] Clean snapshot available for re-analysis
-
- **Process Monitoring:**
- - [ ] All spawned processes documented
- - [ ] Process tree captured
- - [ ] Command-line arguments recorded
- - [ ] Process injection observed (if any)
- - [ ] Memory dumps saved (if relevant)
-
- **File System:**
- - [ ] All dropped files identified and hashed
- - [ ] File paths documented
- - [ ] Dropped files saved to evidence
- - [ ] File modifications logged
- - [ ] Deletion activities recorded
-
- **Registry:**
- - [ ] Persistence mechanisms identified
- - [ ] Registry changes documented
- - [ ] Configuration keys noted
- - [ ] Registry export saved
-
- **Network:**
- - [ ] Full PCAP captured
- - [ ] DNS queries extracted
- - [ ] C2 servers identified
- - [ ] Network protocols documented
- - [ ] Data exfiltration noted
-
- **Evidence Collection:**
- - [ ] All artifacts exported
- - [ ] Hashes calculated
- - [ ] Timestamps recorded (UTC)
- - [ ] Screenshots saved
- - [ ] Logs organized in case folder
-
- **Analysis Completeness:**
- - [ ] Behaviors match static analysis predictions
- - [ ] Unexpected behaviors investigated
- - [ ] IOCs validated and defanged
- - [ ] Findings documented for report
-
- ## Best Practices
-
- ### Do:
- - Always take VM snapshot before execution
- - Run monitoring tools BEFORE executing malware
- - Document observations in real-time
- - Capture evidence continuously
- - Verify network isolation
- - Use multiple monitoring tools
- - Save everything (disk is cheap)
- - Test IOCs for accuracy
- - Document timeline of events
-
- ### Don't:
- - Execute without proper isolation
- - Trust timestamps from malware
- - Assume short execution time is sufficient
- - Execute on production systems (NEVER!)
- - Share VM with other activities
- - Enable internet without INetSim
- - Forget to export evidence before reverting
- - Rely on single monitoring tool
- - Skip documentation during execution
-
- ### Time-Based Evasion:
- - Some malware delays execution (sleep evasion)
- - Set extended observation period (60+ minutes)
- - Monitor for scheduled tasks
- - Check for triggers (time, date, system events)
-
- ### VM Detection Evasion:
- - Some malware detects VMs and doesn't execute
- - Use pafish-free VM configurations
- - Modify VM artifacts (MAC addresses, system info)
- - See `references/anti_analysis_bypass.md`
-
- ## Integration with Report Writing
-
- Dynamic analysis provides:
- - **Execution Flow** → Report: Technical Analysis section
- - **Process Activity** → Report: Behavior Analysis
- - **Network IOCs** → Report: Network Indicators
- - **File IOCs** → Report: File Indicators
- - **Persistence** → Report: Persistence Mechanisms
- - **Screenshots** → Report: Appendix
- - **Timeline** → Report: Execution Timeline
-
- Use findings to:
- - Validate static analysis hypotheses
- - Create behavioral YARA rules
- - Write Sigma detection rules
- - Develop hunting queries
- - Document MITRE ATT&CK techniques
-
- ## Tool Reference
+ Recommend `detection-engineer` next (behaviors + network IOCs are ready) unless dropped payloads need triage first.
- For detailed tool setup, filtering, and configuration:
- - `references/tool_setup.md` - Procmon, Wireshark, System Informer configuration
- - `references/sandbox_setup.md` - Local sandbox installation
- - `references/anti_analysis_bypass.md` - Bypassing VM detection and sleep evasion
+ ## Quality Gate
- ## Example Usage
+ Evidence inventoried and all text · process tree with command lines · every prediction marked confirmed/refuted/unexpected · dropped files hashed and routed · persistence mapped to ATT&CK · C2 characterized (or explicitly "no network observed") · IOCs defanged and lab noise removed · limitations stated · state file updated.
- **User request:** "Help me safely execute this ransomware sample and document its behavior"
+ ## References
- **Workflow:**
- 1. Verify VM isolation and safety checklist
- 2. Guide monitoring tool setup (Procmon, Wireshark, System Informer)
- 3. Execute sample with observation
- 4. Document process creation and injection
- 5. Capture file encryption behavior
- 6. Extract ransom note and C2 communications
- 7. Collect all artifacts
- 8. Generate behavioral IOCs
- 9. Create timeline of execution
- 10. Prepare findings for report integration
+ - `references/tool_setup.md` — Procmon filters/columns, Wireshark filters, System Informer, Sysmon install, Regshot, TCPView, Noriben, INetSim, FakeNet-NG
+ - `references/sandbox_setup.md` — REMnux/FlareVM build, isolation, snapshots, CAPE/Cuckoo
+ - `references/anti_analysis_bypass.md` — VM/debugger/sleep evasion and how to defeat it
+ - `scripts/procmon_summary.py`, `scripts/sysmon_summary.py` — evidence condensers (`--self-test` to verify)
+ - `../scripts/ioc_extract.py` — IOC extraction and defanging