Basic Dynamic Analysis

Previously, we learned techniques to analyze malware without executing it in the Basic Static Analysis room. However, as we have learned, malware can use techniques to hide its features from a malware analyst. But no matter how good malware hides its features from static analysis, its primary purpose is to execute. And when malware executes, it leaves traces that a malware analyst can use to identify if it's malicious. We will use basic dynamic analysis techniques in this room to analyze the traces malware leaves when running.

Learning Objectives:

In this room, we will learn:

• Sandboxing and using a sandbox for malware analysis.
• The components of a sandbox and how to create one for yourself.
• Using ProcMon to monitor a process' activity.
• Using API Logger and API Monitor to identify API calls made by malware.
• Using ProcExp to identify if a process is modified maliciously.
• Using Regshot to track registry changes made by malware.

Pre-requisites:

Before starting this room, it is recommended that you complete the following rooms for a better understanding of the content in this room.

• Introduction to Windows API
• Windows Internals
• Intro to Malware Analysis
• Basic Static Analysis