行为分析基础

Welcome to Basic Behavioral Analysis! In this lesson, we'll learn how to observe malware in action.

Behavioral analysis is like watching a suspect in a controlled environment to understand their habits and intentions. It's crucial for understanding how malware operates.

Unlike static analysis (which examines code without running it), dynamic analysis involves executing the malware. This lets us see exactly what it does.

By running malware in a safe, isolated environment, we can observe its interactions with the operating system, network, and files.

To safely perform dynamic analysis, we use a sandbox. A sandbox is an isolated testing environment that mimics a real system.

It prevents malware from escaping and infecting your actual computer or network. Think of it as a virtual playpen for malicious programs.

Sandboxes come in two main flavors:

• Cloud-based: Services like Any.Run or VirusTotal execute malware for you and provide a report. Great for quick checks!
• Local: You set up a virtual machine (VM) on your own machine. This gives you more control and privacy for deeper analysis.

For local behavioral analysis, a Virtual Machine (VM) is essential. Software like VirtualBox or VMware Workstation allows you to run a full operating system (e.g., Windows XP/7/10) within your current OS.

Key setup steps:

• Install VM software.
• Create a new VM with a guest OS.
• Configure network settings (often 'Host-Only' or 'NAT' to isolate).
• Take a snapshot of a clean state!

One of the most powerful tools for local analysis is Process Monitor (ProcMon) from Sysinternals. It captures real-time file system, Registry, and process/thread activity.

When malware runs, ProcMon logs every action, like creating files, modifying registry keys, or launching new processes. It's a treasure trove of data!

Malware often communicates with external servers (Command and Control, or C2). Monitoring network traffic is vital.

Tools like Wireshark capture raw network packets, while Fiddler (for HTTP/S) acts as a proxy to show web requests. Look for unusual IP addresses, domain names, or data exfiltration.

Malware frequently modifies the Windows Registry for persistence (to run on startup) or to alter system settings. It also drops new files (executables, DLLs) or modifies existing ones.

Tools like ProcMon or Regshot (which compares registry snapshots) help identify these changes. Always look for new entries in common startup locations!

After running malware, you'll have a lot of data. Here's what to look for:

• New processes: Did the malware launch anything else?
• File system changes: New files, deleted files, modified files.
• Registry modifications: Especially in startup keys like Run.
• Network activity: Connections to suspicious IPs/domains, unusual ports.

Which of the following are common indicators of malicious activity you would look for during basic behavioral analysis?

Great job! You've learned the fundamentals of basic behavioral analysis.

• We use sandboxes (local VMs or cloud services) to safely execute malware.
• Tools like Process Monitor track system changes.
• Wireshark and Fiddler help analyze network traffic.
• We look for new processes, file changes, registry modifications, and suspicious network connections to understand malware's intent.

Keep practicing in your isolated lab!