>> Moving on after we've done
the automated analysis or if
we choose not to do the automated analysis,
just so we can maintain some type
of secrecy about the activities that we're doing,
we want to begin setting up
a virtual machine so we can do our
static and our dynamic analysis.
Not to go too far in depth
on how to setup a virtual machine,
but there's essentially two, the VM providers.
There's probably a lot more,
but two of your most common,
>> you're going to have VMware and VirtualBox.
>> VirtualBox is going to be a free product that you can
use and you can download
that just by going to the VirtualBox link.
With VirtualBox, it allows snapshot view,
so if you're doing a lot of
this malware analysis and you find
that the malware has done something to your machine,
you can easily revert back
>> to that initial install state.
>> But the good thing about VM is that
the software allows for multiple machines,
>> multiple OSs,
>> and that you can essentially
>> configure a network between
>> those VMs to figure out what
that malware would do in a networked environment.
Then as we talked about earlier,
your VMs will allow for
easy snapshots and rollbacks so in case you
mess something up or the virus
essentially tries to destroy one of your machines,
you can easily roll that back.
After you've installed your virtual machine,
the next thing you're going to want to do is
to find an operating system.
Ideally, it's best to test your virus on
the same operating system as your affected machines.
That way, you can see exactly what's going to happen
on those machines when you start that testing process.
Now essentially, what you're going to
have to do is you're going to have to use
a license from some of the software
>> that you purchased, either with your
>> bulk software purchase or you can go to the
>> Microsoft Developer Technologies website there.
>> They actually offer some free VMs to test out.
There's also a paid version
of Microsoft Developer Technologies.
But if you're wanting to do this,
especially at home just for some training and
testing, you can go to that link and
download a copy of one of those operating systems.
I think it's good for a three month test and trial.
Then also there are
numerous open source versions of Linux
that you can download and
run some of these programs in as well.
But obviously, Linux may have some drawbacks.
It doesn't have necessarily all of
the tools that we're going to discuss here today,
but it is a viable option.
The next thing we have to do is get a sample of
the malware to our system
>> so we can conduct our analysis.
>> Ideally, if it's possible, we want to
refrain from sending the malware across the network.
It just is easiest or best if we don't send
the malware across the network because it
prevents accidents from occurring.
If we do have to send malware across that network,
procedures I've seen happen is to
essentially establish a network folder with
write-only permissions that allows users to submit
malware but prevents others from
essentially executing the malware accidentally.
Another good TTP to use,
is that if you're going to be sending
malware either to this folder or you're
going to have to email a sample of the malware, you
>> should essentially have a password to protect the file.
>> An example that is going to be
a zip file with password protection.
That way that just again prevents someone from
accidentally clicking and opening that malware.
The best case for transparent malware is using
some type of designated white media device to
essentially download onto your controlled media
and then transporting that to your forensic machine.
However, if you've got a large networked environment
and you're spread across the United States,
you're spread across the globe,
that may not be possible and you might have
to send that malware over the network.
Strings is one of the
first things that we're going to talk
about in our static analysis.
Strings is a good way to get
an idea about the functionality of a program.
With strings, it helps
identify the functions of that file,
it identifies the processes
that are created by that file,
and it identifies the URLs that
the file's trying to connect to.
An example here that we can see on
our next slide is some of the processes that
>> this file is essentially trying to create.
>> I've circled those in red.
As you can see, it's going to start creating file A,
and then find next file A.
Those are some of the things that the file is
essentially trying to do and to create.
Going on, we can see that it's trying to reach out to
an IP address and we have that IP address there.
Those are things that you can block essentially
using your firewall settings
once you identify those IP addresses.
Then moving on, we can see that it's
essentially trying to connect to this URL here.
Those are also things that you can
block within your firewall to
prevent inbound and outbound traffic
coming from those URLs.
One of the next things that we're going to talk
about is unwrapping the malware.
A lot of times when malware writers do
their code, they go on to obfuscate
their codes so that the files are harder to read.
One of the other processes
that we're going to want to do is to
essentially see if that program
has something that packs it and unpacks it.
When a packed program runs,
a wrapper program also is going to run around
that program to unpack that file.
In normal static analysis,
packed files will not be readily apparent.
However, there are tools that you can use like PEiD,
that will be able to tell
you whether or not the files are packed.
In this next slide we have,
it shows an example of
one of the files that we have for analysis
and it shows the type of
file system that is packed within that file.