Absolutely.
And talking about document malware, this leads into exactly what else you need
to do to your operating system in order to make it look real. You want to go
in and you want to install software onto the VM to make it look real. Install
Office, install Adobe, install Chrome or Firefox or other programs that are
commonly used. If you want to simulate like a user environment, like a home
user environment,
go in and install something like Steam or some other programs that
somebody would use on their desktop or at their home.
I can place the Pokemon card game on there.
Yeah, and install that in there.
And just so that the malware, when it gets on there, it can
it look, when it starts looking around,
it looks like it's in an actual system and not in this
barren computer that's probably analyzing it.
That makes me think of something else to. Are we looking at‑‑‑we've
made this OS. Is there an install date or like, This OS has existed
since this time on this device. Is that something we need to be
concerned about as well? You know,
that's not a bad idea. The install date is
typically‑‑‑there're actually multiple ways within
Windows that you can find out the install date.
There's a location in the registry.
There are specific files in the file system that you
can look at the timestamp for.
I would recommend that if you're concerned about that to at least go into
the registry and find the registry key that contains the install date and
modify that, maybe to something before what you expect because malware
could go in there and say, Hey, this system is only three days old,
even though it has all this software. That doesn't quite make sense.
So it may use that as a check.
Yeah, absolutely.
And even, and this goes into,
I don't know how many tools you have that can change this type of thing,
but even the amount of runtime,
like how long has this thing been running since its existence.
And that's the nice thing too about snapshots is we
could take a snapshot of a week ago,
and if we restore that snapshot now a week later and it's in a running format,
and I do recommend that when you take snapshots, do it where the VM is
running so you don't have to wait for it to boot up.
But when you restore that snapshot, it's going to look at the current date,
and it's going to update that.
And then it will look like it's been running for a week or however long.
Yeah, that's smart.
So It's almost nice to have this stuff set up, have your
lab ready, and there's a benefit to having a well‑aged
malware analysis platform. Exactly.
When you're talking about documents, and we need to
because obviously in enterprise,
you're not just turning on Windows and playing solitaire all day,
at least not normally. You at least act like you do work.
Right. So you're going to have Office on there.
You're going to have Office documents there then. You did do a
document analysis course for malware document analysis.
And in that, we talk about a tool where it will create Office documents
and modify them and use them so that that looks real.
Yeah, so a lot of malware,
one of the things that it does in order to make sure
that the system that it's on is real,
it will look at the number of documents that you've recently opened.
And this type of thing is stored in the registry. All it has
to do is query very specific registry keys that contain your
most recently used documents.
There's a great tool called Lazy Office Analyzer.
And what Lazy Office Analyzer does, its sole purpose really is to go
in and kind of automate the analysis of Office documents, but one of
the nice things about it is it will go in, and it will kind of add
these registry entries in for you.
So it does look like your system has opened a whole bunch of
Office documents and and other types of documents.
If you don't want to use Lazy Office Analyzer, then really what I would
recommend doing is just going in and opening a bunch of documents.
Download a bunch of PDFs or throw a bunch of Word docs on there or Excel
docs and then open them all up so that these registry entries do get
populated, and so malware when they get on there and they look in there
and they say, Well, how many files have they opened up recently?
It looks like you've actually opened up documents.
It looks like this is a computer that you actually use.
Perfect.
Yeah,
that's a one time deal. It doesn't take too much effort to grab some
documents, and then you snapshot that, and then you're good to go. A
couple of minutes, and then you're good.