Doing different types of analysis
Last updated
Last updated
We will be using the attached Remnux VM. Remnux (Reverse Engineering Malware Linux) is a Linux distribution purpose-built for malware analysis. It has many tools required for malware analysis already installed on it.
What is Pecheck?
The PE File Header contains the metadata about a Portable Executable file. This data can help us find a lot of helpful information to help us in our analysis.
Pecheck also shows us the functions that a PE file imports. In the above terminal window, we can see the IMAGE_IMPORT_DESCRIPTOR, which shows the functions it imports from the ADVAPI32.dll Linked library. We will see similar descriptors for all the other linked libraries whose functions are imported by the sample.
While basic static analysis provides us with useful information about a sample, most times, we need to perform additional analysis to move further in our analysis procedure. One quick and dirty way to find more clues about a malware's behavior is by performing basic dynamic analysis. Many of the properties of a malware sample can be hidden when it's not running. However, when we perform dynamic analysis, we can lay these properties bare and learn more about the behavior of a malware sample.
I can search for the hash of the sample previously found. Therefore, I will search for the md5sum of the wannacry sample from the attached VM. I will see that it is already submitted multiple times, and can choose from the submitted results.
Now that i've clicked on the interface for one of the samples. I can see a navigation pane on the right that highlights different parts of the report. I can also see that the verdict is malicious, with a threat score of 100/100 and AV detection of 95%. Below that, we see the overview of the sample's behavior. Below that, I can see the mapping to MITRE ATT&CK techniques. I will see the following mapping when I click view all details.
Below that, I can see some indicators and context information and some static analysis information for the sample. The dynamic analysis part comes below that:
This part provides us with a lot of information about the behavior of the sample when it was run in a sandbox. I can click each process to find more detail about it. In the above screenshot, of particular interest can be the executions of cmd.exe. I can see that the sample is running script files and deleting backups and volume shadow copies, something often done by ransomware operators to stop the victim from restoring their files from these sources.
Below this section, I will see network analysis of the sample:
Extracted strings and extracted files are also available in the report. These can provide information about the batch scripts we saw in the processes above.
And there are comments from the community at the very end. As we might have seen, I can find many pieces of the puzzle that a malware sample is, using the discussed techniques. However, in some cases, these techniques can prove insufficient to make a decision. Let's move to the next task to determine what scenarios can make it challenging to analyze malware.
