In this lesson, we will take a look at how most of the companies do malware analysis in recent days,
that is automated dynamic malware analysis.
In this method, we submit the malware sample to an automated malware analysis sandbox.
Now, who builds the sandbox?
There are quite a few commercials sandbox like McAfee, advance threat defence, FireEye, the model number
AX 5550, paloalto's Wildfire, etc..
We also have an open source, sandbox that one can deploy in their environment called cuckoo.
The working principle of the sandbox is the same.
they spin-up one or more virtual machines with different operating system.
Usually a company would spin up all the different operating system and different versions of operating
system they use in their real network.
For example, Windows 10, Windows 10 at a different patch level or service pack level, Windows 2016,
Windows 2019 etc..
They install most of the usual applications like Acrobat Reader, MS office, browsers like Chrome,
Firefox and media players like VLC or quick time, etc..
This is to ensure we create a near real replica of what our users use in everyday work so that if the
malware is taking advantage of a vulnerability in VLC media player, it will run and be able to do its
job.
After building the required virtual machines within the sandbox environment, a administrator or a malware
analyst can submit the samples to these operating systems and sandbox gets into action of analysing
the behavior.
Typically, these sandboxes will look for behaviors like.
When a word file is open, it should only spin up one process that is word dot exe but if it spins
additional processes, then the score is assigned to this sample.
Similarly, Ms word file should not initiate any network activity automatically.
But if network activity is seen after opening the file, the score goes up.
Another behaviour may be opening a legitimate MS word file does not create new files in the operating
system.
If it does, the score goes up again.
Finally, all the scores, due to various activities are added up and given a final score, some vendors
prefer to do it from 0 to 10, and some vendor do it from 0 to 100.
Usually the admin will have the option to configure what to do with the file based on the score.
For example, if the score is less than three mark it as clean file, if the score is between three and
six market as suspicious file.
And if the score is more than six, consider it to be malicious file.
Now, isn't that something sweet, the machine's doing all the hard work for us.
Even though automated sandbox can make the process of malware analysis easy, building a sandbox itself
is very expensive.
When we choose the commercial sandbox options or very tedious process when opted for open source
sandbox like cuckoo.
So in the recent days, piggybacking on the cloud trend, several vendors have taken their sandbox to
cloud.
Few of the popular cloud based sandbox include Any.Run, hybrid-analysis.com, Joesandbox.com,
PaloAlto wildfire.
In case of a cloud based sandbox, all you need is to subscribe to the service and right away you can
start submitting the samples without having to deal with building your own sandbox.
In the next lesson, we will take a look at demonstration of Any.Run sandbox.