Narrator: In this lesson, we will learn
about malware analysis.
Malware analysis is examining malicious software
to understand its behavior, impact,
and potential indicators of compromise or IoCs.
Malware analysis concepts include sandboxing,
malware detonation, and IoC extractions.
Sandboxing is a technique that isolates applications
or processes in a controlled environment
to prevent them from affecting the rest of the system.
This isolation allows the safe execution
and analysis of potentially harmful code.
Next, malware detonation is the process
of running the malware within the sandbox
to trigger its full functionality.
Finally, IoC or indicator of compromise extraction
identifies key artifacts such as file hashes,
IP addresses, or domain names that can be used
to detect or block future attacks.
Let's learn more about sandboxing, malware detonation,
and indicator of compromise, or IoC extractions.
First, we have sandboxing.
Sandboxing is a key method in malware analysis
that isolates potentially dangerous code
or applications in a secure, controlled environment.
This controlled environment allows analysts to execute
and observe the code without the risk of it spreading
or infecting other systems.
By isolating the malware, sandboxing enables analysts
to see exactly how the malware behaves,
including any modifications it makes to files,
the registry, or network connections.
This process in forensic investigation helps
security professionals understand the capabilities
and intent of the malware without risking
broader system compromise.
The importance of sandboxing lies in its ability
to contain the threat while providing valuable insights.
Since modern malware often has features
that try to detect whether it is being analyzed,
sandboxing must be done in a way
that mimics a real system environment closely.
Tools like Joe Sandbox, Cuckoo Sandbox,
and FireEye are popular options
for running malware in isolated conditions.
These tools monitor various aspects of the system
to detect changes made by the malware,
allowing analysts to gather data
without causing harm to other systems.
A practical example of sandboxing
could involve a security analyst
investigating a suspicious email attachment.
Instead of opening the attachment on their primary system,
the analyst may upload it to a sandbox tool
such as Cuckoo Sandbox.
The sandbox allows the attachment to be executed,
monitors the behavior of the resulting malware
and logs any suspicious actions like attempts to reach out
to external IP addresses or download additional payloads.
So by using sandboxing, the analyst gathers
vital information without compromising the broader network.
Second, we have malware detonation.
Malware detonation refers to the process
of intentionally executing malware
in a controlled environment, such as a sandbox,
to observe its full range of actions and behavior.
Unlike static analysis,
which involves examining the malware without running it,
detonation allows for a dynamic understanding
of how the malware operates.
This approach in forensic investigation
helps uncover the specific tactics, techniques,
and procedures or TTPs used by the malware
as well as its potential payloads.
The value of malware detonation becomes evident when dealing
with complex or hidden malware behaviors.
Many advanced threats are designed to remain dormant
or behave benignly unless specific conditions are met.
By detonating the malware in a sandbox,
analysts can force these behaviors to trigger,
gaining a more complete picture of the threat.
A tool like Cuckoo Sandbox is commonly used
for this purpose as it allows real-time observation
of everything the malware does, from file manipulation
to network communication attempts.
For example, an analyst may detonate a piece
of ransomware in a sandbox to see how it encrypts files,
which files it targets, and whether it communicates
with any command and control servers.
By doing this, the analyst can learn how to prevent
or respond to the ransomware,
such as by identifying which files are at risk
and where the malware may be sending data.
Malware detonation thus provides essential clues
in developing countermeasures and improving system defenses.
Third and last, we have indicator of compromise
or IoC extractions.
IoCs are the pieces of evidence left behind
by malicious activity.
These may include file hashes, IP addresses, domain names,
URLs, or even specific patterns in log files.
Extracting these IoCs from malware analysis
enables detecting and mitigating future attacks.
In forensic investigations,
IoC extraction helps build a threat profile,
enabling security teams to quickly identify
and respond to related threats.
IoC extraction allows organizations
to proactively defend against malware
by using identified indicators in their security systems.
Tools like YARA, or Yet Another Recursive Algorithm,
MISP, or the Malware Information Sharing Platform,
and Splunk can assist in extracting
and correlating indicators of compromise
with known malware behaviors.
This allows security teams to share information
across organizations, creating a collective defense
against widespread threats.
For instance, after detonating malware in a sandbox,
an analyst might extract several IoCs,
such as the IP addresses the malware tries to contact,
and the MD5 hash of the executable file.
These IoCs can then be added to a block list
or shared with the broader threat intelligence community
to help other organizations identify the same malware.
This process helps security teams not only address
the immediate threat, but also harden their systems
against future similar attacks.
So remember, malware analysis involves
studying malicious software
to understand its behavior, potential damage,
and uncovering indicators of compromise or IoCs.
An important part of this process is sandboxing,
where harmful code is isolated in a safe environment,
allowing analysts to observe its actions
without risking other systems.
This leads to malware detonation
where the malware is executed within a sandbox
to trigger its full functionality
and reveal its tactics and techniques.
Finally, IoC extraction follows
where important artifacts like file hashes
or IP addresses are identified, which are used
to help detect and prevent future attacks.