Malware Forensics, Persistence and Behavior Analysis

What it is

Malware forensics answers three questions: what is this file, what did it do to the system and how does it survive a reboot. The investigator works in an isolated lab, never on a production machine.

This page covers static and dynamic analysis, malicious documents, persistence in the registry and elsewhere, system behavior monitoring, artifact analysis and a fileless loader called Gootloader.

How it works

Static and dynamic malware analysis

Static checks include the hash (look it up, do not upload sensitive files), readable strings, the PE section table, the import table and high entropy that suggests packing. Dynamic analysis uses a virtual machine with a snapshot that is reverted after each run, with the network simulated or tightly controlled.

Analyzing suspicious Word, Excel and PDF documents

Office files carry malware mainly through macros (VBA) that run on events such as AutoOpen or Document_Open. The older binary formats (.doc, .xls) and macro enabled formats (.docm, .xlsm) can hold macros, while plain .docx and .xlsx cannot. Other tricks are Excel 4.0 macros, DDE fields and remote templates.

PDF files can contain JavaScript and automatic actions. Suspicious keywords in the file are /JavaScript, /JS, /OpenAction, /AA, /Launch and /EmbeddedFile.

Analyze without opening the document in its normal application, and never enable macros on the evidence copy.

Registry based malware persistence

Persistence also exists outside the registry: scheduled tasks, Startup folders and WMI event subscriptions.

Identifying malware persistence

Compare the current autostart entries with a known good baseline.

• Sysinternals Autoruns lists every autostart location in one view.
• reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run shows one key.
• schtasks /query lists scheduled tasks.
• Look for event 7045 (service installed) and 4698 (task created).
• Offline, parse hives with RegRipper or Registry Explorer.

Entries that point to temp folders, user profile paths or oddly named files deserve a closer look.

System behavior analysis: registry, processes, services, startup, logs, API calls, drivers

Take a before and after view of the system. Regshot compares registry and file snapshots. Process Explorer and Process Hacker show process trees, loaded DLLs and unsigned code. Commands such as tasklist /svc, sc query and driverquery list processes, services and drivers. Windows event logs show new services, logons and PowerShell use. API Monitor or a debugger shows API calls such as file, registry, process and network functions, which reveal intent. Unsigned or unexpected drivers may indicate a rootkit.

System behavior analysis: installation and system call monitoring

Installation monitoring records everything changed when a program is installed or run: new files, folders and registry keys. System call monitoring watches the calls a process makes to the OS. On Windows, Process Monitor shows file system, registry, process and thread activity. On Linux, strace traces system calls.

System behavior analysis: files, folders, network, ports and DNS

Lab tools such as FakeNet-NG or INetSim simulate network services so the malware shows its requests without reaching the real internet.

Artifact analysis for suspicious or malicious content

Combine what you found into indicators of compromise: file hashes, file names and paths, registry keys, mutex names, IP addresses and domains. Detection rules such as YARA describe patterns in files, for example:

rule Suspicious_Cmd {
  strings:
    $a = "cmd.exe /c" ascii
  condition:
    $a
}

Check hashes with a reputation service, record the first seen times from file system and Prefetch data, and hash every artifact you extract.

Gootloader fileless malware analysis

Gootloader is a JavaScript based loader. Victims reach it through search engine poisoning, where a compromised site shows a fake forum answer or document template. The download is an archive holding an obfuscated .js file, which Windows Script Host (wscript.exe) runs.

The script then starts PowerShell and loads further payloads into memory, with persistence reported through scheduled tasks or shortcuts. Some reported variants keep encoded data in the registry. "Fileless" means the final payload is not a normal file on disk.

A worked example

A user opens an Excel file from an email. Process Monitor shows excel.exe spawning powershell.exe, which writes update.exe to %APPDATA% and adds a Run key value. Regshot confirms the new key and Wireshark shows a connection to an unknown domain every 60 seconds.

The analyst records the hash of update.exe and the domain and key as indicators. The static review of the macro with olevba confirms the download command.

How the exam asks about this

• "Which analysis type executes the sample in a sandbox?" -> Dynamic analysis.
• "Which registry key runs a program at every user logon?" -> The Run key (HKCU or HKLM).
• "Which Sysinternals tool lists every autostart location?" -> Autoruns.