Dynamic and Behavioral Analysis: Building a Heuristic Detector

In Lab 1 you triaged a binary without ever running it: you read its

structure, its imports, and its entropy. That is static analysis, and a

determined author can hide from it with packing, encryption, and dynamic

API resolution. In this lab we take the opposite approach. We

detonate the sample inside an isolated virtual machine and watch

what it actually does — the files it writes, the registry keys it

sets, the processes it spawns, and the hosts it tries to reach. Then you

will teach a program to read that behavior and decide, on its own, whether

the sample is malicious.

The goals of this lab:

• Safely detonate an unknown sample inside an isolated Windows 10 analysis VM (host-only, no real internet).
• Capture runtime behavior across four channels: file system, registry, process/thread, and network.
• Recognize behavioral indicators and map them to MITRE ATT&CK-style tactics: persistence, process injection, C2 beaconing, and defense evasion.
• Automate detection by scoring captured behavior programmatically in lab4_behavior.py, turning raw events into a verdict.

Background

Static vs. Dynamic Analysis

Static analysis inspects a program at rest. It is fast and safe

but blind to anything the program only reveals at runtime. {Dynamic

analysis} runs the program and observes its effects. It sees through

packing and obfuscation — the unpacked code must eventually execute — but

it only reveals the behavior that happens to fire during the observation

window, and it requires a safe place to run malware. The two techniques are

complementary; a real analyst uses both.

The Sandbox Concept

A sandbox is a disposable, instrumented, and isolated

environment in which you can run untrusted code and record everything it

does. Ours is a Windows 10 VM on Dr. Chen's Badger infrastructure,

reachable through Guacamole in your browser. It has three properties that

make it safe: a clean snapshot you revert to before and after

each run, an isolated network with no route to the real internet,

and instrumentation tools that log the sample's activity.

What Each Tool Captures

• Procmon (Process Monitor, Sysinternals) — real-time file system, registry, process/thread, and basic network events. This is your primary sensor and the source of the CSV you will score.
• Regshot — a before/after diff of the registry and file system. Take a "1st shot" before detonation and a "2nd shot" after; the diff isolates exactly what changed.
• FakeNet-NG / INetSim — fake internet. They answer the sample's DNS, HTTP, and TCP requests so you can observe C2 attempts without a real network connection.
• Wireshark — full packet capture of the sample's network traffic (domains, IPs, ports, payloads, user-agent strings).
• Autoruns (Sysinternals) — enumerates every autostart location on the system, making persistence easy to spot.

A Taxonomy of Behavioral Indicators (MITRE ATT&CK-style)

Malware behavior is not random; it clusters into a small number of

tactics. Learn to recognize these and you can classify almost any

sample:

• Execution — getting code to run, often via a helper interpreter. Example: spawning powershell.exe -enc <base64> or wscript.exe as a child process.
• Persistence — surviving a reboot. Examples: a ...\textbackslash CurrentVersion\textbackslash Run registry value, a file dropped into the Startup folder, a scheduled task (schtasks.exe), or a new Windows service.
• Privilege Escalation — gaining higher rights, e.g. a UAC-bypass or a service that runs as SYSTEM.
• Defense Evasion — hiding or disabling protections. Example: writing DisableAntiSpyware to disable Microsoft Defender, or clearing event logs.
• Discovery — surveying the machine: querying the computer name, enumerating processes, or reading ...\textbackslash CurrentVersion for OS version.
• Command-and-Control (C2) — phoning home. Example: a periodic DNS beacon or HTTP request to a hard-coded domain on a fixed port, often with a recognizable user-agent.
• Impact — the payoff. Example: mass file encryption (ransomware) preceded by deletion of Volume Shadow Copies (vssadmin delete shadows) to block recovery.

Concrete markers you will hunt for in this lab: a Run-key write, a

scheduled task, a service install, a CreateRemoteThread-style

injection (the VirtualAllocEx → WriteProcessMemory

→ CreateRemoteThread sequence), a DNS beacon, Defender being

disabled, and mass file encryption.

title={SAFETY AND LEGAL WARNING -- READ BEFORE YOU START}]

You are about to run live malware. Treat it accordingly.

• Never run lab4_sample.bin on your own computer, your phone, a lab desktop, or any machine connected to a real network. Detonate only inside the assigned isolated analysis VM.
• Confirm the VM network is host-only / isolated and that FakeNet-NG (or INetSim) is running before you detonate. There must be no route to the real internet.
• Revert to the clean snapshot before you begin, and revert again when you are done. Do not save the infected state.
• Do not copy the sample out of the VM, email it, upload it to a public scanner from a personal account, or share it. Handling malware carelessly can violate law and university policy.
• If anything behaves unexpectedly (the VM tries to reach the real network, files start disappearing on a shared drive), power off the VM immediately and notify the instructor.

Experiment Setup

• Log in to the analysis VM through Guacamole using the URL and credentials posted on the course website.
• Revert the VM to its clean snapshot. Always start from a known-good state.
• Confirm the network is isolated: verify the adapter is host-only and start FakeNet-NG (or INetSim). Leave it running for the whole exercise. Open an Administrator command prompt and run FakeNet-NG: fakenet Leave this window open — it logs every connection the sample attempts.
• Launch Regshot, choose "Scan dir1" as C:\textbackslash (or the folders of interest), and take the 1st shot.
• Start Procmon. Clear the display (Ctrl+X) so the capture is clean, and confirm capture is on (Ctrl+E toggles it).
• Optionally start a Wireshark capture on the host-only adapter so you have a full packet record.
• Copy the provided sample lab4_sample.bin from the shared folder into a working directory such as C:\textbackslash Analysis\textbackslash on the VM. Do not run it yet.

Lab Exercise

Task 1 — Detonate and Capture

With Procmon capturing and FakeNet-NG running, detonate the sample and let

it run for about 60 seconds so its behavior unfolds.

1. In Procmon, confirm capture is ON (Ctrl+E). 2. Double-click lab4_sample.bin (or run it from the command prompt). Start a timer. 3. After ≈60 seconds, stop the Procmon capture (Ctrl+E). 4. In Regshot, take the 2nd shot, then click Compare to produce the before/after diff. 5. Save the Procmon log as CSV: File -> Save -> comma-separated values (CSV). Note the file path — you will feed it to lab4_behavior.py in Task 4.

Task 2 — Persistence and Injection

Now characterize how the sample survives a reboot and whether it tampers

with other processes. Open Autoruns to see every autostart entry,

and use Procmon filters to zoom in.

Useful Procmon filters (Filter -> Filter...): Operation is RegSetValue — catches Run-key / service writes. Operation is Process Create — catches spawned children. Path contains Run — narrows to autostart registry writes. In Autoruns, check the Logon and Scheduled Tasks tabs.

For injection, look for the tell-tale Windows API sequence used to run code

in another process: VirtualAllocEx (allocate memory in the target)

→ WriteProcessMemory (copy the payload in) →

CreateRemoteThread (start it). In Procmon you will see the sample

opening a handle to another process and, in Autoruns/Task Manager, the

payload running under a host process it did not create.

Task 3 — Network / C2

With FakeNet-NG answering requests and Wireshark capturing, examine what

the sample tries to reach. FakeNet-NG's console lists every DNS query and

connection; Wireshark shows the raw packets.

In Wireshark, apply display filters such as: dns — see the domains the sample resolves. http — see requested URLs and the User-Agent header. tcp.port == 443 || tcp.port == 8080 — common C2 ports. Follow a stream (right-click -> Follow -> TCP Stream) to read the beacon.

Task 4 — Automate the Detection (deliverable core)

Manually reading a Procmon log does not scale. In this task you complete

lab4_behavior.py so that it parses your exported Procmon CSV,

applies a set of behavioral rules, accumulates a weighted score, and prints

a verdict. The skeleton already scores four indicators — Run-key

persistence, Startup-folder drops, suspicious child processes, and outbound

network attempts — and runs against a tiny embedded sample so you can try

it immediately.

Run the skeleton as-is on the embedded sample: python3 lab4_behavior.py 4pt] Then run it on the CSV you exported in Task 1: python3 lab4_behavior.py --csv Logfile.CSV

Your job: add at least two more rules in the build_rules()

TODO block. Good candidates are a Defense Evasion rule (the sample

disabling Microsoft Defender via a DisableAntiSpyware registry

write) and an Impact rule (deletion of Volume Shadow Copies via

vssadmin delete shadows). Then tune the weights and the verdict

thresholds so the tool's verdict matches your own analysis of the sample.

The core of the scoring engine looks like this:

@dataclass
class Rule:
    name: str                       # short identifier
    tactic: str                     # ATT&CK-style tactic
    weight: int                     # points added when it fires
    match: Callable[[dict], bool]   # predicate over one Procmon event

def is_run_key_write(event):
    if op(event) != "RegSetValue":
        return False
    p = path(event).lower()
    return ("currentversion\\run" in p) or ("currentversion\\runonce" in p)

# TODO (student): add is_defender_disabled(event) and
#                 is_shadow_copy_deletion(event), then register them
#                 as Rule(...) entries in build_rules().

Task 5 — Write-up (Behavior Report)

Produce a short behavior report that another analyst could act on.

Summarize the Indicators of Compromise (IOCs) you collected:

• File hashes — the SHA-256 of lab4_sample.bin and of any files it dropped.
• Dropped files — full paths of files the sample created.
• Registry keys — persistence and configuration keys it wrote.
• Network indicators — domains, IPs, ports, and User-Agent.
• Behavior summary — one paragraph mapping the sample's actions to the ATT&CK-style tactics from the Background section.

Hints

Review Class 8: Dynamic Analysis and Sandboxing for a walkthrough

of Procmon filtering, the Regshot before/after workflow, and reading a

FakeNet-NG capture. When Procmon feels overwhelming, remember: filter

aggressively (by process name first, then by operation), and let the

Regshot diff tell you where to look.

Deliverables

• A detailed project report in PDF format answering Q1—Q4 and containing the Task 5 behavior report, with screenshots of Procmon, Regshot diff, Autoruns, and the FakeNet-NG/Wireshark capture.
• Your completed 0 with the two (or more) added rules and tuned thresholds.
• An excerpt of the exported Procmon CSV showing the events that triggered your rules.

Submission

• The lab due date is available on our course website. Late submission will not be accepted;
• The assignment should be submitted to D2L directly.
• Your submission should include: A detailed project report in PDF format to describe what you have done, including screenshots of the final result, along with your completed lab4_behavior.py and the Procmon CSV excerpt.
• {No copy or cheating is tolerated}. If your work is based on others', please give clear attribution. Otherwise, you {WILL FAIL} this course.