Lesson 7 of 9 · 26m

Behavioral Analysis: Watching It Live

Instrument before you detonate, cut Procmon noise, read the process tree as a story, and hunt the persistence locations that matter — then diff against a clean baseline.

Static analysis tells you what a sample could do. Behavior tells you what it did, on a machine like yours, in an order you can put in a timeline. The discipline is the same every time: baseline, instrument, detonate, diff, revert. Skip the baseline and you will eventually report Windows Update as persistence.

Instrument before you detonate

# Analysis VM, freshly reverted to "clean-baseline"
sysmon64.exe -accepteula -i C:\Tools\sysmonconfig.xml
autorunsc64.exe -accepteula -a * -c -h -s -nobanner > C:\Analysis\autoruns_before.csv
Procmon.exe /AcceptEula /Quiet /Minimized /BackingFile C:\Analysis\run1.pml
# REMnux side:  sudo inetsim   and   sudo tcpdump -i ens33 -w run1.pcap

Detonate, give it at least five minutes, then Procmon.exe /Terminate, take autoruns_after.csv, and diff. Autoruns with -h -s gives you hashes and signature status, so the new unsigned entry stands out immediately.

Cutting Procmon noise

A five-minute capture is millions of events. Filter for intent, not volume:

Process Name is the sample and its children — use the Process Tree view to collect child PIDs.
Operation is Process Create, WriteFile, RegSetValue, TCP Connect, Load Image.
Exclude C:\Windows\Prefetch, the Procmon backing file, and your own tooling.

Read the process tree as a story

WINWORD.EXE (2140)  invoice_0412.doc
 └─ cmd.exe (4410)  /c powershell -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQA...
     └─ powershell.exe (5512)  -> writes C:\Users\Public\kx.dat
         └─ rundll32.exe (6020)  C:\Users\Public\kx.dat,DllRegisterServer
             └─ CreateRemoteThread -> explorer.exe (1984)   [Sysmon EID 8]

That -enc blob is base64 of UTF-16LE text; SQBFAFgAIAAoA decodes to IEX (. Office spawning a shell is the initial-access tell; a signed rundll32.exe loading a .dat from a world-writable folder is the execution tell; the remote thread into explorer.exe explains why the sample's own process later disappears. Filter Procmon on the original filename only and you see none of this — living-off-the-land malware does its work in children of signed binaries.

Sysmon events that carry the weight

EID	Event	What you're looking for
1	Process create	Command lines, parent/child chains
3	Network connection	Which process talked, to what port
8	CreateRemoteThread	Injection into another process
10	Process access	`lsass.exe` opened = credential theft
11	File create	Dropped payloads, staging folders
13	Registry value set	Run keys, service config
22	DNS query	Domains, with the process that asked

Persistence: where to look

HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce (and the HKLM twins when it had admin)
Scheduled tasks: C:\Windows\System32\Tasks\, or schtasks /query /fo LIST /v
Services: HKLM\SYSTEM\CurrentControlSet\Services
Startup folders, COM hijacks under HKCU\Software\Classes\CLSID\{...}\InprocServer32
WMI subscriptions: Get-CimInstance -Namespace root\subscription -ClassName __EventFilter

Field notes

Behavior is conditional. No reachable C2 often means no stage two; standard user vs admin changes HKCU vs HKLM persistence. Note which conditions you tested.
Record the wall-clock time you detonated so pcap, Procmon, and Sysmon line up.
Revert after every run. Persistence from run one will look like "re-infection" in run two.
The injected explorer.exe is a host artifact IR can hunt for — hand it over (lesson 9).