[lktp]

Hi there!

Ive been looking around the forum, and im kinda new to malware analysis. I can do some basic stuff, but up till now ive been building my own tools to do before / after comparisons. Ive heard that captureBAT is a good tool but I cant get it to work well with windows 7. Does anyone have any good Open source tools that can be used for this kind of comparison?

Thank you!

[r3shl4k1sh]

CaptureBAT works well under Win 7 32bit using elevated command prompt.

[lktp]

Whenever I try to run it, using the syntax "CaptureBAT.exe -c -l test.txt -n"

i get the following results:

Code: Select all

Option: Collecting modified files
Option: Logging system events to test.txt
Option: Capturing network packets
Error loading kernel driver: CaptureProcessMonitor - 0x000004fb
Error loading kernel driver: CaptureRegistryMonitor - 0x000004fb
FileMonitor: WARNING - Filter driver not loaded (error: 800704fb) waiting 3 seconds to try again ... (try 1 of 5)
FileMonitor: WARNING - Filter driver not loaded (error: 800704fb) waiting 3 seconds to try again ... (try 2 of 5)
FileMonitor: WARNING - Filter driver not loaded (error: 800704fb) waiting 3 seconds to try again ... (try 3 of 5)
FileMonitor: WARNING - Filter driver not loaded (error: 800704fb) waiting 3 seconds to try again ... (try 4 of 5)
FileMonitor: WARNING - Filter driver not loaded (error: 800704fb) waiting 3 seconds to try again ... (try 5 of 5)

[r3shl4k1sh]

You probably have 64bit os.

[lktp]

Your right, it is 64 bit. The other program I have been told is Winalysis, the problem is when i install winalysis 3.1 it will do everything but create the winalysis.exe file to allow you to run the program.

[r3shl4k1sh]

winanlysis is pretty old by now.

If you want to use some automation i would suggest using Process Monitor with Noriben script to automate the analysis of the results.

Noriben: https://github.com/Rurik/Noriben?source=cc

Tutorial on how to use Process Monitor to analyze malware: http://www.irongeek.com/i.php?page=videos/procmon1

[lktp]

Ok thank you very much for your time!