[EP_X0FF]

Here is your bat

Code: Select all

:l
if not exist "C:\DOCUME~1\User\0016~1\F29E35~1.BIN" goto e
del /Q /F "C:\DOCUME~1\User\0016~1\F29E35~1.BIN"
goto l
:e
del /Q /F "C:\DOCUME~1\User\APPLIC~1\4763869.bat"

What you want is ready-to-use AV style sandbox (with detailed logs, all data collection and timed memory dumps). No Sandboxie cannot do this. It is still "Sandbox IE" nothing more.

Additionally it is kinda strange that you cannot extract this bat yourself, especially when this sample drops it at first usual breakpoint.

[Buster_BSA]

Sandboxie does not save the file because the file would not be saved if you run the malware in a real system, so it is perfectly normal.

I understand that, but I want to have the file saved, it's essential for further investigate how the malware works.

So Sandboxie does not save dropped files?

Sandboxie is just a sandbox software, not a malware analysis tool.

If you want to keep all files, then you should use other contributed utility like this:

http://forums.sandboxie.com/phpBB3/view ... 22&t=16656

[rnd.usr]

Additionally it is kinda strange that you cannot extract this bat yourself, especially when this sample drops it at first usual breakpoint.

Yes, but maybe I want to create an automated analysis tool based on BSA that collects all dropped files and so on?

Nah, but I just pointed out that Sandboxie did not save dropped files which is basic stuff for dynamic analysis. Dammit, this is an easy malware, can almost use notepad as disassembler lol.

Sandboxie is just a sandbox software, not a malware analysis tool.

If you want to keep all files, then you should use other contributed utility like this:

http://forums.sandboxie.com/phpBB3/view ... 22&t=16656

Was exactly what I was looking for! Huge thanks and case closed :)

[EP_X0FF]

Additionally it is kinda strange that you cannot extract this bat yourself, especially when this sample drops it at first usual breakpoint.

Yes, but maybe I want to create an automated analysis tool based on BSA that collects all dropped files and so on?

A very bad idea.

1) SandboxIE restricts most of actions that application can do. Some apps will crash, some do not work, some work in totally restricted mode.
2) Most of malware aware about sandboxie and in comparison to VM sandboxie cannot be hidden from sophisticated detection.
3) Running actual malware on your own PC even if it "sandboxed" is a high risk. Bugs and exploits inside sandboxie are present and unknown and in comparison to true VM they will directly affect on your actual environment.

Your results will be incomplete and wrecked.

If you look for automated analysis tool then virtual machine + your own behaviour logger is the only way. That's how Anubis, malwr, CAMAS, VirusTotal etc works.

[Buster_BSA]

If you look for automated analysis tool then virtual machine + your own behaviour logger is the only way. That's how Anubis, malwr, CAMAS, VirusTotal etc works.

The ideal would be a software like Cuckoo Sandbox (malwr) with the features/reports from BSA. The most similar to that is Joe Sandbox but it is not public.

[rnd.usr]

If you look for automated analysis tool then virtual machine + your own behaviour logger is the only way. That's how Anubis, malwr, CAMAS, VirusTotal etc works.

Yup, I have my very own machine for automatic analysis. It's basically Virtualbox with --nictrace and dumpguestcore and 2 tools(API-sniffer and RWX-dumper). It's not the best tool but it's always fun to create your own thing. I've tried Cuckoo but the behavioral function never works for me.

The problem is that my tools kinda sucks. I have no program to monitor the I/O(filemon sucks because it does not store buffers), so that's why I'am in this thread looking for solutions. Although I've got an answer from Buster_BSA the problem about more advanced malware occur, like kernel hooks and code injection/process replacement/bootkits will fail in Sandboxie.

I have physical machines running XP and W7, but no tools.. So if you guys have any good tips on tools I'll be very happy to hear them.

[EP_X0FF]

If you look for automated analysis tool then virtual machine + your own behaviour logger is the only way. That's how Anubis, malwr, CAMAS, VirusTotal etc works.

Yup, I have my very own machine for automatic analysis. It's basically Virtualbox with --nictrace and dumpguestcore and 2 tools(API-sniffer and RWX-dumper). It's not the best tool but it's always fun to create your own thing. I've tried Cuckoo but the behavioral function never works for me.

The problem is that my tools kinda sucks. I have no program to monitor the I/O(filemon sucks because it does not store buffers), so that's why I'am in this thread looking for solutions. Although I've got an answer from Buster_BSA the problem about more advanced malware occur, like kernel hooks and code injection/process replacement/bootkits will fail in Sandboxie.

I have physical machines running XP and W7, but no tools.. So if you guys have any good tips on tools I'll be very happy to hear them.

Have you looked how for example camas or vt/malwr (vbox vm) do this monitoring?

[rnd.usr]

Have you looked how for example camas or vt/malwr (vbox vm) do this monitoring?

Well, yes. First of all is Cuckoo using Cuckoomon: https://github.com/cuckoobox/cuckoomon for it's hooking and monitoring. Then there's the Behavior-plugin: https://github.com/cuckoobox/cuckoo/blo ... ehavior.py

So yeah, there's a lot to learn if I want to hack something out of an already working(not for me) auto-analysis VM. I think the best way is just to keep it simple as possible.

I have one method, it's by compare the original disc image with the disc after I ran the malware, then I can find some files(not wipe:d). I need some automated machines because I kinda want to build something that Xyli did with Zbotscan. Now that malwr uses an API I can use that one and then code an parser for grepping the whole report, but jeez that's not professional.

Do you remember dirwatch_uifrom SysAnalyzer? Is basically exactly what I want because it saves files on modification. I mean, is it hard to just build a driver that hooks NtCreateFile and NtDeleteFile and does like "copy on write"-kinda thing?

[bao]

Buster_BSA, Would you please add a possibility to choose a viewer to view reports?

[Buster_BSA]

Buster_BSA, Would you please add a possibility to choose a viewer to view reports?

If I release a new version of BSA I will include the option.