Perform Dynamic Malware Analysis
Overview
Execute only inside an environment chosen by select-analysis-isolation and preflighted by prepare-isolated-analysis-lab, with an observation plan that can distinguish artifact behavior from baseline noise. Preserve the exact sample, prepared-lab record, and environment identity.
Read references/dynamic-observation-plan.md for baseline, stimulus, telemetry, and teardown fields.
Workflow
- Define the unresolved question and minimum stimulus.
- Verify isolation.
- Require the prepared-lab record and verify its guest/platform build, baseline/reset state, accounts, shares, clipboard, devices, credentials, network mode, monitoring, stop controls, export path, and teardown plan are still current.
- Record virtualization artifacts or anti-VM behavior that may affect the conclusion.
- Capture a baseline.
- Record processes, files/registrations, persistence surfaces, network state, services, and relevant logs before execution.
- Execute one controlled step.
- Record command/UI action, time, user/privilege, environment variables, arguments, and interactions.
- Do not improvise additional payloads, credentials, or targets.
- Observe behavior.
- Correlate process tree, file/registry or platform state, persistence, permissions, child artifacts, network/DNS, logs, prompts, crashes, and timing.
- Hash and preserve dropped/modified artifacts as new evidence.
- Repeat only to answer a named question.
- Change one variable at a time and revert to the baseline snapshot.
- Export and tear down.
- Export only intended evidence, scan it before host use, destroy/revert the environment, and revoke temporary access.
Output
Return the prepared-lab identity, environment/baseline identity, stimulus, observed timeline, artifacts and indicators, absent expected behavior, virtualization/evasion/coverage limits, conclusion, and teardown verification.
1---2name: perform-dynamic-malware-analysis3description: Observe suspicious content in a disposable environment. Use when execution, process ancestry, file changes, persistence, network behavior, payloads, or user interaction need measurement after static analysis with isolation and teardown.4---56# Perform Dynamic Malware Analysis78## Overview910Execute only inside an environment chosen by `select-analysis-isolation` and preflighted by `prepare-isolated-analysis-lab`, with an observation plan that can distinguish artifact behavior from baseline noise. Preserve the exact sample, prepared-lab record, and environment identity.1112Read [references/dynamic-observation-plan.md](references/dynamic-observation-plan.md) for baseline, stimulus, telemetry, and teardown fields.1314## Workflow15161. Define the unresolved question and minimum stimulus.172. Verify isolation.18 - Require the prepared-lab record and verify its guest/platform build, baseline/reset state, accounts, shares, clipboard, devices, credentials, network mode, monitoring, stop controls, export path, and teardown plan are still current.19 - Record virtualization artifacts or anti-VM behavior that may affect the conclusion.203. Capture a baseline.21 - Record processes, files/registrations, persistence surfaces, network state, services, and relevant logs before execution.224. Execute one controlled step.23 - Record command/UI action, time, user/privilege, environment variables, arguments, and interactions.24 - Do not improvise additional payloads, credentials, or targets.255. Observe behavior.26 - Correlate process tree, file/registry or platform state, persistence, permissions, child artifacts, network/DNS, logs, prompts, crashes, and timing.27 - Hash and preserve dropped/modified artifacts as new evidence.286. Repeat only to answer a named question.29 - Change one variable at a time and revert to the baseline snapshot.307. Export and tear down.31 - Export only intended evidence, scan it before host use, destroy/revert the environment, and revoke temporary access.3233## Output3435Return the prepared-lab identity, environment/baseline identity, stimulus, observed timeline, artifacts and indicators, absent expected behavior, virtualization/evasion/coverage limits, conclusion, and teardown verification.
gaelic-ghost