How can I capture files malware creates and then deletes? [closed]

Question

Closed. This question needs to be more focused. It is not currently accepting answers.

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 6 years ago.

Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?

You can use tools within the Remnux Linux Distribution to analyze malware statically and dynamically which would include file deletes, additions, registry edits, network changes, etc. etc. One good tool is called Mastiff but, there a a-lot of good tools. I would recommend looking at Remnux. — Joshua Faust, Jul 6, 2017 at 13:20

xvk3 · Accepted Answer · 2017-07-06 14:48:32Z

The Sysinternals Suite contains a variety of tools, many of which can be used for dynamic malware analysis.

Process Explorer shows useful information about the running processes on a system

ProcMon monitors process activity showing information such as:

and more.

In order to capture file before they are deleted: I would hook "NtDeleteFile" or the specific API the process is calling.

Filtering the calls to that function would prevent the process from deleting certain files.

This could be implemented in a Dynamic Link Library and injected into the target process.

1 Answer 1