How can I see which files, ports, URLs, etc that are used by a suspicious Windows executable.
This depends on how savvy the programmer of the malicious binary decides to be.
If it's a simple binary I would suggest first downloading Strings for Windows. It's a version of the Linux programs of the same name. It runs through and prints out all strings in a binary. If the binary isn't encoded or packed this should give you what you want to know. Once installed:
- Bring up a command prompt:
WindowsKey + r, type
A lot of output will be printed to the screen. You can use
strings <binary_name>.exe > output.txt to write it to a file.
If the binary is packed or encoded the easiest way to analyze a Windows binary for these things is a tool called PE Insider or CFF Explorer. PE Insider allows you to quickly look at the Portable Executable's headers, performs quick decompilation, and simple analysis. CFF Explorer allows you to decode and unpack other resources within the binary.
The links provided should give you enough resources on how to use those tools. For more information on malware analysis you can checkout How to Analyze a Piece of Malware, and Topics to Know When Analyzing Malware.