7

Is that possible to trace the actions performed by a virus? Run Time , stolen data and the files consulted and get the relative impact on my pc.?

  • 6
    You could create a honeypot and watch what happens. – hamena314 Mar 23 '16 at 12:00
  • 1
    An easy way to do this would be to use Process Monitor if you're trying to analyze its behavior by running it. This won't help if you're trying to find traces of actions already performed in the past by the virus. – Chirag Bhatia - chirag64 Mar 23 '16 at 14:51
  • 1
    Can you program at all? Starting in Windows Vista, the Windows Kernel generates an enormous amount of event data about every single thing that happens your PC. I mean absolutely everything. There's a convenient .NET library to access all of this called TraceEvent. – user7933 Mar 23 '16 at 16:16
  • Maybe relevant: bugs.chromium.org/p/project-zero/issues/detail?id=769 – kasperd Mar 23 '16 at 16:48
7

I strongly recommend to run that virus in an artificial environment like a sandbox so you won't affect your personal computer! In this way you can track its activity through the sandbox specific CLI/GUI.

Sandbox Example: Cuckoo Sandbox, Sandboxie, etc.

The other way around:

Use an virtual environment to test the malware and to manually track its activity.

  • Familiarise yourself with things like venom when using a VM to track activity: nakedsecurity.sophos.com/2015/05/14/… – hd. Mar 23 '16 at 15:38
  • Thanks for remembering me about the VENOM bug but I don't think it's easy to exploit especially when it was found years ago. I don't negate that there is still a minimal risk of reproduction! – Lucian Nitescu Mar 23 '16 at 15:47
  • 1
    And when I say many years ago I refer to: CVE-2007-1744, CVE-2008-0923, CVE-2009-1244, CVE-2011-1751, CVE-2012-0217, CVE-2014-0983 because that's when it was born the concept of those vulnerabilities. – Lucian Nitescu Mar 23 '16 at 15:52
  • 5
    Don't test a virus in a VM; it might be smart enough to infect the host. – Phil Lello Mar 23 '16 at 16:51
  • @PhilLello read the other comments to this answer ;) – Lucian Nitescu Mar 23 '16 at 20:33
5

After the facts? Very unlikely unless you have full egress logging and remote audit files of the system that was compromised and even then it's not 100% reliable.

If you want to know what a Virus does there's always malware analyzers like Cuckoo.

2

Not clear if you are planning for how to do this in case you have a virus or have already had a virus and you want to do incident response, or if you have a virus in mind and want to watch it do its work.

You have some freely available tools to do this but if you aren't proficient in these tools, you will fail. So, the real answer is "get proficient with these tools BEFORE you attempt to use them to do incident response". By 'proficient' I mean that you can quickly filter out what is "normal" so you can spot the abnormal. Trying this can be a way to get proficient with these tools, but don't expect to be successful while you are learning.
If the virus has admin privileges, it can cause these tools to not be reliable.
The tools I am thinking of are...

  1. Windows Event Logs: This is the first stop in forensic reconstruction of what happened. I don't mean "forensically sound" as in "usable as evidence". This paper in the Sans Reading Room details some ways to use the Windows Event Logs including misspellings of common executables and processes running from a non-standard path.
  2. Netstat: If the communication is ongoing, Netstat can identify the process that is communicating with malicious hosts.
  3. Process Monitor: See what actions the above process is performing. This won't be useful if you are trying to learn things after the fact.
  4. Wireshark: analyze the packet-level communication of this virus. What is contained in those TCP packets? What techniques is it using to bypass security controls and avoid detection? A good inspiration for using Wireshark this way comes from this excellent presentation at a Wireshark conference. Yes, it is more than 1 hour long, but it is worth it.

There are many more tools for malware analysis that I have no knowledge of.

2

Have a look at the following site : https://www.hybrid-analysis.com/

You can submit the files to the system and can get detailed report.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.