Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?

closed as too broad by TheJulyPlot, S.L. Barth, Xander, Serge Ballesta, Steffen Ullrich Jul 7 '17 at 6:29

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You can use tools within the Remnux Linux Distribution to analyze malware statically and dynamically which would include file deletes, additions, registry edits, network changes, etc. etc. One good tool is called Mastiff but, there a a-lot of good tools. I would recommend looking at Remnux. – Joshua Faust Jul 6 '17 at 13:20
  • reboot with a thumb drive before it can delete? – dandavis Jul 6 '17 at 21:25

The Sysinternals Suite contains a variety of tools, many of which can be used for dynamic malware analysis.

Process Explorer shows useful information about the running processes on a system

ProcMon monitors process activity showing information such as:

  1. Registry modification
  2. Disk access
  3. Process creation

and more.

In order to capture file before they are deleted: I would hook "NtDeleteFile" or the specific API the process is calling.

Filtering the calls to that function would prevent the process from deleting certain files.

This could be implemented in a Dynamic Link Library and injected into the target process.

Not the answer you're looking for? Browse other questions tagged or ask your own question.