Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?
closed as too broad by TheJulyPlot, S.L. Barth, Xander, Serge Ballesta, Steffen Ullrich Jul 7 '17 at 6:29
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The Sysinternals Suite contains a variety of tools, many of which can be used for dynamic malware analysis.
Process Explorer shows useful information about the running processes on a system
ProcMon monitors process activity showing information such as:
- Registry modification
- Disk access
- Process creation
In order to capture file before they are deleted: I would hook "NtDeleteFile" or the specific API the process is calling.
Filtering the calls to that function would prevent the process from deleting certain files.
This could be implemented in a Dynamic Link Library and injected into the target process.