According to what I read there are four phases: - Dormant phase - Propagation phase - Triggering phase - Execution phase
I however am having trouble finding a chronological order in how these events occur and a scenario.
- The user downloads or acquires an infected .exe file
- Would this be considered the dormant phase? The virus is idle not doing anything.
- The user executes the infected .exe file
- Now that the virus is activated it starts to replicate itself into other programs etc.. Is this the propagation period?
- The user triggers the virus via a system event.
- This I am guessing is the triggering phase?
- The virus is now executing it's payload.
- Finally once the virus has been triggered the payload is obviously executed, this could be harmless or damaging such as displaying text to the user, spamming the network, destroying the hard drive, you-name-it. I am to believe this is the final phase, the execution phase?
Is this how a typical virus works? Or am I lost.