Workflow

---

This is a basic workflow I came up with.

The core concepts are:

• try to guess what the malware do
• note EVERYTHING EVERYTIME you use this workflow

0. Screenshot “Pre-Detonation” ⇒ host-only network mode
1. PEiD: see if malware it’s packed
2. PEStudio
   1. check their signatures if it’s already recognized by some antivirus
   2. analyze if it’s packed, by looking at sections
   3. see imports
   4. see strings
3. Make sure nothing is in execution in your VM
4. Open Fakenet
5. Open RegShot and make a first snapshot
6. Open ProcMon, make a filter for the process and start to capture events
7. Open ProcExp
8. Run the malware and see what happens
9. Stop capturing with ProcMon
10. Take another snapshot with RegShot and analyze the log
11. Copy-paste fakenet logs somewhere
12. Start to dig ProcMon’s log

Then, you will need to setup IDA and a debugger and look all the ASM code.