Study guide
12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts
Key Takeaways Explain This Topic AI
Dynamic malware analysis observes specimen runtime behavior within an isolated, monitored sandbox, capturing real-time file system modifications, registry persistence, process spawning, and network beacons.
Malware frequently incorporates evasion techniques including anti-VM artifact detection (e.g., VMware/VirtualBox MAC OUIs, low core counts), anti-debugging flags, and sleep-delay timers to bypass automated sandboxes.
Sysinternals Process Monitor (Procmon) captures high-fidelity operating system events across Registry, File System, Network, and Process/Thread subsystems, relying on precise filtering (e.g., Operation is RegSetValue) to isolate malicious behavior.
Regshot performs differential registry auditing by comparing pre-infection (Shot 1) and post-infection (Shot 2) system states, generating structured reports of newly added, modified, and deleted keys and values.
Network simulation platforms like FakeNet-NG and INetSim intercept and spoof critical network protocols (DNS, HTTP/S, SMTP), coaxing malware into executing secondary payload stages and revealing C2 communications.
Last updated: September 2026
12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts
Quick Answer: Dynamic malware analysis detonates a suspect binary inside an isolated, non-persistent sandbox to monitor runtime behavior. Investigators capture live system alterations using Sysinternals Process Monitor (Procmon) —applying filters for Process Name is , Operation is RegSetValue , and Operation is CreateFile —while Process Explorer (Procexp) inspects active process trees, image signatures, and memory-versus-disk string discrepancies (uncovering Process Hollowing ). Registry modifications and persistence mechanisms are captured via Regshot by comparing pre-execution ("1st shot") and post-execution ("2nd shot") snapshots. Outbound network callouts and C2 beacons are safely stimulated and captured using network simulators like FakeNet-NG or INetSim coupled with Wireshark .
The Dynamic Behavioral Analysis Environment
While static analysis reveals what a binary contains , dynamic analysis reveals what the binary does . Dynamic analysis is critical for analyzing heavily packed, crypter-protected, or multi-stage modular malware families whose code cannot be unpacked through static means alone. +-------------------------------------------------------------------------+
- | DYNAMIC MALWARE SANDBOX ARCHITECTURE |
- +-------------------------------------------------------------------------+
- | +-------------------------------------------------------------------+ |
- | | HOST WORKSTATION (Physical Hypervisor / Bare-Metal) | |
- | | • Isolated Virtual Switch (Host-Only / Internal Network) | |
- | +-------------------------------------------------------------------+ |
- | ▲ |
- | | Host-Only Network (No Internet) |
- | ▼ |
- | +-------------------------------+ +-------------------------------+ |
- | | TARGET GUEST VM (Sandbox) | | NETWORK SIMULATOR VM | |
- | | • Windows 10/11 x64 Specimen | | • FakeNet-NG / INetSim Server | |
- | | • Procmon / Procexp / Regshot |<->| • Intercepts DNS, HTTP, SMTP | |
- | | • Reverts to Clean Snapshot | | • Full Wireshark PCAP Capture | |
- | +-------------------------------+ +-------------------------------+ |
- +-------------------------------------------------------------------------+
- Core Sandbox Engineering Principles
Hypervisor Isolation: Malware detonation must occur inside isolated virtual machines (Type 1 or Type 2 hypervisors) or dedicated bare-metal systems equipped with hardware reboot-to-restore controllers.
Host-Only / Air-Gapped Networking: Guest virtual machines must never bridge to the host's physical network adapter or route to the public internet. All network adapters are connected to an isolated host-only virtual switch (vSwitch) .
Non-Persistent Snapshot Management: Before introducing any malware specimen, the examiner creates a Golden Clean Snapshot of the guest OS in a fully configured state (monitoring tools installed, security defenses disabled). Following execution and evidence capture, the VM is instantly reverted to the clean snapshot to eliminate residual cross-contamination.
Anti-Analysis & Anti-VM Evasion Countermeasures
Sophisticated malware incorporates extensive anti-analysis checks to detect whether it is executing inside a virtual machine, sandbox, or debugger. If evasion checks return positive, the malware terminates silently, displays a fake error message, or executes benign behavior. +-------------------------------------------------------------------------+
- | COMMON ANTI-VM EVASION TECHNIQUES |
- +-------------------------------------------------------------------------+
- | Evasion Category | Check Mechanism | Forensic Countermeasure |
- |---------------------|------------------------|--------------------------|
- | **MAC Address** | Checks network adapter | Spoof MAC address to a |
- | **OUI Inspection** | OUI prefix for known | standard physical vendor |
- | | virtualization vendors | (e.g., Intel, Realtek) |
- |---------------------|------------------------|--------------------------|
- | **Hardware** | Checks CPU cores (<2), | Allocate 4+ CPU cores, |
- | **Resource Checks** | RAM (<4GB), or hard | 8GB+ RAM, and 100GB+ |
- | | drive capacity (<60GB) | virtual disk space |
- |---------------------|------------------------|--------------------------|
- | **Registry & Device**| Queries registry for | Sanitize hypervisor keys;|
- | **Artifacts** | "VMware", "VBOX", or | rename virtual guest |
- | | loaded driver names | driver services |
- |---------------------|------------------------|--------------------------|
- | **Instruction** | Executes CPUID or | Patch hypervisor XML to |
- | **Fingerprinting** | RDTSC (measures CPU | mask hypervisor flags; |
- | | execution cycle delta) | disable timing traps |
- |---------------------|------------------------|--------------------------|
- | **Human Interaction**| Monitors mouse cursor | Run automated UI actions;|
- | **& Sleep Delays** | movement, clicks, or | hook and accelerate |
- | | executes 10-min Sleep | kernel32!Sleep calls |
- +-------------------------------------------------------------------------+
- 1. Virtualization Hardware Artifacts
MAC Address OUIs: Virtualization hypervisors assign standardized Organizationally Unique Identifiers (OUIs) to virtual network adapters:
- VMware: 00:05:69 , 00:0C:29 , 00:50:56
- VirtualBox: 08:00:27
- QEMU / KVM: 52:54:00
Device Names & Drivers: Malware queries the registry under HKLM\\HARDWARE\\Description\\System for strings like VBOX , VMware Virtual Platform , or QEMU . It checks for virtual guest drivers such as VBoxMouse.sys , VBoxGuest.sys , or vmmouse.sys .
2. Instruction & Timing Evasion ( RDTSC )
The RDTSC (Read Time-Stamp Counter) x86 assembly instruction reads the current CPU cycle counter. Malware executes RDTSC , calls a routine, and executes RDTSC a second time to calculate the elapsed cycle delta:
If an interactive human examiner is stepping through the code inside a debugger (e.g., x64dbg), or if a hypervisor intercepts instruction execution via VM-exits, the elapsed cycle count is millions of cycles higher than expected on bare-metal hardware. Detecting this latency, the binary aborts.
3. Extended Sleep & Sandbox Starvation
Automated analysis sandboxes enforce rigid timeout limits (typically 2 to 5 minutes) per sample. Malware routinely calls Sleep(600000) (10 minutes) before initiating malicious activity. Advanced sandboxes defeat this by hooking kernel32.dll!Sleep and accelerating time, though sophisticated malware detects sleep acceleration by querying real-time hardware timers via GetSystemTime or GetTickCount .
Real-Time System Monitoring with Sysinternals Procmon & Procexp
The Microsoft Sysinternals suite provides the foundational telemetry required to track real-time dynamic behavior on Windows endpoints. +-------------------------------------------------------------+
- | PROCMON EVENT CAPTURE ENGINE |
- +-------------------------------------------------------------+
- | Event Classes: |
- | [Registry] RegOpenKey, RegSetValue, RegDeleteValue |
- | [File System] CreateFile, WriteFile, SetDispositionInfo |
- | [Process/Thread]Process Create, Thread Create, Load Image |
- | [Network] TCP Connect, TCP Send, UDP Send |
- +-------------------------------------------------------------+
- | Filter Engine: [Process Name is malware.exe] Include
- ▼
- +-------------------------------------------------------------+
- | Isolated Event Stream: Direct Malicious Action Telemetry |
- +-------------------------------------------------------------+
- 1. Process Monitor (Procmon) Filtering Architecture
Procmon captures millions of operating system events per minute. Without precise filters, legitimate background system noise ( svchost.exe , SearchIndexer.exe , TiWorker.exe ) will overwhelm the analysis.
- Essential Filter Configurations for Malware Triage
- Target Isolation: Process Name is [malware_sample.exe] -> Include
- Detecting Registry Persistence: Operation is RegSetValue -> Include
Flags attempts to write to CurrentVersion\\Run , RunOnce , StartupApproved , or Services keys.
Detecting Dropped Payloads: Operation is CreateFile -> Include AND Detail contains OpenResult: Created -> Include
Filters out routine read/query file operations, isolating exactly where the binary dropped secondary scripts, .dll modules, or encrypted files.
Detecting Process Spawning: Operation is Process Create -> Include
Reveals attempts to invoke cmd.exe , powershell.exe , certutil.exe , or wmic.exe .
Boot Logging: If malware requires a system restart to execute persistence routines, the examiner navigates to Options -> Enable Boot Logging . Procmon configures a kernel driver to capture all boot-time activity during the subsequent reboot before user logon.
2. Process Explorer (Procexp) Inspection
Process Explorer serves as an advanced task manager, exposing deep process properties:
Process Hierarchy & Color Coding: Running processes are organized in a parent-child tree. Newly spawned processes flash green , terminating processes flash red , services appear in pink , and suspended or packed processes display in dark grey .
Image Signature Verification: Navigating to Options -> Verify Image Signatures causes Procexp to validate Authenticode digital signatures across all running binaries. Unsigned binaries running from user directories (e.g., C:\\Users\\<user>\\AppData\\Local\\Temp\\ ) are immediately highlighted.
Uncovering Process Hollowing (Memory vs. Disk Strings):
Process Hollowing occurs when an attacker launches a legitimate binary (e.g., svchost.exe ) in a suspended state, hollows out its virtual memory, and writes malicious code in its place.
In Procexp, double-click the suspect process, select the Strings tab, and toggle between the Image radio button (strings residing in the physical binary on disk) and the Memory radio button (strings residing in active virtual memory).
The Indicator: If the Image strings show legitimate Microsoft print spooler strings, while the Memory strings reveal C2 IP addresses, IRC commands, or ReflectiveLoader text, the process has been hollowed.
Registry Differential Auditing with Regshot
While Procmon captures transient registry operations in real-time, Regshot provides a macro-level, differential baseline comparison of the Windows Registry before and after malware detonation. +-------------------------------------------------------------+
- | REGSHOT TWO-SHOT WORKFLOW |
- +-------------------------------------------------------------+
- | Step 1: Snapshot 1 (Clean System Baseline State) |
- | • Scans HKLM, HKU, HKCU, and target directories |
- +-------------------------------------------------------------+
- | Detonate Malware Specimen
- | Wait for Behavioral Execution
- ▼
- +-------------------------------------------------------------+
- | Step 2: Snapshot 2 (Post-Infection Compromised State) |
- | • Scans modified hives and file paths |
- +-------------------------------------------------------------+
- | Compute Differential
- ▼
- +-------------------------------------------------------------+
- | Differential Output Report: |
- | • Keys Added / Deleted |
- | • Values Added / Modified |
- | • Files Added / Modified in System Directories |
- +-------------------------------------------------------------+
- Regshot Operational Sequence
Take 1st Shot: In a freshly restored clean sandbox, launch Regshot and click 1st shot -> Shot . Regshot walks the registry hives ( HKLM\\SYSTEM , HKLM\\SOFTWARE , HKU , HKCU ) and records all keys, values, and data types into a temporary memory map.
Detonate Specimen: Execute the malware sample with administrative privileges. Interact with any dialog boxes if required, allowing the malware sufficient time (3 to 5 minutes) to unpack, inject, and establish persistence.
Take 2nd Shot: Click 2nd shot -> Shot .
Generate Comparison Report: Click Compare . Regshot generates a clean, formatted text or HTML report detailing exact changes.
- Typical Regshot Persistence Indicators ----------------------------------
- Values Added: 3
- ---------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSecurity: "C:\Users\victim\AppData\Roaming\winupdate.exe"
HKLM\SYSTEM\CurrentControlSet\Services\NetDriverSvc\ImagePath: "C:\Windows\System32\drivers\netdriver.sys"
HKU\S-1-5-21-...\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: "explorer.exe, C:\Users\victim\AppData\Local\Temp\beacon.exe"
- ---------------------------------
- Files Added: 2
- ---------------------------------
- C:\Users\victim\AppData\Roaming\winupdate.exe
- C:\Windows\System32\drivers\netdriver.sys
- Network Simulation & C2 Callout Capture
Multi-stage droppers require an active internet connection to download secondary payloads, verify outbound connectivity, and register with Command and Control (C2) servers. Because the sandbox is air-gapped, outbound requests will fail unless intercepted and simulated. Target Sandbox VM Network Simulator VM
- +-----------------------+ +-----------------------+
- | Malware executes: | 1. DNS Query | FakeNet-NG / INetSim |
- | GET /payload2.exe |---------------------->| Resolves ALL queries |
- | to c2.attacker.com | | to 192.168.10.1 |
- | | 2. Spoofed Response | |
- | |<----------------------| IP: 192.168.10.1 |
- | | | |
- | Establishes HTTP GET | 3. HTTP Request | Web Server Engine |
- | request over port 80 |---------------------->| Intercepts HTTP GET |
- | | | |
- | Receives 200 OK + | 4. Synthetic Payload | Returns valid 200 OK |
- | Fake PE Executable |<----------------------| + Dummy .exe binary |
- | | | |
- | Executes Stage 2! | | (Traffic Logged to |
- +-----------------------+ | Wireshark PCAP) |
- +-----------------------+
- 1. FakeNet-NG & INetSim
INetSim: A Linux-based software suite that simulates common internet protocols including DNS , HTTP , HTTPS , SMTP , FTP , NTP , and IRC . When configured as the default gateway and DNS server for the malware sandbox, INetSim returns realistic server banners and synthetic responses.
FakeNet-NG: A next-generation dynamic network simulation tool developed by Mandiant. FakeNet-NG runs directly on Windows or Linux, redirecting all outbound network traffic to localhost or a simulated interface:
DNS Spoofing: When malware issues a DNS request for any domain (e.g., evil-malware-c2[.]org ), FakeNet intercepts the query at the network driver level and replies with a spoofed IP pointing to its own listening adapter.
HTTP/HTTPS Service Simulation: When the malware attempts an HTTP GET request for a second-stage dropper, FakeNet returns a valid HTTP 200 OK header accompanied by a synthetic, dynamically generated PE binary. Receiving a valid executable, the malware proceeds to its next execution phase, exposing secondary behaviors that would otherwise remain hidden.
SSL/TLS Interception: FakeNet dynamically generates SSL certificates to intercept encrypted HTTPS traffic, allowing examiners to read plaintext C2 commands.
2. Traffic Analysis with Wireshark
Running Wireshark on the network simulator captures the full network exchange to a .pcap file for extraction:
Domain Generation Algorithms (DGAs): High volumes of NXDOMAIN DNS queries for random character strings (e.g., xzklaqwebnm[.]biz , qowieurytz[.]info ).
Beaconing Jitter & Intervals: Calculating the time deltas between successive HTTP POST requests. If requests occur every exactly 60 seconds (or within 10% randomized jitter), automated beaconing is established.
Exfiltration Headers: Inspecting HTTP headers for base64-encoded user credentials or machine reconnaissance data stored inside Cookie: , Authorization: , or custom HTTP headers ( X-Session-ID: ).
- Practical Forensic Case Scenario: Detonating a Banking Trojan
- The Incident
A suspect .vbs (Visual Basic Script) is recovered from an employee's downloads directory following a phishing campaign. Static analysis shows heavy obfuscation with Chr() functions.
Dynamic Analysis Execution
Environment Setup: The analyst reverts the Windows 10 sandbox to its clean snapshot. INetSim is started on an adjacent VM ( 192.168.10.1 ), configured as the sandbox's DNS server and gateway. Wireshark is launched on the INetSim host.
Tool Baselining: The analyst launches Regshot and takes the 1st shot . Procmon is launched with an active capture filter for Process Name is wscript.exe .
Detonation: The analyst executes wscript.exe Invoice.vbs .
Procmon Telemetry: Procmon records wscript.exe spawning powershell.exe with a hidden window argument. powershell.exe initiates a CreateFile operation writing an executable named svchost_update.exe into C:\\Users\\victim\\AppData\\Local\\Temp\\ .
Network Simulation: Wireshark captures a DNS request for api.crypto-vault-update[.]com . INetSim resolves the domain to its local IP. The malware issues an HTTP GET /drop/payload.bin request. INetSim returns a dummy binary response.
Regshot Delta: The analyst takes the 2nd shot and generates the comparison report. Regshot identifies a new value added under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityService pointing directly to the dropped svchost_update.exe binary.
Reporting: The analyst compiles the dropped file hash, the registry persistence path, and the C2 domain into a structured IoC advisory for the incident response team.