10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

TryHackMe Security Analyst Level 1 SAL1

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy

2 SOC Simulator Exam Skills

2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes

3 Network Essentials

3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission

4 Operating System Basics

4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity

5 Cryptography, Cloud, Web and Scripting Basics

5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs

6 Cybersecurity Fundamentals and MITRE ATT&CK

6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques

7 Kill Chain, NIST CSF, and Attack Indicators

7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain

8 Social Engineering and Network Attacks

8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns

9 Web Exploitation and Endpoint Attacks

9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd

10 Command and Control, Malware, and LOLBAS

10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

11 EDR, Firewalls, and WAF

11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation

12 SIEM and SOAR

12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration

13 Threat Intelligence and Vulnerability Scanning

13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning

14 SOC Team, Activities, and Alert Triage

14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts

15 SOC Metrics, Escalation, and Communication

15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication

10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

Key Takeaways Explain This Topic AI

Classify malware by actions: ransomware encrypts and extorts, worms self-spread, RATs provide remote control, wipers destroy, infostealers harvest secrets, and trojans deceive at delivery

Static analysis inspects a file without running it (hash, type, strings, signature, VirusTotal); dynamic analysis detonates it in an isolated sandbox

A Level 1 SOC analyst uses reputation, EDR, and sandbox reports; debugger-level reversing is malware-researcher work, not the SAL1 job

Living Off the Land Binaries And Scripts (LOLBAS) abuse signed Windows tools such as powershell.exe, wscript, mshta, rundll32, certutil, and bitsadmin so attackers need not drop a new unsigned implant

Detect LotL from command-line arguments, parent process, path, and network context—the mere presence of a Microsoft binary is not an incident

Last updated: September 2026

10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

Quick Answer: SAL1 classifies malware by what it does —encrypt ( ransomware ), impersonate ( trojan ), self-spread ( worm ), remotely control ( Remote Access Trojan (RAT) ), destroy ( wiper ), steal data ( infostealer )—not by brand names. Static analysis inspects a file without running it (hashes, strings, reputation). Dynamic analysis runs it in a controlled sandbox. Living Off the Land Binaries And Scripts (LOLBAS) are signed Windows tools such as powershell.exe and certutil.exe that attackers reuse so they do not need a custom malware binary.

This independent study material covers Malware and LOLBAS topics that appear in SAL1 training content. You learn to name behaviors, pick an analysis method a SOC analyst would actually use, and recognize living-off-the-land command lines. You do not need malware samples, unpackers, or a recipe for abusing Windows utilities.

Classify by behavior, not by brand

The SAL1 training content focuses on actions . A sample labeled with a crimeware family on a blog is less useful on the exam than "this binary steals browser cookies and waits for operator commands." Brands change; behaviors map to playbooks.

Ransomware

Ransomware encrypts (or otherwise denies access to) files and demands payment. Analyst-visible clues include mass file renames or new extensions, a ransom note, attempts to delete volume shadow copies, disabled backups, and sudden encryption across Server Message Block (SMB) shares. The business impact is availability plus extortion. Distinguish this from a wiper that destroys keys or overwrites disks with no credible recovery path.

Trojan

A trojan delivers or hides a payload inside something that looks legitimate: a cracked installer, a fake invoice "viewer," or a look-alike updater. The defining action is deception at delivery , not a specific payload. A trojan may drop ransomware, a RAT, or an infostealer. On an alert, "trojan" answers how it arrived pretending to be software ; you still name the follow-on behavior.

Worm

A worm self-propagates across hosts using a vulnerability, stolen credentials, or removable media, with little or no extra user click per new victim. Worms create fan-out : many similar EDR alerts in minutes, internal scanning, bursts of SMB or Remote Desktop Protocol (RDP). Contrast with a trojan that sits until the next user is phished.

Remote Access Trojan (RAT)

A RAT provides interactive remote control : file system access, screen, command execution, sometimes additional sensors. This overlaps C2 from the previous section. Keep the labels straight: malware type is the implant's job (remote access); C2 is the channel . A RAT without a live channel is still a RAT in classification. An interactive reverse shell can be the channel under a RAT.

Wiper

A wiper destroys data or makes systems unbootable. Notes may imitate ransomware, but there is no working decryptor. Clues include rapid overwrite, boot-record tampering, destruction of backups, and an intel picture that looks like disruption rather than profit. Treat it as a destructive incident, not a billing event.

Infostealer

An infostealer harvests credentials, cookies, tokens, cryptocurrency wallets, or selected files. Clues include browser database access, reads of configuration and password stores, staging of a small archive, and often short dwell then quiet. Infostealers frequently precede business email compromise or later ransomware.

Type Core action Typical L1 evidence Not the exam point

Ransomware Deny access / encrypt for extortion Ransom note, mass encryption, backup tampering Specific gang marketing name

Trojan Pretend to be legitimate to run a payload Unexpected installer, lure document, dual-use sideload Brand of the dropper

Worm Self-replicate across systems Rapid multi-host clones, scan-and-spread patterns One CVE trivia item without spread

RAT Interactive remote control of a host Persistent C2, remote CLI or GUI artifacts Operator console walkthrough

Wiper Destroy data or systems Unrecoverable overwrite, fake ransom Assuming payment helps

Infostealer Collect secrets and data Browser or credential file access, small staged archives Dumping a real sample

A single incident can chain types: a trojanized installer, then an infostealer, then later ransomware. Classify each observed action . Do not force one label onto the whole case if the evidence shows a sequence.

Malware indicators a Level 1 analyst actually uses

You will rarely open a debugger on the SOC floor. You will match indicators :

File: hash, path (Temp, Downloads, alternate data streams), missing or invalid signature, double extension such as invoice.pdf.exe .

Process: unusual parent (WinWord to cmd to PowerShell), encoded command lines, injection into a trusted process.

Network: new domains, C2-like timing from the previous section, Domain Name System (DNS) lookups to newly registered names.

Host change: new services, Run keys, scheduled tasks, disabled antivirus, deleted logs.

Those mix IoCs (hashes, names, IPs) and Indicators of Attack (IoAs) (behaviors such as mass encryption). SAL1 wants you to identify indicators and choose static versus dynamic next steps—not to author exploits.

Static versus dynamic analysis at L1

Static analysis means examining the artifact without executing it. Dynamic analysis means running it in a controlled environment and watching what it does. Both are in scope; the exam cares about which job uses which method .

Static analysis (SOC analyst toolkit)

Typical Level 1 static steps:

Hash the file (SHA-256) and search internal history plus a multi-engine reputation service such as VirusTotal (VT) .

Confirm file type (a real Windows Portable Executable versus a renamed picture).

Pull strings and metadata: URLs, mutex names, debug paths, ransom-note fragments—without treating strings as proof by themselves.

Check digital signature : Microsoft-signed certutil.exe is a different story from an unsigned binary in %TEMP% .

Read whatever YARA or EDR static machine-learning verdict the platform already produced.

Static analysis is fast, safe for the enterprise network, and good for known-bad and obvious lure files. Limits: packed or encrypted samples look boring until they run; hash variants miss the next compile; VT hits can be generic or delayed.

Dynamic analysis (sandbox detonation)

Detonation runs the sample in a sandbox —an isolated virtual machine with instrumentation. Reports show process trees, file writes, registry changes, and outbound domains. Level 1 uses vendor or internal sandbox output , not a hobby virtual machine on the analyst laptop.

Dynamic analysis answers questions static review cannot: does it beacon, drop a second stage, encrypt documents, or steal browser files? Limits include sleep and jitter, sandbox-evasion checks (hostname, uptime, missing mouse movement), and lack of real domain context (no genuine file server to encrypt).

The diagram below is the L1 decision picture: inspect first, detonate only in an isolated pipeline when static results are inconclusive and policy allows it.

Loading diagram... Static inspection versus sandbox detonation for L1 malware triage

SOC analyst versus malware researcher

Task SOC analyst (SAL1 depth) Malware researcher
Hash / VT / EDR verdict Daily Supporting step
Detonation report Read and extract IoCs for blocking One input among many
Strings, filename, parent process Core triage Prelude to reversing
Debugger, unpacker, decompiler Out of scope for L1 Core craft
Writing new detection logic Escalate to detection engineering Often collaborates
Goal Classify, contain, escalate with evidence Explain internals and variants

If the sandbox says the file contacted an uncategorized domain and wrote a script under Temp, your job is containment and ticket quality—not reconstructing the packer. Escalate packed samples that beat both VT and a short sandbox run; do not reverse them yourself on production time.

LOLBAS and living-off-the-land

LOLBAS stands for Living Off the Land Binaries And Scripts . The public LOLBAS project catalogs Windows binaries, scripts, and libraries that can be abused for purposes beyond their documented admin job . Related labels: LOLBins (the binaries) and living-off-the-land (LotL) .

Attackers use signed Windows binaries because:

They are already on disk. There is no need to drop a custom implant that antivirus or EDR may hash-detect.

They are Microsoft-signed. Allowlisting that trusts publisher = Microsoft will execute powershell.exe , rundll32.exe , and certutil.exe .

They blend into admin noise. Information technology teams use PowerShell. The binary name is not malicious; arguments, parent, network, and user context are.

Defense evasion. LotL is a strategy to hide in legitimate tooling (MITRE ATT&CK tactic TA0005), not a single vulnerability.

SAL1 asks why threat actors use LotL and how to recognize command-line clues. It does not ask you to reproduce abuse.

Analyst-visible command-line clues

Never treat the presence of these processes as a conviction. Hunt rare argument patterns and wrong parents . The table lists clues you may see in EDR, Sysmon, or Security Information and Event Management (SIEM) command-line fields—not steps to run.

LOLBin Everyday job Suspicious command-line clues (recognition) Why it helps an attacker

powershell.exe Automation and administration -EncodedCommand or -enc ; -nop / -NonInteractive ; -w hidden / -WindowStyle Hidden ; IEX ; DownloadString ; FromBase64String Runs logic in memory and can pull extra code without a new EXE

wscript.exe / cscript.exe Windows Script Host for .vbs / .js Script path under Temp or Downloads; Office or email client as parent Executes lure scripts using a signed host

mshta.exe Microsoft HTML Application host http:// or https:// in the command line; javascript: inline; WinWord or Outlook as parent Runs HTA or JavaScript with a trusted Microsoft binary

rundll32.exe Load a DLL export Missing DLL and function name; javascript: or htmlfile ; DLL from a user-writable path Executes code through a trusted loader

certutil.exe Certificate services -urlcache with -split / -f and an HTTP(S) URL; -decode or -encode on odd files in Temp Download and decode payloads using a signed tool

bitsadmin.exe Background Intelligent Transfer Service client /transfer or /download to unusual destinations; notify-and-run style flags Jobs can resemble Windows updates while fetching follow-on files

Process-tree clues that beat the binary name

LotL detections are relationship detections:

Outlook spawning mshta.exe which then spawns powershell.exe
WinWord spawning wscript.exe with a .js file in Temp
cmd.exe spawning certutil.exe with -decode , then the decoded file executing
bitsadmin launching outside patch windows from a non-admin user

A help-desk technician running signed PowerShell from an approved script store at 10:00 is a different ticket from a finance user whose Word process spawned encoded PowerShell at 22:00.

Why LotL frustrates signature-first antivirus

Traditional antivirus wanted malicious files . LotL may add zero new files : the "malware" is a command line and a Microsoft binary. EDR behavioral rules, PowerShell script-block logging (Event ID 4104), Sysmon command lines, and application allowlisting with publisher plus path plus hash constraints (not publisher-only) are how SOCs catch this. You still cannot delete powershell.exe . You constrain who may run it, from where , and you alert on how .

Putting analysis and LotL together on a ticket

A user reported a slow PC. EDR shows mshta.exe with an https:// argument, parent EXCEL.EXE , then powershell.exe with -nop -w hidden -enc . VirusTotal on a dropped dynamic-link library (DLL) in Temp is mixed. Static: hash the DLL, read the captured command line, note the URL. Dynamic: if policy allows, detonate the DLL or HTA in the sandbox , not on the analyst workstation. Classification: a trojanized document leading to LotL execution , possibly a RAT or infostealer depending on sandbox behaviors (C2 callbacks versus credential-file reads). Escalate with the URL, hash, encoded command, and parent tree. Do not paste live malware into chat, and do not try the command yourself.

Common traps

Brand names as answers. Prefer "wiper behavior" over a marketing family if the question is about actions.

Static-only comfort. A unique hash with zero VT hits can still encrypt files five minutes after detonation.

Blocking LOLBins wholesale. You will break Windows administration. Detect abuse; restrict context.

Sandbox on the analyst PC. Detonation belongs in an isolated pipeline.

Trusting the signature alone. A Microsoft signature means publisher, not "this command line is safe."

Calling every PowerShell alert a RAT. Encoded PowerShell is a technique . The malware type still depends on what it does after execution.