Using Enable File Artifacts Extraction

The dump_enable_file_dumps option controls whether interacted files will be extracted during analysis. When enabled, p2a will extract files that are interacted with during the execution of the sample being analyzed.

Considerations and Recommendations

When using the dump_enable_file_dumps option:

For optimal results:

Example Use Case

Imagine you are analyzing a suspicious executable that is suspected of dropping additional files onto the system. By enabling the dump_enable_file_dumps option, you can ensure that p2a extracts and saves any files that the executable interacts with during its execution. This allows you to review and analyze the extracted files to identify any potentially malicious or unauthorized activities performed by the executable.

Using Enable Network Packet Extraction

The dump_enable_network_dumps option controls whether network packets will be extracted during analysis. When enabled, p2a will capture and save network packets that are exchanged during the execution of the sample being analyzed.

Considerations and Recommendations

When using the dump_enable_network_dumps option:

For optimal results:

Example Use Case

Suppose you are analyzing a suspicious executable that is suspected of establishing network connections to external servers. By enabling the dump_enable_network_dumps option, you can capture and save the network packets exchanged between the executable and the external servers. This enables you to inspect the contents of the network communication, identify potential command and control activities, and gain insights into the data being transmitted.

Using Enable Registry Key Extraction

The dump_enable_registry_dumps option controls whether interacted registry keys will be extracted during analysis. When enabled, p2a will extract and save registry keys that are accessed, modified, or created by the sample being analyzed.

Considerations and Recommendations

When using the dump_enable_registry_dumps option:

For optimal results:

Example Use Case

Imagine you are analyzing a suspicious executable that is suspected of making unauthorized modifications to the Windows registry. By enabling the dump_enable_registry_dumps option, you can capture and save registry keys that the executable interacts with during its execution. This allows you to review the changes made to the registry and assess whether they are legitimate or potentially malicious.

Using Cryptographic Dumps

To enable the extraction of decrypted cryptographic buffer data, modify the configuration of your sandbox environment and adjust the dump_enable_crypto_dumps option. Enabling this option allows decrypted data to be captured and extracted during the analysis process.

Cryptographic Buffer Extraction

Enhancing Analysis: By enabling cryptographic dumps, you can capture and analyze the decrypted data generated by the analyzed program, providing insights into its cryptographic operations.

Relevance to Malware Packers

Decrypting Packed Malware: Many malware packers use encryption techniques to obfuscate the payload. By enabling dump_enable_crypto_dumps, you can capture and extract the decrypted content, revealing the original malicious payload hidden behind the packer's encryption.

Packing and Unpacking: Analyzing cryptographic dumps becomes essential in understanding how malware packers encrypt and decrypt their payloads during runtime, shedding light on their packing and unpacking mechanisms.

Considerations and Recommendations

When using the dump_enable_crypto_dumps option:

For optimal results:

Example Use Case

Consider the analysis of a malware sample known to employ a sophisticated packing technique involving encryption. By enabling the dump_enable_crypto_dumps option, you can capture and extract the decrypted payload, allowing you to analyze the unpacked malware and gain insights into its behavior and potential threats.

Using Enable Screenshots Extraction

The dump_enables_screen_dumps option controls whether virtual machine screenshots will be taken at certain moments during analysis. When enabled, p2a will capture and save screenshots of the virtual machine's display to provide visual insights into the sample's behavior.

Considerations and Recommendations

When using the dump_enables_screen_dumps option:

For optimal results:

Example Use Case

Imagine you are analyzing a suspicious executable that is suspected of performing changes to the virtual environment, such as modifying the desktop or opening certain windows. By enabling the dump_enables_screen_dumps option, you can capture and save screenshots at various moments during the execution of the sample. This enables you to visually assess the sample's impact on the virtual environment and verify any visual changes it makes.

Setting Screenshots Vertical Resolution

The dump_screen_y_resolution option allows you to set the vertical resolution of the screenshots that p2a captures during analysis. This determines the quality and clarity of the screenshots saved.

Considerations and Recommendations

When using the dump_screen_y_resolution option:

For optimal results:

Example Use Case

Suppose you want to capture detailed screenshots of a suspected malware's interactions with the virtual environment. By setting a higher dump_screen_y_resolution value, you can ensure that the captured screenshots are clear and provide valuable insights into the sample's behavior. However, keep in mind that higher resolution screenshots will consume more storage space, so ensure that your storage resources are sufficient.

Using Enable PE Image Extraction

The dump_enable_image_dumps option controls whether in-memory PE images will be extracted during analysis. When enabled, p2a will extract and save in-memory Portable Executable (PE) images generated by the sample being analyzed.

Considerations and Recommendations

When using the dump_enable_image_dumps option:

For optimal results:

Example Use Case

Suppose you are analyzing a suspicious executable that is known to dynamically load additional modules during its execution. By enabling the dump_enable_image_dumps option, you can capture and save the in-memory PE images that the executable generates. This allows you to analyze the content and behavior of these images, helping you understand the additional code that the executable introduces into the process space.

Using Memory Dumps

To enable the extraction of in-memory images and process runtime memory data, modify the configuration of your sandbox environment and adjust the dump_enable_memory_dumps option. Enabling this option allows you to capture in-memory images of PE (Portable Executable) files, analyze runtime memory (including heap and stack), and extract found DLLs.

In-Memory Image Extraction, Runtime Memory Analysis, and DLL Extraction

Enhancing Analysis: By enabling memory dumps, you can:

Example Use Case

Consider analyzing a suspicious executable that dynamically loads additional modules in memory. By enabling the dump_enable_memory_dumps option, you can:

This comprehensive memory analysis helps you gain insights into the program's execution, memory usage, and potential malicious activities.

Using Memory Dumps for URL Analysis

To enable the extraction of in-memory images and process runtime memory data specifically for URL analysis, modify the configuration of your sandbox environment and adjust the dump_enable_memory_dumps_url_analysis option. Enabling this option allows you to capture in-memory images of PE (Portable Executable) files, analyze runtime memory (including heap and stack), and extract found DLLs during URL analysis.

In-Memory Image Extraction, Runtime Memory Analysis, and DLL Extraction for URL Analysis

Enhancing URL Analysis: Similar to the general memory dumps option, enabling memory dumps for URL analysis allows you to:

Example Use Case

Imagine you are analyzing a suspicious URL that leads to the execution of a potentially malicious executable. By enabling the dump_enable_memory_dumps_url_analysis option, you can:

These memory analysis capabilities provide deeper insights into the behavior and potential threats associated with the analyzed URL.

Using Memory Dumps Subobject Scanning

The dump_memory_scan_for_subobjects option controls whether p2a will scan memory dumps for embedded Portable Executable (PE) objects during analysis. When enabled, p2a will extract and save any in-memory executable images found within the process space.

Considerations and Recommendations

When using the dump_memory_scan_for_subobjects option:

For optimal results:

Example Use Case

Suppose you are analyzing a malware sample that is suspected of using process hollowing to hide its malicious activities within a legitimate process. By enabling the dump_memory_scan_for_subobjects option, you can scan the memory dumps for any in-memory executable images that may have been injected into the process's memory space. This enables you to identify and analyze hidden PE objects, providing insights into the sample's code injection and runtime behavior.

Using IAT Reconstruction for PE Image Dumps

The dump_image_apis_resolve_iat option controls the level of Import Address Table (IAT) reconstruction for in-memory executable images during analysis. The IAT is an essential component of a PE image that maps imported functions to their corresponding addresses. This option determines how extensively the IAT will be reconstructed for in-memory PE image dumps.

Valid Values

Considerations and Recommendations

When using the dump_image_apis_resolve_iat option:

For optimal results:

Example Use Case

Imagine you are analyzing a malware sample that heavily relies on imported functions to perform its malicious activities. By setting the dump_image_apis_resolve_iat option to 2, you can ensure that all references to imported functions are resolved in the reconstructed IAT of the in-memory PE images. This allows you to accurately trace the execution flow and interactions of the imported functions within the sample, helping you understand its behavior more comprehensively.

Using IAT Reconstruction for Memory Dumps

The dump_memory_apis_resolve_iat option controls the level of Import Address Table (IAT) reconstruction for all memory dumps during analysis. The IAT is an essential component of a PE image that maps imported functions to their corresponding addresses. This option determines how extensively the IAT will be reconstructed for memory dumps.

Valid Values

Considerations and Recommendations

When using the dump_memory_apis_resolve_iat option:

For optimal results:

Example Use Case

Imagine you are analyzing a malware sample that uses dynamic function resolution techniques to obfuscate its imported functions. By setting the dump_memory_apis_resolve_iat option to 2, you can ensure that all references to imported functions are resolved in the reconstructed IAT of the memory dumps. This allows you to accurately trace the execution flow and interactions of the imported functions within the sample, helping you uncover its obfuscation techniques and behavior.

Using Maximum Size of Single Dump

The dump_maximum_size_single option controls the maximum size of a single dump that p2a can generate during analysis. This option is especially useful for managing the size of individual memory or file dumps extracted from the analysis environment.

Range and Default Value

Considerations and Recommendations

When using the dump_maximum_size_single option:

For optimal results:

Example Use Case

Suppose you are analyzing a malware sample that generates large memory dumps during its execution. By setting the dump_maximum_size_single option to a value of 100000000 (100 MB), you can ensure that each individual memory dump extracted from the sample does not exceed 100 MB. This helps manage storage usage and prevents individual dumps from consuming excessive space, while still allowing you to capture relevant memory content for analysis.

Using Maximum Cumulated Size of Dumps per Process

The dump_maximum_size_per_process option controls the maximum cumulated size of all dumps generated for a single process during p2a analysis. This option helps manage the total size of dumps associated with a particular process and prevents excessive storage usage.

Range and Default Value

Considerations and Recommendations

When using the dump_maximum_size_per_process option:

For optimal results:

Example Use Case

Imagine you are analyzing a malware sample that creates multiple instances of the same process and generates substantial memory dumps for each instance. By setting the dump_maximum_size_per_process option to 50000000 (50 MB), you can ensure that the cumulated size of all dumps generated for a single process instance does not exceed 50 MB. This allows you to manage storage usage while still capturing relevant information about each process's behavior.

Using Maximum Cumulated Size of All Dumps

The dump_maximum_size_total option controls the maximum cumulated size of all dumps generated during p2a analysis. This option helps manage the total storage usage for dumps across all processes and aspects of analysis.

Range and Default Value

Considerations and Recommendations

When using the dump_maximum_size_total option:

For optimal results:

Example Use Case

Suppose you are analyzing a complex malware sample that generates a substantial amount of memory and file dumps across various processes and analysis aspects. By setting the dump_maximum_size_total option to 500000000 (500 MB), you can ensure that the total cumulated size of all dumps does not exceed 500 MB. This helps you manage storage usage while retaining sufficient data to analyze the sample's behavior and interactions.

Using Discard Dumps Based on Difference Percentage

The dump_discard_if_delta_under_permillion option controls whether dumps with a low percentage of different bytes will be discarded during p2a analysis. This option helps manage the extraction of relevant dumps by filtering out those with minimal differences from a reference.

Range and Default Value

Considerations and Recommendations

When using the dump_discard_if_delta_under_permillion option:

For optimal results:

Example Use Case

Imagine you are analyzing a sample that generates numerous memory dumps with slight variations due to runtime conditions. By setting the dump_discard_if_delta_under_permillion option to 5000, you can ensure that dumps with less than 0.005% different bytes from a reference are discarded. This helps filter out dumps that are likely to be noise or variations from the analysis, allowing you to focus on dumps with more significant differences.