Digital Forensics and Incident Response - Second Edition

Malware sandbox

Dynamic analysis is often facilitated using a sandbox. A sandbox is a system that has been created for the controlled execution of malware. One method in crafting a sandbox is to have a virtual appliance, with the proper OS and toolset installed. Once the sandbox is properly configured, a snapshot of the virtual system can be taken, and the malware then executed. From here, the analyst can monitor network traffic, examine processes, and compare them to normal baseline behavior. Deviations from this baseline can be examined in more detail, to determine if they are legitimate or tied to a malicious executable.

Responders can also conduct a range of digital forensic tasks on the sandbox, to extract available IoCs. The preferred ...