🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Incident Response › Lesson 7
TEC-CYBE44-07 · Lesson 7 · 14 clock hours · lab

Malware Analysis Basics and Eradication

Objective. Students will perform static and basic dynamic analysis of a provided malware sample in an isolated sandbox environment and produce an eradication plan.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is Malware Analysis?

Malware analysis is the process of examining malicious software to understand what it does, how it spreads, and how to remove it. Incident responders use analysis findings to contain an active infection, clean affected systems, and prevent recurrence. Two foundational approaches are static analysis and dynamic analysis.

Static Analysis

Static analysis examines a file without executing it. You collect facts about the file itself:

Static analysis is fast and safe because you never run the file. Its limitation is that obfuscation and packing can hide most meaningful content.

Basic Dynamic Analysis

Dynamic analysis runs the sample in a controlled environment and records what actually happens. A sandbox automates this: it executes the file inside an isolated virtual machine, captures system calls, network traffic, registry changes, and file system activity, then produces a behavior report.

Cuckoo Sandbox is an open-source, self-hosted sandbox widely used in training and production environments. Any.Run is a cloud-based interactive sandbox with a free tier suitable for training. Both are acceptable for this lab.

Key behaviors to record during dynamic analysis:

Sysinternals Tools for Live Analysis

When examining a running or recently infected Windows system, the Sysinternals Suite (published by Microsoft) provides essential visibility:

Use Sysinternals on the lab VM only, never on a production system during live analysis without authorization and a documented change-control process.

Safety and Lab Isolation

Isolation is non-negotiable. Malware analysis — even with pre-approved training samples — must occur inside a network-isolated virtual machine. Before starting:

1. Confirm the lab VM's network adapter is set to Host-Only or Isolated mode, with no path to your production network or the internet (unless using a cloud sandbox where isolation is managed for you).

2. Take a snapshot of the clean VM state before executing or importing any sample. You can revert cleanly when finished.

3. Never transfer a malware sample to a host machine or share it over email or chat.

4. Treat every file produced during analysis (memory dumps, dropped files, logs) as potentially hazardous until confirmed otherwise.

These controls mirror real-world incident response practice and protect both you and the school network.

Writing an Eradication Plan

Eradication removes the threat completely. A well-ordered plan prevents re-infection. Standard sequence:

1. Isolate the affected system from the network first (pull cable or disable the NIC).

2. Terminate malicious processes.

3. Remove persistence mechanisms — delete malicious registry run keys, disable or delete scheduled tasks, remove malicious services.

4. Delete dropped files — use full absolute paths identified during analysis.

5. Reset credentials that may have been exposed.

6. Patch the vulnerability exploited for initial access.

7. Restore from a known-good backup or rebuild if the system integrity is in doubt.

8. Verify with a fresh scan before reconnecting to the network.

Order matters: removing a dropped file before disabling its scheduled task can allow the task to re-download it. Always kill persistence first, then artifacts.

Connecting to Your Credentials

CompTIA Security+ and CySA+ both include incident response and malware-analysis content. ISC2 CC covers the security principles that underpin safe analysis practices. The skills you practice in this lab — hashing, behavioral observation, and structured eradication — map directly to exam objectives and to day-one job tasks in a SOC or IR role.

Key terms10

Static analysisExamination of a malware file without executing it, using hashes, string extraction, and PE header review to identify its characteristics.
Dynamic analysisRunning a malware sample in a controlled, isolated environment and recording its runtime behaviors such as file drops, registry changes, and network connections.
SandboxAn isolated virtual environment — such as Cuckoo Sandbox or Any.Run — that executes a malware sample and automatically captures its behavior for analysis.
File hashA fixed-length cryptographic digest (e.g., SHA-256) computed from a file's contents that uniquely identifies it and supports threat-intelligence lookups.
Persistence mechanismA method malware uses to survive reboots, such as registry run keys, scheduled tasks, or malicious services.
AutorunsA Sysinternals tool that enumerates all autostart locations on a Windows system, making it practical to spot malware-added persistence entries.
Indicators of Compromise (IOCs)Observable artifacts — file hashes, IP addresses, domain names, registry keys — that indicate a system has been compromised.
EradicationThe incident response phase in which all components of a threat — malicious files, persistence mechanisms, and attacker-created accounts — are removed from affected systems.
Strings extractionA static analysis technique that pulls printable character sequences from a binary file to reveal embedded URLs, registry paths, and API function names.
Process Monitor (Procmon)A Sysinternals tool that captures real-time file system, registry, and process activity on a Windows system, used to observe malware behavior during live analysis.
In class: Submit a provided malware sample (pre-approved, safe for training) to an isolated Cuckoo Sandbox or Any.Run session; record file hashes, strings, and observed behaviors in an analysis worksheet. · Use Sysinternals tools (Process Monitor, Autoruns, TCPView) on a Windows lab VM to identify persistence mechanisms and lateral movement artifacts left by a simulated malware infection. · Write a step-by-step eradication plan for the simulated infection, including removal of malicious registry keys, scheduled tasks, and dropped files, and specify the order of operations to avoid re-infection.
Materials: Cuckoo Sandbox or Any.Run (free tier), Sysinternals Suite, pre-staged lab VMs with simulated infection artifacts, malware analysis worksheet, student guides
Check: Analysis worksheet and eradication plan reviewed by instructor; must correctly identify at least 4 of 5 planted artifacts and provide a logically ordered eradication sequence to pass.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — Threats, Attacks and Vulnerabilities
1. An analyst extracts a SHA-256 hash from a suspicious file and searches for it in a threat-intelligence database before running the file. Which analysis technique is the analyst using?
CompTIA CySA+ — Incident Response
2. Before submitting a malware sample to an on-premises sandbox, a trainee should first take which action to allow a safe return to a known state?
CompTIA Security+ — Threats, Attacks and Vulnerabilities
3. During dynamic analysis in a sandbox, the report shows that the sample creates a registry value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the most likely purpose of this action?
CompTIA CySA+ — Incident Response
4. A responder uses Autoruns and finds an entry in the Scheduled Tasks tab pointing to a file named 'svch0st.exe' in C:\ProgramData. The entry is unsigned. What is the appropriate next step in the eradication process?
CompTIA CySA+ — Security Operations
5. Which Sysinternals tool would best help an analyst identify an unusual outbound connection made by a suspicious process on a live Windows system?
CompTIA Security+ — Threats, Attacks and Vulnerabilities
6. An analyst performing static analysis extracts the following readable text from a malware binary: 'http://update.badactor.net/payload.exe' and 'RegSetValueEx'. What do these strings most likely indicate?
ISC2 CC — Incident Response
7. In the incident response lifecycle, during which phase does an analyst remove malicious registry keys, delete dropped files, and unschedule malicious tasks?
CompTIA CySA+ — Threat Intelligence
8. A malware sample is heavily packed, meaning most of its code is compressed or encrypted inside the binary. Which limitation does this create for static analysis?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →