Instructor: In this lesson, 2 2
we're going to talk about sandboxing. 3 3
Now, signature-based tools 4 4
are becoming less and less effective 5 5
in their ability to automatically block malware execution, 6 6
because malware creators 7 7
are getting more advanced in their techniques 8 8
to disguise their malicious intent all the time. 9 9
Now, in order to compete with this advancing malware, 10 10
malware analysts need to keep improving their techniques 11 11
and their ability to conduct manual analysis 12 12
of that malware. 13 13
To do this, they often have to run malware 14 14
in a controlled environment to observe its effects, 15 15
but they don't want to infect their own networks or systems, 16 16
so we use a technique known as sandboxing. 17 17
Sandboxing is a computing environment 18 18
that's isolated from the host system 19 19
to guarantee that the environment 20 20
runs in a controlled and secure fashion, 21 21
and that the communication links 22 22
between the sandbox and the host are completely prohibited. 23 23
Now, most often you're going to see a sandbox environment 24 24
created by using something like a virtual machine 25 25
or virtual box. 26 26
This allows us to install whatever operating system we want, 27 27
set up the parameters we need, take a snapshot, 28 28
and then we can load up the malware inside of it 29 29
and run that malware, 30 30
and then we'll be able to find out things about that malware 31 31
based on what we see 32 32
when we run it inside that virtualized environment. 33 33
For example, let's say I run 34 34
a malicious file inside of a sandbox. 35 35
I can then determine if that file really is malicious 36 36
and determine any effects it's going to have on the system, 37 37
and we can also identify any dependencies 38 38
within the files on that host that may exist 39 39
whenever you're running that piece of malware. 40 40
By using sandboxing, 41 41
it's going to allow us to quickly test malware 42 42
in multiple different environments 43 43
across multiple different operating systems 44 44
without really affecting our underlying host. 45 45
Now, to effectively analyze malware, 46 46
we're going to be using this sandboxing tool, 47 47
and we're going to use a lot of different features 48 48
inside of a sandbox. 49 49
For example, we can monitor any system changes 50 50
without direct user intervention. 51 51
So if I run a file, 52 52
and then all of a sudden 53 53
something changes inside of that system, 54 54
such as inside the registry, 55 55
new files were created, or whatever, 56 56
we can identify those within the sandbox. 57 57
Also, I can execute files that are known to be malicious, 58 58
and that way if I know they're malicious, 59 59
I can then monitor all the changes that are happening 60 60
to the processes, to the registry, to the file system 61 61
on that given sandbox system, 62 62
and that will help me develop 63 63
my indicators of compromise or signatures 64 64
for my other solutions 65 65
like antimalware or antivirus solutions. 66 66
Additionally, I can monitor network sockets 67 67
for attempted connections 68 68
in a way that can identify any kind of known bad IPs 69 69
that are being used for command and control nodes 70 70
or beaconing or something like that. 71 71
Also, I can use the sandbox 72 72
to be able to monitor for system calls that are being made 73 73
or any API calls that are being called 74 74
by that malicious binary. 75 75
Another great feature of using a sandbox 76 76
is what's known as a snapshot feature. 77 77
Now, a snapshot allows us to take an instant copy 78 78
or backup of the environment before we run a program. 79 79
Then we can run that malicious program, 80 80
and after we see the changes 81 81
we can roll back to the time before that snapshot. 82 82
This is much quicker 83 83
than doing a full backup and restoration 84 84
that can take several hours sometimes on larger systems, 85 85
whereas a snapshot can take about 30 to 60 seconds. 86 86
Another thing we're able to do inside of our sandbox 87 87
is to record any file creation or deletions 88 88
that may be happening when we're running a piece of malware, 89 89
and we can dump all of the information 90 90
from that virtual machine's memory in that sandbox 91 91
so then we can do a full analysis of the program 92 92
and the contents of memory on that system. 93 93
This is important because sometimes 94 94
when we're dealing with a piece of malware, 95 95
they actually make compress it or pack it or encrypt it, 96 96
and it won't be unencrypted or decompressed 97 97
until you run the malware. 98 98
So when you run it inside a sandbox, 99 99
we can then have that malware in memory, 100 100
and when we dump that virtual memory, 101 101
we can then analyze that virtual memory dump 102 102
in the unpacked or unencrypted version of that malware. 103 103
Now, one of the big keys that you have to have 104 104
when you're dealing with a sandbox 105 105
is that your sandbox host, which is a virtual machine, 106 106
should not be used for any other purposes 107 107
except for your malware analysis. 108 108
This keeps your sandbox clean, 109 109
and once it's infected, 110 110
it keeps the infection from spreading anywhere else 111 111
because it's isolated inside of the sandbox. 112 112
Now, there are lots of different tools that we can use 113 113
when we're doing sandboxing. 114 114
One of my favorites is actually known as FLARE VM, 115 115
which is provided by Mandiant. 116 116
Now, FLARE VM is actually a free program 117 117
that you can install on top of Windows 10, 118 118
and this allows you to run a Windows binary on the system 119 119
and then see what the status is 120 120
and all the different changes that that malware is doing. 121 121
All of this can be run 122 122
in any virtualization program you want, 123 123
such as VMware or VirtualBox or Parallels 124 124
or something like that. 125 125
And this way we have a nice sandbox environment 126 126
to be able to do malware analysis 127 127
if you're working as a triage analyst or a malware analyst. 128 128
Another great tool out there is known as Cuckoo. 129 129
Now, Cuckoo is a sandboxing program 130 130
that allows you to automatically run 131 131
a bunch of different malware samples in it 132 132
and then see what they do inside of a Linux environment, 133 133
a Windows environment, or even a Mac environment. 134 134
Cuckoo is a really good program 135 135
for providing you with a lot of automation 136 136
inside of this world of malware analysis, 137 137
so you don't have to do as much manual analysis 138 138
as you're going through and doing your triage 139 139
of a particular piece of malware. 140 140
The third program we need to talk about 141 141
is known as Joe Sandbox. 142 142
Now, Joe Sandbox is another great sandboxing tool 143 143
that you can use as a cybersecurity analyst. 144 144
Joe Sandbox is a dynamic malware analysis tool 145 145
that allows a security research or cybersecurity analyst 146 146
to analyze and understand the behavior of malware samples 147 147
in a safe and controlled environment. 148 148
It's designed to automate the process of analyzing malware, 149 149
allowing security professionals like you and I 150 150
to quickly and easily identify potential threats 151 151
without the need for manual analysis. 152 152
At its core, Joe Sandbox is going to emulate 153 153
the environment of a real computer, 154 154
like a virtual machine would, 155 155
and allows malware samples to be run and analyzed 156 156
in a safe isolated environment. 157 157
It then collects and analyzes data 158 158
on the malware's behavior, 159 159
such as which files it's creating are modifying, 160 160
what network connections are being made, 161 161
and what changes are being made to the registry 162 162
and other parts of the system. 163 163
This information can then be used to identify 164 164
the malware's capabilities, 165 165
such as whether it's spyware, ransomware, 166 166
or some other kind of malware. 167 167
Now, one of the key features of Joe Sandbox 168 168
is its ability to detect and analyze malware 169 169
across multiple platforms, 170 170
including Windows, Mac OS, Linux, and Android. 171 171
This allows us the security professionals 172 172
to analyze malware samples on all these different platforms 173 173
where they're most likely to be to be encountered, 174 174
and provide us a comprehensive view 175 175
of that particular malware's behavior. 176 176
Now, another great thing about Joe Sandbox 177 177
is that it provides a user-friendly interface for us to use 178 178
to easily view and analyze 179 179
the data being collected from these malware samples. 180 180
The interface then displays the information 181 181
in an organized and intuitive manner, 182 182
and allows cybersecurity professionals like us 183 183
to quickly identify potential threats 184 184
and take the appropriate actions. 185 185
Another important feature of Joe Sandbox 186 186
is the ability to automatically classify malware 187 187
based on its behavior, 188 188
so we can actually identify malware based on its family, 189 189
tracking the evolution of a piece of malware 190 190
or identifying similarities 191 191
between different types of malware samples 192 192
that we're analyzing inside of Joe Sandbox. 193 193
Now, because the CySA+ exam 194 194
is considered to be vendor neutral, 195 195
they're not going to go into too much detail 196 196
on any specific tool, 197 197
such as FLARE VM, Cuckoo, or Joe Sandbox, 198 198
but I am mentioning them here 199 199
because they're really good tools for you to know about 200 200
when you're working as a cybersecurity analyst, 201 201
a triage analyst, or a malware analyst. 202 202
Now, if you want to do more complex analysis, though, 203 203
you're going to need to create a honeypot lab, 204 204
and this will have multiple sandbox machines 205 205
and internet access, 206 206
so you can actually study the malware and its C2 structure 207 207
as it starts communicating out 208 208
with lots of other things on the network. 209 209
But again, creating this type of honey net or honeypot 210 210
is beyond the scope of the CySA+ exam. 211 211
But if you find yourself working as a malware analyst, 212 212
then you may be asked to set one of these up and use it 213 213
as you're performing your job functions during your career.