A forum for reverse engineering, OS internals and malware analysis
0.chloe wrote:An option that redirects all newly created files to a specific folder?(BSA do this, but does not work in most cases)You mean Sandboxie, and it works in all cases: no files are written out of sandbox folder.
Buster_BSA wrote:You mean Sandboxie, and it works in all cases: no files are written out of sandbox folder.Oh, yes I mean Sandboxie. I analyzed a sample a few days ago and an .ini was dropped but Sandboxie did not save the file. Cuckoo did a great job with the saving.
Buster_BSA wrote:I do not see any ".ini" in the malwr report.I'am sorry, I meant .bat-file.
CreateFile(C:\Documents and Settings\Buster\Datos de programa\9004503.bat) [c:\m\test\f29e355693fc9169e02179fe510f56f6fc6975c2250dc794f25a0333e673e729.exe]Sandboxie does not save the file because the file would not be saved if you run the malware in a real system, so it is perfectly normal.
DeleteFile(C:\DOCUME~1\BUSTER\DATOSD~1\9004503.bat) [c:\windows\system32\cmd.exe]
Buster_BSA wrote:Sandboxie does not save the file because the file would not be saved if you run the malware in a real system, so it is perfectly normal.I understand that, but I want to have the file saved, it's essential for further investigate how the malware works.
