perform-dynamic-malware-analysis

Perform Dynamic Malware Analysis

Overview

Execute only inside an environment chosen by select-analysis-isolation and preflighted by prepare-isolated-analysis-lab, with an observation plan that can distinguish artifact behavior from baseline noise. Preserve the exact sample, prepared-lab record, and environment identity.

Read references/dynamic-observation-plan.md for baseline, stimulus, telemetry, and teardown fields.

Workflow

1. Define the unresolved question and minimum stimulus.
2. Verify isolation.
   • Require the prepared-lab record and verify its guest/platform build, baseline/reset state, accounts, shares, clipboard, devices, credentials, network mode, monitoring, stop controls, export path, and teardown plan are still current.
   • Record virtualization artifacts or anti-VM behavior that may affect the conclusion.
3. Capture a baseline.
   • Record processes, files/registrations, persistence surfaces, network state, services, and relevant logs before execution.
4. Execute one controlled step.
   • Record command/UI action, time, user/privilege, environment variables, arguments, and interactions.
   • Do not improvise additional payloads, credentials, or targets.
5. Observe behavior.
   • Correlate process tree, file/registry or platform state, persistence, permissions, child artifacts, network/DNS, logs, prompts, crashes, and timing.
   • Hash and preserve dropped/modified artifacts as new evidence.
6. Repeat only to answer a named question.
   • Change one variable at a time and revert to the baseline snapshot.
7. Export and tear down.
   • Export only intended evidence, scan it before host use, destroy/revert the environment, and revoke temporary access.

Output

Return the prepared-lab identity, environment/baseline identity, stimulus, observed timeline, artifacts and indicators, absent expected behavior, virtualization/evasion/coverage limits, conclusion, and teardown verification.