Lion Cipher Lab
Dynamic analysis: safely watch a program's real behavior in a sandbox VM
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Real malware is packed, obfuscated, and encrypted specifically to defeat someone reading its code. Static analysis can be blind to a payload that only unpacks itself in memory at runtime — but the program still has to DO its job when it runs, and that behaviour is observable. Dynamic analysis is how a DFIR analyst answers 'what does this thing actually do to a machine?' — what files it drops, how it survives a reboot, who it calls home to. The catch is that running unknown code is how you infect yourself, so the real skill is not clicking 'run': it is the discipline of a safe, isolated,…
What you'll learn
- what dynamic analysis is and how it complements static analysis
- building a safe, isolated analysis lab (throwaway VM, snapshots, network isolation)
- simulating the internet so a sample 'phones home' to you, not its real C2 (INetSim / FakeNet-NG)
- writing a benign specimen that produces real, observable malware-like behaviour
- capturing behaviour with Process Monitor filtered to one process
- finding persistence with Autoruns and mapping it to MITRE ATT&CK
- turning observed behaviour into IOCs and a handoff to a YARA rule
- judgment: when to run a sample dynamically, when static is safer, and when malware refuses to detonate
Steps in this lab
- Static vs dynamic — two ways to look at a suspicious file
- WHEN dynamic beats static — and WHEN it fails
- Build the safe lab: an isolated, revertible analysis VM
- Simulate the internet so 'phone home' still fires — safely
- Get the observation tools (inside the VM, on your clean snapshot)
- Write the benign specimen (it stands in for real malware)
- Capture the behaviour with Process Monitor
- Find the persistence with Autoruns, and map it to ATT&CK
- Turn behaviour into IOCs and hand off to a YARA rule
- Revert, and the judgment to keep