I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to begin. The professor has mentioned that the best place to start is by taking a snapshot of your initial system setup, running the malware, and then "figuring out what has changed".
My strategy is as follows:
- Take a memory backup of my initial VM state.
- Set up my VM so that a network connection is available, but doesn't actually connect to the internet.
- Run the malware (in a debugger? outside of a debugger?).
This is where I get a little iffy. I am not sure what "checking for changes on the system" entails. Does this mean I need to take a memory dump of the OS state after the malware has run? What should I be looking for within the memory dump? Is there some tool that identifies meaningful changes between my starting state and the state after the malware runs? Do I need to audit the registry keys to see what has been changed? If I know the malware uses the network, should I be running Wireshark?
Ultimately, I am not sure what the most efficient approach is. It is a pretty powerful piece of malware with a lot of functionality and I want to make sure I collect all necessary information upfront so I don't waste time later in the project.