Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection.

I've looked at CaptureBat, but its drivers are only 32-bit. I also thought about using file recovery utilities for this.

  • No need to use a third-party tool. You can just use ACLs. See serverfault.com/questions/285058/… Commented Jun 16, 2013 at 21:36
  • Ok, thanks. I'll try it but as mentioned in the suggested post, it can crash the application or even prevent it from executing by the "desired" path. Still, I'm more interested with something that will not interfere with the program flow.
    – PhoeniX
    Commented Jun 16, 2013 at 21:42
  • How about manually patching your executable?
    – PSS
    Commented Jun 18, 2013 at 3:50
  • It's a way, but needs development. Or, if you mean, by using debugger, then it is also not straight forward. As it looks right now, I'll eventually will need to develop my own tool :)
    – PhoeniX
    Commented Jun 18, 2013 at 6:26
  • So did you get you hands dirty? I need exactly what you requested for, I´m analyzing a malware which deletes itself. I created the forensic timeline with sleuthkit fls, but there is no trace of the deleted file. File carving is a possibility but it is time consuming so I'm also looking for something as practical as capture bat is for x32.
    – h4sh
    Commented Mar 6, 2015 at 17:39

2 Answers 2


There are couple of ways that I could think of.

First off, you could use Cuckoo Sandbox. It is an automated malware analysis system. It is open source and its modules are written in Python. To quote the website:

Malware! Tear it apart, discover its ins and outs and collect actionable threat data. Cuckoo is the leading open source automated malware analysis system.

Pretty exciting, isn't it? I believe, it will capture dropped files by default. Once a malware sample is submitted to Cuckoo Sandbox and analysis is completed, user gets analysis report. Certain sub-directory of the analysis report will contain files Cuckoo was able to dump. For more information check out Cuckoo's Analysis Result page.

In addition, you could create your own custom module to process dropped files. What are processing modules? Per Cuckoo Doc Website:

Cuckoo’s processing modules are Python scripts that let you define custom ways to analyze the raw results generated by the sandbox and append some information to a global container that will be later used by the signatures and the reporting modules. You can create as many modules as you want, as long as they follow a predefined structure...

I am pretty sure there are other automated sandboxes out there as well. However, you have to remember, there is no 100% guarantee a sandbox will process your malware just the way it would execute in real life environment.

Second method. You really need to know HOW dropped files are deleted for this method to work. I have already mentioned it in the comments above. You could also patch your executable. Let's say DeleteFile() is used. If patching malware is not an option, you could hook DeleteFile() function system wide. It is standard Windows API used to delete a file. This function is exported by Kernel32.dll. There is a lot written about system wide or global hooks and ways to accomplish it. I will not go in details about it here. However, there is one thing worth mentioning, you have to make sure you "trick" malware into "thinking" file is indeed delete by returning appropriate values. That's why, there could be a problem with using ACL directly. What if malware checks a return of DeleteFile() (or whatever it uses to delete the dropped file), and gets ERROR_ACCESS_DENIED? It might very well divert it from the regular "desired" execution path.

In addition, there are debuggers out there, that you help you make this process rather semi-automated. To mention few: Immunity Debugger by Immunity Inc. It employs very well supported Python API for automation and scripting. There are other option out there as well.

What I would like to mention at the end is that you are absolutely right. You might need to look into creating a little tool of your own. There is no "one-fits-all" solution. Some automated solutions might work better then others. From time to time you will have to dig in. Remember, getting your hands "dirty" gives you great and in-depth understanding of things happening behind the "curtain". I personally love such an involvement, and find it to be a really great learning experience.

  • 1
    Thanks a lot for your explanation! So it decided then, I'll try to develop a such tool, something I need to think about how and I completely understand your passion about getting hand "dirty" as I also like to do it too.
    – PhoeniX
    Commented Jun 18, 2013 at 20:42

You can try the APIMonitor as well. Firstly filter the WINAPI calls you are looking for in this case we're looking for CreateProcessA, CreateProcessW, WriteFile, and WriteFileEx so that we can track any new file or process creation. Now load the executable into it and In the summary tab in the top-right corner It'll list all the API calls being made and the data being sent. In many cases, that's insufficient so we can put a breakpoint on the API called made, select the API call for the File being written, and right-click > breakpoint>before the call. Now rerun the executable and it'll be stopped when the file is created hence you can go into the folder, and review the file as per your requirement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.