3

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there an alternate to this that will capture deleted files?

I imagine this will need to work at the Kernel leverl for API hooking as well. I have looked at a couple of alternatives including using PowerShell to monitor file changes (http://dereknewton.com/category/powershell/) and also to use the WMI process for logging data, but neither of them are a great solution and I want all captured files that the malware attempts to delete.

Does anyone know of a tool that will work on Windows 7 for this?

Improve this question

2 Answers 2

Reset to default
1

Capture BAT is open-source. Why not just rebuild it for Windows 7?

And based on my 10 seconds of skimming Capture BAT's described functionality, it seems that Process Monitor might be a viable alternative.

Improve this answer
2
  • First, I am not a coder so wouldn't know where to begin coding. Second, Process Monitor only observes the system as it runs and dues not capture deleted files of network pcaps
    – user3413087
    May 8, 2014 at 14:06
  • You don't have to code anything. Just compile it under your own local machine.
    – drum
    May 9, 2014 at 6:29
0

This is a kind of hackish method, but works.

Try to run Rohitab API Monitor. This will monitor process creations. If a process is started you will be notified and able to catch its parameter and more :)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.