🛡️ Sherlocked Security – Malware Sandbox Analysis
Dissect and Understand Malicious Payloads Without Risking Your Network
📄 1. Statement of Work (SOW)
Service Name: Malware Sandbox Analysis
Client Type: Enterprises, CERTs, MSSPs, Financial Institutions, SOC Teams
Service Model: Static + Dynamic Analysis in Controlled Environments
Compliance Coverage: ISO 27001, SOC 2, GDPR, MITRE ATT&CK
Analysis Types:
- File-based (EXE, DLL, DOCX, PDF)
- URL-based Payloads & Droppers
- Memory-only Malware
- Obfuscated Scripts (VBS, JS, BAT, PowerShell)
🧠 2. Our Approach (with Visual)
🔹 Safe Isolation in Detonated Environments
🔹 Behavior-Based Classification
🔹 Threat Actor and TTP Mapping
[File Intake] → [Static Analysis] → [Dynamic Execution in Sandbox] → [Behavior Logging] → [IOC Extraction] → [TTP Mapping] → [Report Generation & Client Briefing]
🧪 3. Methodology (with Visual)
[Malware Sample Intake] → [File Fingerprinting (hashes, metadata)] → [Static Disassembly & String Analysis] → [Sandboxed Execution & Behavior Capture] → [C2, Registry, Network Indicators Extraction] → [Threat Classification] → [MITRE ATT&CK TTP Alignment] → [Detailed Report Generation] → [Client Review + IOC Sharing]
📦 4. Deliverables to the Client
- ✅ Malware Classification Report
- 🧾 IOC Package (IPs, Domains, Hashes, Registry Keys)
- 🧭 Static and Dynamic Behavior Maps
- 📘 Malware Analysis Report including:
- File Metadata & Entropy
- Behavioral Summary (network, file, memory)
- Screenshots from sandbox environment
- Persistence & Evasion Techniques
- MITRE ATT&CK Mapping
- Remediation Guidance
- References
- 📊 Process Tree & Behavior Flowcharts
- 📽️ Optional Analyst Walkthrough (Recording or Call)
- 🧑💻 Detection Use Case Recommendations
- 🔁 Retest with Updated Sample (if variant found)
- 🎓 Malware Analysis Certificate (Per Sample/Batch)
🤝 5. What We Need from You (Client Requirements)
- ✅ Suspicious File or URL Sample (ZIP with password: infected)
- ✅ Context or Source (email, download, endpoint path)
- ✅ Any observed behaviors (slow PC, file drops, DNS queries)
- ✅ Consent for execution in controlled sandbox
- ✅ POC for report briefing
- ✅ Deadline/SLA (if urgent triage needed)
🧰 6. Tools & Technology Stack
- 🧪 Sandbox Engines (Cuckoo, Any.Run, Joe Sandbox, VMRay)
- 🧬 Static Analysis (Ghidra, PEStudio, Detect-It-Easy)
- 📡 Network Monitoring (PCAP, Wireshark, Suricata)
- 🔍 Threat Intel (VirusTotal, Hybrid Analysis, ThreatFox)
- ⚙️ Custom Disassembler Scripts (Python, YARA)
- 📊 Visualization (Graphviz, Maltego, Process Explorer)
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Discovery Call 2. Sample Intake 3. File Triage & Fingerprinting 4. Static Analysis 5. Sandbox Detonation 6. IOC Extraction & TTP Mapping 7. Report Compilation 8. Client Review Meeting 9. Optional Variant Re-Analysis
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🧠 Dual-Phase Analysis | Static + dynamic insights for complete behavior mapping |
| 🔁 Variant Recognition | Detection of obfuscation, packing, and malware families |
| 📘 MITRE Mapped Reports | Use-case ready for SOC integration |
| ⚙️ IOC Extraction Suite | Machine-parseable output for SIEM/EDR tuning |
| 🎓 Knowledge Transfer | Briefings, training, and walk-throughs available |
📚 9. Real-World Case Studies
🦠 PDF Dropper Campaign on HR Portal
Client: Mid-size IT Services Firm
Sample: PDF file uploaded via job form
Findings:
- Embedded macro downloading executable
- C2 via Telegram API
Outcome: - IOC blocklist distributed to firewall & EDR
- Policy updated to sanitize uploads
💣 JS-based CryptoMiner in Marketing Email
Client: SaaS CRM Platform
Action:
- JavaScript redirected to mining script after user click
- Obfuscated and dynamically generated hostnames
Outcome: - Sandbox captured all C2 calls
- Block rules created and campaign reported
🛡️ 10. SOP – Standard Operating Procedure
- Sample Submission by Client
- Hash fingerprinting and format validation
- Static metadata & entropy analysis
- Controlled sandbox execution
- Record behavior (network, registry, process)
- Extract and score IOCs
- Classify malware & map to MITRE
- Compile detailed report
- Deliver IOC pack and walkthrough
- Optional: Redetonation or variant correlation
📋 11. Sample Malware Analysis Report Snippet (Preview)
- Submit suspicious files and URLs to sandbox.
- Record static and dynamic analysis results.
- Detect evasion, anti-VM, or obfuscation techniques.
- Extract network indicators and system changes.
- Identify persistence and command-and-control behavior.
- Map behavior to known malware families.
- Correlate with threat actor TTPs.
- Generate threat score and confidence level.
- Export IOCs and behavioral signatures.
- Deliver analysis summary for SOC action.