Lab 3-4

1) What happens when you run this file?

Apparently, when executed, the Malware does nothing and deletes itself. By taking a closer look with Process Monitor it’s possible to see several Registry values being checked:

Also, it’s possible to see that the Malware invokes cmd.exe in order to delete itself:

It’s possible that the Malware didn’t find all the requirements in order to perform its real actions.

2) What is causing the roadblock in dynamic analysis?

It is possible that some System component is missing or special arguments must be provided in order to make the Malware execute successfully.

3) Are there other ways to run this program?

It’s possible that this Malware can only be executed properly when provided the right arguments. In the strings of the Malware, we can find possible flags like -cc, -re or -in that may be used in order to make the Malware run properly.