Access detailed malware analysis report

To access the report:

1. Go to the Submissions or Alerts page.

2. Click on the malicious file or URL link to view the detailed report.

3. Review the following details:

   • Overview: Provides a detailed summary of the analysis.

     • Analysis Details - This section contains general information on the analysis, such as any signatures and engines that were detected, how long the analysis took, a brief description of the submitted file, and so on.

     • Process Graph - This section shows a graph of the sample with its process ID, process name, and command line. Click to expand the window.

   • Detection: Displays the threat detection rules triggered by the sample.

     • Engine: The name of the engine that detected the sample.

     • Rule ID: The rule that was checked against the events during the sample analysis to determine if the file is malicious.

     • Signature Name: The name of the threat group associated with the sample.

     • Weight: The score assigned to the signature. If the score is greater than or equal to 100, the sample is malicious.

   • Extracted Object: Analyze extracted files and artifacts. This is divided into two sections:

     • Graph: This section displays a graph of the objects extracted from the sample during analysis. For more information on an extracted object, click on the name to go directly to the Details section.

     • Details: This section displays detailed analysis results of each extracted object. The object name, hash values, verdict, and any associated signatures are listed. For any sample with a verdict of Custom Riskware, Malicious, or Riskware, you can expand the sample to view the analysis results. This provides more information, such as the detection engine that analyzed the sample, the weight, and the signature.

   • ATT&CK: Map threat behavior using MITRE ATT&CK.

     On the MITRE ATT&CK Mapping page, any rules triggered by the sample are mapped to the MITRE ATT&CK matrix. The MITRE ATT&CK matrix contains a set of techniques used to achieve specific objectives, or tactics, from gathering information about the target person or group, to extracting information from that target.

     Tactic	Description
     Initial access	Attempting to gain access to your system. For example, using a phishing campaign.
     Execution	Running malicious code on your system.
     Persistence	Attempting to maintain access to your system.
     Privilege execution	Attempting to gain higher level permissions on your system
     Defense evasion	Attempting to avoid detection on your system.
     Credential access	Attempting to gain access to user names and passwords, for example by key logging.
     Discovery	Exploring your system to see what can be accessed and controlled.
     Lateral movement	Using legitimate credentials to move through your system.
     Collection	Gathering information of interest to the attacker.
     Command and control	Communicating with compromised systems to control them.
     Exfiltration	Stealing data from your system.
     Impact	Manipulating, interrupting, or destroying systems and data. For example, using ransomware to encrypt data.

   • Files, Processes and Registry: Monitor file, process, and registry activities.

     • The Files page lists all files that were accessed by the sample. All files that were read, edited, created, or deleted are shown in separate tables. The following table describes the details on the Files page:

       Column	Description
       PID	The unique number assigned to identify the process.
       Process Name	The name of the process accessed by the sample.
       File Details	The path name of the file that was read, edited, created, or deleted.
       Size	The size of the file that was read, edited, created, or deleted.
       Create Options	The options applied when the file was read or created.

     • The Processes page lists all processes started or terminated by the sample. The following table describes the details on the Processes page:

       Column	Description
       PID	The unique number assigned to identify the process.
       PPID	The unique number assigned to identify the parent process.
       Process Name	The name of the process accessed by the sample.
       Parent Name	The name of the parent process accessed by the sample.
       Command Line	The command and parameters used to run the operation on the process.

     • The Registry page shows all queries to registry events and changes to registry events. The following table describes the details on the Registry page:

       Column	Description
       PID	The unique number assigned to identify the process.
       Registry Value	The registry value that was queried or changed.
       Process Name	The name of the process associated with the registry value.
       NTSTATUS	These values communicate system information.

   • APIs: Monitor API calls made by the sample. The following table describes the details on the API page:

     Column	Description
     PID	The unique number assigned to identify the process.
     Image Path	The file path to the process run by the sample.
     DLL Name	The name of the library accessed by the API call.
     API Name	The name of the API called by the sample.
     Parameters	The parameters applied to the API.

   • Network: Monitors network-related activities. It consists of:

     • Callbacks: A callback is an outbound communication sent by a threat to remotely control a system, collect data, or download additional malware.

     • Network Traffic: The flow of data across a network, monitored for unusual patterns to determine malicious activities.

       The following table describes the details of Callbacks and Network Traffic.

       Column	Description
       Port	The port number of the network process.
       DNS Name	The domain name associated with the network.
       Payload	The data embedded in the network call.
       Signature Name	The name of the threat group behind a malicious attack.
       Weight	The score assigned to the signature. If the score is greater than or equal to 100, the sample is malicious.

     • Network Events: Specific actions or activities within the network, such as connection attempts or configuration changes, that are monitored to identify potential security threats.

       The following table describes the details of Network Events

       Column	Description
       Mode	The type of network event, such as DNS query, listen, and so on.
       Host Name	IP address or host name of the destination.
       Protocol	The type of network event.
       Process Name	The process name accessed by the sample.
       PID	The unique number assigned to identify the process.

   • Search: Allow users to search for specific events in the analysis.

   • IOCs: Analyzes extracted Indicators of Compromise from the sample. All IOCs that were extracted during the analysis are displayed here. If an IOC is extracted during analysis, then your system may have been compromised. The name and MD5 hash are displayed for the main object and any associated files.