Use the CLI to change the artifact extraction parameters before you submit malware sample analysis on the Malware Analysis appliance.
Note
Artifact extraction is enabled by default, but you can configure extraction settings such as whether to extract full memory dumps or extract artifacts from live malware analysis samples.
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
Start the configuration wizard.
hostname (config) # analysis extract-artifact
Answer the questions when you are prompted.
All the fields are optional. To change an answer while running the wizard, press CTRL+C, and then enter the step number. To skip a parameter, press Enter. To clear a previously saved value, enter clear. Entering a new value will overwrite the previous value of the parameter. To save changes and exit, press Enter.
Step
Response
Enable artifact extraction during DA?
Enter yes to enable the administrator to extract artifacts during dynamic analysis.
File extraction mode?
Enter production mode.
File extraction enabled?
Enter yes to perform file extractions. Default is yes.
Extract all types of dropped files?
Enter yes to extract all dropped file types. Default is yes.
Extract dropped executable and PE files?
Enter yes to extract dropped executable and PE files. Default is yes.
Extract dropped script files?
Enter yes to extract dropped script files. Default is yes.
Extract dropped embedded objects?
Enter yes to extract embedded objects. Default is yes.
Extract dropped de-obfuscated active content?
Enter yes to extract dropped de-obfuscated active content. Default is yes.
Extract dropped live mode payload?
Enter yes to extract dropped live mode payloads. Default is yes.
Extract additional artifacts?
Enter yes to extract additional artifacts associated with malware behavior. Default is yes.
Total number of artifacts to be extracted?
Enter the number. Default is the maximum of 10 artifacts.
Extract full memory dump?
Enter yes to extract full memory dumps. Default is no.
Extract memory regions for an unpacked PE files dump?
Enter yes to extract memory regions for unpacked PE files dumps. Default is no.
Extract memory regions for a critical API call dump?
Enter yes to extract memory regions for critical API call dumps. Default is no.
Extract XCSection for a stack dump?
Enter yes to extract the eXecutable Code Section for stack dumps. Default is no.
Extract heap spray memory dump?
Enter yes to extract heap spray memory dumps. Default is no.
Extract shell code memory dump?
Enter yes to extract shell code memory dumps. Default is no.
Extract kernel dumps?
Enter yes to extract kernel dumps. Default is no.
Max number of dumps to be extracted?
Enter the number. Default is the maximum of 10 artifacts.
Verify your changes that you made through the wizard.
Save your changes.
hostname (config) # write memory