Early exit dynamic analysis of a virtual machine
Techniques for early exit dynamic analysis of a virtual machine are disclosed. In some embodiments, a system/process/computer program product for early exit dynamic analysis of a virtual machine includes initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment; monitoring activities of the malware sample during execution of the malware sample in the virtual computing environment; and determining when to exit the dynamic analysis before a predetermined period of time.
1 . A system, comprising:
a processor configured to:
initiate a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment for a predetermined period of time;
monitor activities of the malware sample including launching a new process during the executing of the malware sample in the virtual computing environment, wherein the monitoring of the activities of the malware sample during execution of the malware sample in the virtual computing environment includes one or more of the following: writing, copying, or moving a file; changing a registry setting; modifying a system service; and scheduling a task; and
determine when to exit the dynamic analysis before the predetermined period of time based on the monitoring of the activities of the malware sample during the executing of the malware sample in the virtual computing environment to determine that using all of the predetermined period of time for the dynamic analysis is not required to determine that the malware sample is malicious or benign based on one or more of the following:
(1) the malware sample cannot be executed in the virtual computing environment;
(2) the malware sample requires an external dependency that is not available in the virtual computing environment;
(3) the malware sample is associated with an unsupported file sub-type; and/or
(4) an analysis of the new process of the malware sample has been completed; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system recited in claim 1 , wherein the virtual computing environment comprises a virtual machine instance.
3 . The system recited in claim 1 , wherein an early exit from the dynamic analysis before the predetermined period of time is performed based on a termination of a main process associated with executing the malware sample in the virtual computing environment.
4 . The system recited in claim 1 , wherein an output of the monitored activities of the malware sample during execution of the malware sample in the virtual computing environment is automatically analyzed to determine whether the malware sample is malicious or benign.
5 . The system recited in claim 1 , wherein the processor is further configured to:
monitor memory during execution of the malware sample in the virtual computing environment.
6 . The system recited in claim 1 , wherein the processor is further configured to:
perform an early exit of the dynamic analysis of the malware sample before the predetermined period of time based on monitoring of the malware sample during execution in the virtual computing environment.
7 . The system recited in claim 1 , wherein the processor is further configured to:
perform an early exit of the dynamic analysis of the malware sample before the predetermined period of time based on monitoring of the malware sample during execution in the virtual computing environment to determine that the malware sample has completed execution and no further dynamic analysis is to be performed to determine whether the malware sample is malicious or benign.
8 . The system recited in claim 1 , wherein the processor is further configured to:
perform an early exit of the dynamic analysis of the malware sample before the predetermined period of time based on monitoring of the malware sample during execution in the virtual computing environment; and
determine that the malware sample is benign.
9 . The system recited in claim 1 , wherein the processor is further configured to:
perform an early exit of the dynamic analysis of the malware sample before the predetermined period of time based on monitoring of the malware sample during execution in the virtual computing environment; and
determine that the malware sample is malicious.
10 . A method, comprising:
initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment for a predetermined period of time;
monitoring activities of the malware sample including launching a new process during the executing of the malware sample in the virtual computing environment, wherein the monitoring of the activities of the malware sample during execution of the malware sample in the virtual computing environment includes one or more of the following: writing, copying, or moving a file; changing a registry setting; modifying a system service; and scheduling a task; and
determining when to exit the dynamic analysis before the predetermined period of time based on the monitoring of the activities of the malware sample during the executing of the malware sample in the virtual computing environment to determine that using all of the predetermined period of time for the dynamic analysis is not required to determine that the malware sample is malicious or benign based on one or more of the following:
(1) the malware sample cannot be executed in the virtual computing environment;
(2) the malware sample requires an external dependency that is not available in the virtual computing environment;
(3) the malware sample is associated with an unsupported file sub-type; and/or
(4) an analysis of the new process of the malware sample has been completed.
11 . The method of claim 10 , wherein the virtual computing environment comprises a virtual machine instance.
12 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment for a predetermined period of time;
monitoring activities of the malware sample including launching a new process during the executing of the malware sample in the virtual computing environment, wherein the monitoring of the activities of the malware sample during execution of the malware sample in the virtual computing environment includes one or more of the following: writing, copying, or moving a file; changing a registry setting; modifying a system service; and scheduling a task; and
determining when to exit the dynamic analysis before the predetermined period of time based on the monitoring of the activities of the malware sample during the executing of the malware sample in the virtual computing environment to determine that using all of the predetermined period of time for the dynamic analysis is not required to determine that the malware sample is malicious or benign based on one or more of the following:
(1) the malware sample cannot be executed in the virtual computing environment;
(2) the malware sample requires an external dependency that is not available in the virtual computing environment;
(3) the malware sample is associated with an unsupported file sub-type; and/or
(4) an analysis of the new process of the malware sample has been completed.
13 . The computer program product recited in claim 12 , wherein the virtual computing environment comprises a virtual machine instance.