Dynamic analysis of these types of exploits can be performed in two stages:
- High-level: At this stage, it is required to reproduce and this way confirm the malicious behavior. Usually, it involves the following steps:
- Figure out the actual exploit payload: Generally, this part can be done during the static analysis stage. Otherwise, it is possible to set up various behavioral analysis tools (filesystem, registry, process, and network monitors) and search for suspicious entries once the exploit is supposed to trigger during the next step.
- Identify the product version(s) vulnerable to it: If the vulnerability has been publicly disclosed, in most cases, it contains confirmed versions of targeted products. Otherwise, it is possible to install multiple versions of it in separate VM snapshots in order to find at least one that allows you to reliably reproduce the exploit triggering.
- Low-level: In many cases, this stage is not required as we already know what the exploit...
