Sysinternals Malware Analysis Demonstration

Author: Ian Bickford
Language: Python
Platform: Microsoft Windows
Purpose: Educational malware behavior analysis

Educational Purpose and Responsible Use Disclaimer:

This repository is provided strictly for educational, cybersecurity training, and research purposes. The script is intentionally designed to remain benign and limited in functionality. It demonstrates behavioral indicators associated with malicious software without implementing functional malicious payloads, data exfiltration, or remote command execution. I do not authorize, endorse, encourage, or condone modifying, adapting, or redistributing this script in a manner that introduces malicious functionality or changes its intended benign nature. The intentionally limited nature of this project is deliberate. It is designed to provide meaningful educational exposure to malware analysis without becoming another tool for script kiddies to repurpose or misuse. The objective is to teach individuals how to recognize, investigate, and understand suspicious system behavior, not how to develop or distribute malicious software. This repository should not be interpreted as authorization to access, modify, monitor, or interfere with systems without appropriate permission. The author assumes no responsibility for unauthorized modifications, redistribution, or misuse of altered versions of this project. Preserve the educational intent. Do not weaponize the code.

Overview:

This repository contains a Python-based educational demonstration designed to illustrate several behavioral indicators commonly associated with malicious software on Microsoft Windows systems. The project demonstrates how otherwise benign program functionality can exhibit characteristics that security analysts commonly investigate during malware analysis and incident response. Rather than implementing an actual malicious payload, the script performs controlled, limited actions that allow students and cybersecurity professionals to observe suspicious behavioral indicators using Microsoft's Sysinternals utilities and other Windows monitoring tools. The primary objective is to provide practical exposure to behavioral analysis, endpoint monitoring, and host-based security investigation without distributing functional malware.

MITRE ATT&CK Framework Alignment:

This project was developed from scratch with the MITRE ATT&CK Framework serving as a reference for identifying and understanding behavioral techniques commonly associated with adversarial activity. MITRE ATT&CK was used to help guide the selection of behaviors demonstrated throughout the script, providing a structured approach to understanding how suspicious activity manifests within Windows environments. The development process focused on translating selected adversarial behavior concepts into intentionally benign demonstrations that could be observed, investigated, and analyzed using Windows monitoring utilities. This approach provided practical exposure to:

• Researching adversarial techniques and their associated behaviors.
• Mapping observable system activity to MITRE ATT&CK concepts.
• Understanding how individual behaviors contribute to broader attack patterns.
• Developing a controlled demonstration from the ground up.
• Applying threat-informed defensive analysis to endpoint activity.

The objective was not to reproduce an operational attack or implement functional malware, but to use the MITRE ATT&CK knowledge base as a foundation for developing a practical defensive security learning exercise.

Learning Objectives

This project is intended to provide practical experience with:

• Identifying suspicious file-system activity.
• Recognizing timestamp manipulation.
• Understanding Windows Registry persistence mechanisms.
• Observing parent-child process relationships.
• Identifying dynamic-link library (DLL) loading.
• Monitoring outbound TCP connections.
• Correlating endpoint activity with security monitoring tools.
• Understanding how seemingly ordinary Windows functionality can resemble malicious behavior.

Demonstrated Behaviors:

The Python script demonstrates six behavioral categories commonly examined during malware investigations.

Behavior	Demonstration
File System Activity	Creates and modifies a temporary file in the user's %APPDATA% directory.
File Attribute Manipulation	Changes the visibility attribute of the created file.
Timestamp Modification	Alters the file's timestamps to demonstrate time stomping.
Registry Modification	Creates a current-user Run registry entry.
Process Creation	Launches hidden child processes to demonstrate process relationships.
DLL Loading	Dynamically loads the legitimate Windows kernel32.dll library.
Network Activity	Attempts an outbound TCP connection to google.com over port 443.

Additionally, the program displays a simulated application error message to demonstrate how an application can present an ordinary user-facing interface while other activity occurs in the background.

Important: These demonstrations involve actual Windows system operations. The project is benign in its intended functionality, but it is not entirely passive. Its file, registry, process, and network operations should be observed in an isolated testing environment.

Repository Contents

File	Description
Roblox.py	Python source code containing the educational behavior demonstrations.
Roblox.exe	Compiled executable version of the demonstration.

For transparency and code review, the Python source is the recommended version to examine and execute. The compiled executable is provided as an additional repository artifact. Its build provenance and equivalence to the published Python source have not been independently established.