Analysis File Activities

The Analysis subject sections display the actual activity of the sample, as collected by the NSX Advanced Threat Prevention service.

The sections include the original subject being analyzed and additional subjects tracked by the analysis environment because they were either spawned by the original subject or because the original subject tampered with their memory.

Note: Not all of these activities are present for a specific sample.

Click the icon to expand each of the following sections.

Section Name	Description
Console I/O	Data written to console handles (standard input and standard output file descriptors).
Decoded command line arguments	The arguments to malicious PowerShell scripts are often encoded or obfuscated. If a script was executed during the analysis, the VMware backend decodes it, making its arguments available in a more human-readable form.
Device I/O	Device I/O List of I/O operations attempted by the subject during runtime. For each operation, the targeted device and the control code are recorded.
Driver activity	List of drivers accessed by the subject during runtime. The following operations are recorded: loading and unloading.
Exceptions	List of scripts executed by the subject during runtime. For each row, there is an entry for the Name, TYPE, and INTERPRETER. You can sort the list by any column.
Executed scripts	List of scripts executed by the subject during runtime. For each row, there is an entry for the Name, TYPE, and INTERPRETER. You can sort the list by any column.
File system activity	List of files accessed by the subject during runtime. The following operations are recorded: reading, writing, renaming, deletion. For written files, the new size and MD5 hash of the file is recorded.
Libraries	List of library files loaded by the subject during runtime.
Memory contents	Noteworthy data found in program memory. The system extracts, for example, IPs, domains, and URLs during analysis.
Mutex activity	List of mutex locks accessed by the subject during runtime. The following operations are recorded: creation and opening.
Network activity	List of network conversations involving the subject during runtime. The following type of conversations are recorded: communications over FTP, HTTP, IRC, SMTP, and other types of UDP/TCP protocols. DNS requests and remote file downloads are also recorded.
Process interactions	List of process interactions attempted by the subject during runtime. The following operations are recorded: process creation, thread creation, memory reading and writing.
Registry activity	List of registry keys and values accessed by the subject during runtime. The following operations are recorded: reading, writing, deletion and monitoring.
Service activity	List of services accessed by the subject during runtime. The following operations are recorded: starting, stopping, modifying parameters.
Windows activity	List of windows opened by the subject during runtime.