An Experimental Evaluation on Proposing a Methodology for Assessment of Packing in DFIR of Ransomware Binaries

When investigating ransomware incidents, DFIR (Digital Forensics and Incident Response) personnel and law enforcement agents are often tasked with performing Forensic Analysis and Reverse Engineering of malware to understand, evaluate and assess key features of the malicious executable to be able to establish authorship and materiality of the cyber-attack. In this light, there is often the challenge of dealing with packing of executable files, a feature that malware authors employ to hide malicious features, to avoid detection or to hinder reverse engineering. Although there are many options for malware analysts to deal with this issue, such as online sandbox services and platforms designed for automated, large-scale malware analysis of binaries, they might not be the suitable for DFIR personnel and law enforcement actors entrusted with the investigation of cyber incidents, because, amongst other factors, they might entail the submission of a live sample to a external website or platform, leading to a breach in the chain of custody and confidentiality. They may not output pertinent information of forensic value, act as black boxes, or they may not accurately or sufficiently replicate the environment or IT ecosystem present in each incident. They are often paid-for services or with often limited or inflexible resources and time constraints for free analysis options. Given this, we discuss some of the peculiarities of assessing the packing aspect of malware in the context of ransomware incidents, while carrying out an experimental evaluation of a methodology for assessing that feature in ransomware binaries. The main goal of this assessment is to determine whether a given ransomware sample unpacks itself and how, while also providing the analyst valuable insights about key characteristics of its unpacking process. The proposed methodology combines static and dynamic analysis indicators, in a dynamic multi-pass approach for increased robustness, while also adopting previously established metrics for measuring unpacking found in previous, generic malware research.