Malware INFOLocal-first Windows incident analysis
Malware INFO Investigation Flow
A technical map of Malware INFO workspaces, tabs, evidence outputs, and verified handoffs. It shows available paths and truth boundaries—not a promise that every case requires every stage.
THREE STARTING POINTS
Not every incident needs every stage. The analyst selects the smallest safe path supported by identity, authorization, edition, target eligibility, and available evidence.
FILE INTAKE
Preserve the original path, filename, size, acquisition context, and computed SHA-256 before analysis. Do not execute an unknown file on an everyday endpoint.
Threat Lookup → Scan Studio → controlled analysis only when authorized
DLL INTAKE
Preserve exact file identity and architecture first. Use static triage before any matching-bitness DLL Behavior Trace in an authorized controlled host.
Threat Lookup → Scan Studio → DLL Behavior Trace when eligible
LIVE INCIDENT
Begin with compound process and file identity, Guard freshness, provider coverage, and current endpoint observations. Missing telemetry is not benign evidence.
Protection Matrix → timeline and exact-subject evidence → analyst scope
TECHNICAL PATH
Follow the numbered sequence when the case requires it. Branch, stop, or return to a previous phase whenever evidence, safety, or authorization demands it.
INTAKE
Command Center · Threat Lookup
Compute and preserve exact subject identity. Reputation and analyst notes are context; a lookup result does not create execution proof or response authority.
OUTPUT · exact artifact/subject identity, lookup evidence, analyst-provided scope
STATIC TRIAGE
Scan Studio · Detection Library
Review hashes, structure, imports, strings, signatures, HEX/YARA evidence, packing indicators, reputation, and mappings. Static evidence is not observed runtime behavior.
OUTPUT · bounded local reports, evidence references, gaps, analyst next steps
LIVE EVIDENCE
Live Protection · Protection Matrix
Correlate only within proven identity and collection coverage. Keep Exact, Partial, Unavailable, Degraded, Unsupported, and Unknown states visible; time proximity alone is not causality.
OUTPUT · coverage-aware process, file, registry, network, and timeline observations
CONTROLLED RUNTIME
Automated Unpacker · Advanced Analysis
Consent-gated and appropriate only when live execution or attachment is authorized and necessary in a controlled environment. API Hook Trace follows the current Release History status and remains evidence-bound with no automatic containment.
OUTPUT · session-bound runtime evidence, coverage, diagnostics, and verified export candidates
MEMORY / PAYLOAD
Process Memory Capture · Payload & Memory Analyzer
Recovered bytes are evidence and are never executed automatically. Offline Memory Forensics remains a validation-gated in-development area, separate from current selected-process capture.
OUTPUT · verified memory/payload evidence, provenance, partial ranges, gaps, or unsupported state
CORRELATE
Final Report to CISO
Read analyst-selected packages on demand, verify manifests and SHA-256, normalize eligible evidence, preserve contradictions, and keep identity relation separate from time proximity.
OUTPUT · evidence-linked executive narrative and traceable appendix
STRUCTURED HANDOFF MAP
Eligibility is package-specific. A neighboring ZIP, a familiar filename, or a useful analyst artifact does not bypass manifest, hash, schema, identity, provenance, or policy verification.
ELIGIBLE WHEN VERIFIED
An eligible versioned API Trace handoff is admitted only after package, manifest, source identity, schema, and file hashes verify.
ELIGIBLE WHEN VERIFIED
May enter the current intake only when its verified package contract passes. Website presentation does not grant automatic containment authority.
ELIGIBLE WITH TRACE PROVENANCE
Admitted only when the Analyzer bundle retains verified Deep/API Hook trace provenance and all required relationships verify.
OMITTED BY POLICY
Kept visible as useful evidence but omitted by policy from current Final CISO machine-evidence admission; it is not mislabeled as corrupt.
CONTEXT / EMBEDDED SOURCE
Separate Guard CSV files are not advertised as default machine-correlation inputs. Analyst notes remain clearly analyst-provided context.
ADMISSION + CORRELATION GATE
Final CISO reads an analyst-selected source folder on demand, isolates bad neighbors, records each package outcome, and never upgrades unsupported or missing evidence to success.
FINAL OUTPUT
Final Report to CISO is a reporting and correlation workspace—not a scanner, automatic verdict engine, or response authority.
SUPPORTING LANES
These workspaces remain part of the complete product journey without being misrepresented as direct Final CISO machine-evidence producers.
Enrich scope and analyst decisions. External or contextual intelligence does not become observed endpoint behavior by presentation alone.
Retain, review, and request authorized response. Privileged mutation remains Guard-owned, identity-checked, and authorization-gated.
Transport normalized evidence or authorized requests. Delivery success is not analyst review, containment success, or detection correctness.
Manage rules, access, updates, and guidance. These workspaces support the investigation but do not independently manufacture stronger evidence.
PERMANENT BOUNDARIES
A string, import, rule match, mapping, reputation result, score, or one finding does not by itself prove malware.
Missing, stale, partial, degraded, unsupported, and unknown collection states remain visible; an empty result is not proof of complete clean coverage.
PID, path, or time proximity alone is insufficient. Correlation preserves exact subject identity, observation intervals, provenance, and contradictions.
Final Report to CISO explains admitted evidence. It does not quarantine, terminate, block, upload evidence, or create automatic containment authority.