Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1098221" data-attributes="member: 99014">At one point I saw him selecting about 10 files and executing them at once, but before that, it was already processing and displaying alerts. ZoneAlarm has very slow and very thorough processing and generates a full forensics report that for every malware includes what was the damage, network connections, which country the servers are in, mitre ATT&amp;CK matrix, what was remediated, VT lookups, etc. All this takes time and resources. In a real world scenario, all this malware will not be executed.As to real vs virtual machine, yes. It does make difference as malware could detect the VM and refuse to deliver its real behaviour.Yes, first of all, all these files were not emulated. One of the ZoneAlarm powers is the real time emulation that sends to the sandbox. I don&#039;t even think that emulation will accept that many malware files, from his whole pack. Second, I saw anti-bot (extension to behavioural blocking) and other alerts already popping up. An alert from ZoneAlarm appears only once the infection is fully dealt with and the full forensics report is generated, not any earlier than that.He should have just let ZoneAlarm deal with all that, after which, it would have asked for a restart. Then, he should have restarted the VM if he wants this blocker malware to go away.[ATTACH=full]285005[/ATTACH]</blockquote>

[QUOTE="Trident, post: 1098221, member: 99014"] At one point I saw him selecting about 10 files and executing them at once, but before that, it was already processing and displaying alerts. ZoneAlarm has very slow and very thorough processing and generates a full forensics report that for every malware includes what was the damage, network connections, which country the servers are in, mitre ATT&CK matrix, what was remediated, VT lookups, etc. All this takes time and resources. In a real world scenario, all this malware will not be executed. As to real vs virtual machine, yes. It does make difference as malware could detect the VM and refuse to deliver its real behaviour. Yes, first of all, all these files were not emulated. One of the ZoneAlarm powers is the real time emulation that sends to the sandbox. I don't even think that emulation will accept that many malware files, from his whole pack. Second, I saw anti-bot (extension to behavioural blocking) and other alerts already popping up. An alert from ZoneAlarm appears only once the infection is fully dealt with and the full forensics report is generated, not any earlier than that. He should have just let ZoneAlarm deal with all that, after which, it would have asked for a restart. Then, he should have restarted the VM if he wants this blocker malware to go away. [ATTACH type="full" width="188px" alt="1724082710154.png"]285005[/ATTACH] [/QUOTE]

Verification