427 Botnet fm qxd

Q: 
Where can I get a copy of CWSandbox?
A:
A free research version as well as a commercial one can be retrieved from
Sunbelt. Please use the online form at www.sunbelt-
software.com/Sunbelt-CWSandbox-Request-Info.cfm.
Q: 
Can I get the source code of CWSandbox?
A: 
No, the source code is not available, neither for researchers nor for com-
mercial customers.
Q: 
How long does it take to perform an analysis with CWSandbox?
A: 
Normally the analysis runs for a customizable amount of minutes, which
can be configured in the settings file. On our live sandboxes we use
timeout values of 2 or 3 minutes. Under certain circumstances, the analysis
stops before that time, such as if all monitored processes have terminated
prematurely.
Notes
1. “Norman SandBox Whitepaper;” available at http://sandbox.norman.no/pdf/03-
sandbox%20whitepaper.pdf.
2. Mark Russinovich and Bryce Cogswell, “AutoRuns for Windows v8.54,” Microsoft TechNet;
available at www.microsoft.com/technet/sysinternals/SystemInformation/Autoruns.mspx.
3. Mark Russinovich and Bryce Cogswell, “FileMon for Windows v7.04,” Microsoft TechNet;
available at www.microsoft.com/technet/sysinternals/FileAndDisk/Filemon.mspx.
4. RegMon monitors registry accesses in real time. For more information see “RegMon for
Windows v7.04”; available at www.microsoft.com/technet/sysinternals/utilities/regmon.mspx.
www.syngress.com
390
Chapter 10 • Using Sandbox Tools for Botnets
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented in this chapter and to assist you with real-life implementation of these
concepts. To have your questions about this chapter answered by the author,
browse to