detonaRE

Capture. Detonate. Collect.

From Latin - "to detonate"

Functions:

• initiates .etl packet capture
• initiates Process Monitor with a filter applied for the malware to be detonated
• launches malware sample
• terminates packet capture after specified interval
• initiates evidence collection with Magnet RESPONSE (memory, process, and triage capture)
• terminates the malware process
• converts collected .etl file to .pcap with etl2pcapng.
• converts collected .pml to .csv

Prerequisites:

• Magnet RESPONSE
• etl2pcapng.exe
• procmon.exe

## variable configuration:
$malwspath = "E:" ## malware source path
$malwdpath = "C:\Users\REM\Desktop\Malware\" ## malware destination path on target host
$malware = "malware.exe" ## malware executable
$pcaptime = 180 ## duration in seconds for pcap capture
$toolsdir = "E:\Tools" # tools directory
$collectiondir = "E:\Collections" ## output directory for collections
$procmonconfig = "$toolsdir\malw.pmc" ## Process Monitor configuration file
##