Rapid deployment of Windows environment (files, registry keys, mutex etc) to facilitate malware analysis
This program rapidly sets up a malware analysis environment based on configuration file specified by the user. Configuration file can contain the following lines:
To create a file: file:path=content (content is optional)
To create a registry key: registry:key=value|data (value|data is optional)
To launch a process with specific name: process:process name
To create a mutex: mutex:mutex name
Lines beginning with # are ignored as comments
Example config file:
file:C:\Users\User\Documents\test.txt=This is the content of the file
file:C:\Users\User\Documents\test.txt
Notice the registry entry needs to start with HKEY_CURRENT_USER, this can be any other hive but full name is required
registry:HKEY_CURRENT_USER\SOFTWARE\Test=password|john
mutex:thisisabadmutex
process:calc.exe