Original Goal
My original learning goal for learning malware analysis was "ability to analyze an unknown application and determine if its malicious or legitimate". After starting to learn about malware analysis and get more information about the subject, my goals started to change.
To understand why I change the scope of my learning project, I will give you guys some context: For me, as an SOC analyst, I need to investigate the alert, determine whether it's an false positive or true positive. Once, there's indication that an compromise happen, the next thing is to determine the scope of the compromise which leads to identifying the IOCs. These IOCs can be an IP address, infected files, malicious service or process, etc.. and use those IOCs to determine what devices are infected which leads to quarantine the device. After that, it's also making sure that there no persistence installed installed. Once, that done, it's providing the report to the client and then call them. Through that whole process, there no time to load up IDA to analyze the malware and analyzing one sample can take a long time.
New Goal
Therefore, if I'm going to approach malware analysis, I think the best thing for me to focus on basic static analysis and basic dynamic analysis which helps grab IOCs for the live incident because that will give me the most bang for my bucks for my time and knowledge that I can leverage to investigate an incident.
