Malware’s Conspiracy at a Glance! 🕸️ Visualizing the ‘Link’ Between Registry and File Behavior (with AI)

Jul 14, 2026

—

*This posting is part of Coupang Partners activity and receives a certain amount of commission.

Hello, security analysts who see the big picture! 🕵️‍♂️

Last time, we used AI to meticulously pick out only ‘Anomalies’ from tens of thousands of lines of log data.

“Oh? An unusual file (payload.exe) was secretly created?”
“Oh? Something was registered in the Registry Startup Programs (Run Key)?”

But for now, these incidents exist only as ‘Dots’. Only by connecting these dots with ‘Lines’ can the malware’s overall operational map (Big Picture) finally be seen.

We need to understand the causality: “Because this file was created -> it was registered in the registry.”

Today, we will conduct a visualization practice where we give text logs to AI and ask it to “draw a diagram that easily shows the flow of events!” The complex event relationship diagram will be visible at a glance, like a detective’s investigation board! 📊✨

1. 🧶 Why do we need to look at ‘relationships’?

Malware does not act alone. It performs elaborate linked operations. The most representative pattern is securing ‘Persistence’.

File Creation (Dropper): malware.exe runs and spawns C:Tempbackdoor.exe. (Cause)
Registry Registration (Registration): malware.exe registers backdoor.exe in the registry to run every time Windows starts. (Effect)

If these two logs are seen separately, they might not seem dangerous, but connecting them reveals a clear malicious intent.

2. 📝 [Preparation] Refined Core Logs

Prepare the core log data that was filtered in the previous practice.

[Input Data Example]

Plaintext

1. [Process Create] Parent: downloader.exe (PID: 1234) -> Child: cmd.exe (PID: 5678)
2. [File Create] Process: cmd.exe -> Path: C:UsersPublicupdate.vbs
3. [RegSetValue] Process: cmd.exe -> Key: HKCU...RunWinUpdate -> Data: wscript.exe C:UsersPublicupdate.vbs
4. [Network Connect] Process: wscript.exe -> Dest: 192.168.10.5:4444

Looking at text alone can be a headache, right? 😵‍💫 Let’s visualize this.

3. 🎨 [Practice] Asking AI to draw a “Mermaid Diagram”

We won’t open Paint. If we ask AI to write code using ‘Mermaid.js’ syntax, a very clean flowchart will be automatically generated.

🗣️ Visualization Request Prompt

[Role] You are a cybercrime investigator and a data visualization expert.

[Task] Analyze the malware behavior logs provided below and create a flowchart that shows the causal relationships of the events.

[Requirements]

1. Format: Please write in Mermaid.js code format. (Left-to-right (LR) direction)

2. Structure:

– Process is represented by [square brackets]

– File is represented by (parentheses)

– Registry is represented by {{hexagons}}

– Network is represented by ((circles))

3. Relationship Expression: Label the arrows with the type of action (Drop, Execute, Connect, etc.).

4. Emphasis: Apply styles to clearly highlight the core flow of malicious activity.

[Log Data] (Paste the Input Data Example above)

4. 🖼️ [Result] The Magic of Text Turning into a Picture

AI generates the following Mermaid code.

🤖 AI-generated code (Example)

Code Snippet

graph LR
    P1[downloader.exe] -- Spawns --> P2[cmd.exe]
    P2 -- Drops --> F1(update.vbs)
    P2 -- Registers Persistence --> R1{{HKCU Run Key}}
    R1 -. Points to .-> F1
    F1 -- Executed by --> P3[wscript.exe]
    P3 -- C2 Connect --> N1((192.168.10.5))

    style P1 fill:#f9f,stroke:#333,stroke-width:2px
    style R1 fill:#ff9,stroke:#f66,stroke-width:2px
    style N1 fill:#9cf,stroke:#333,stroke-width:2px

If you paste this code into Mermaid Live Editor (website), Notion, GitHub, etc., a wonderful diagram like the one below will appear!

🔍 Diagram Interpretation:

downloader.exe is the starting point (Patient Zero)!
cmd.exe acted as a minion in the middle.
Ultimately, it planted a file called update.vbs and embedded it in the registry to run permanently.
The final destination was to connect to the 192.168.10.5 server!

Much more intuitive than looking at text, right? 😎

5. 💡 Tip: The Powerful Advantages of Diagramming

There’s a world of difference between a report full of text and one that includes such a diagram.

Easy to persuade non-experts: Best for explaining to executives or non-technical staff, “This guy came in like this and connected like that.”
Identify Kill Chain: Since the stages of an attack (Infection -> Installation -> Command and Control) are visible at a glance, it’s easy to identify which link needs to be broken for defense.
Check for missing information: If there’s a broken link after drawing the diagram? You can find additional analysis points, like “Who executed this file?”

🎉 Conclusion: All the dots are connected!

Congratulations! 👏 You have now reconstructed complex log data into a complete crime scenario. You have evolved from a simple ‘log analyst’ to a ‘cyber investigator’ who sees the whole picture of an incident.

Now, we have:

Analyzed the code (static)
Captured behavior (dynamic)
Filtered out only the important parts (filtering)
And even drawn an event relationship diagram (visualization).

Only one thing remains! To organize all these processes and create the final deliverable (report). See you next time for the grand finale practice, “Automated Generation of Expert-Level Malware Analysis Reports.”

Until the day your analysis becomes art, fighting! 🎨🖌️