Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time execution behavior, interact with malware prompts such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system changes. Use when a suspicious file or URL needs live, interactive behavioral detonation in a cloud sandbox rather than static analysis alone.
Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time execution behavior, interact with malware prompts such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system changes. Use when a suspicious file or URL needs live, interactive behavioral detonation in a cloud sandbox rather than static analysis alone.
Use the interactive session to trigger malware behavior:
Interactive Actions During Analysis:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Document Macros: Click "Enable Content" / "Enable Editing" when prompted
2. Installer Screens: Click through installation dialogs
3. UAC Prompts: Click "Yes" to allow elevation (observe privilege escalation)
4. Credential Harvests: Enter fake credentials to observe phishing behavior
5. Browser Redirects: Navigate to URLs if malware opens browser windows
6. File Dialogs: Select target files if malware presents file picker
7. Timeout Extension: Extend analysis time if malware has delayed execution
Step 3: Analyze Process Tree
Review the complete process execution chain:
Process Tree Analysis Points:
━━━━━━━━━━━━━━━━━━━━━━━━━━━
Parent-Child Relationships:
- WINWORD.EXE -> cmd.exe -> powershell.exe (macro execution chain)
- explorer.exe -> suspect.exe -> svchost.exe (process injection)
Process Events to Note:
- Process creation with suspicious command-line arguments
- PowerShell with encoded commands (-enc / -encodedcommand)
- cmd.exe executing script files (.bat, .vbs, .js)
- Legitimate processes spawned from unusual parents
- Process termination (self-deletion behavior)
Step 4: Review Network Activity
Examine DNS, HTTP/HTTPS, and TCP/UDP connections:
ANY.RUN Network Panel Analysis:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DNS Requests:
- Domain resolutions with threat intelligence tags
- Fast-flux or DGA domain patterns
- DNS over HTTPS (DoH) detection
HTTP/HTTPS Traffic (with MITM enabled):
- Full request/response bodies for HTTP
- Decrypted HTTPS traffic showing C2 commands
- Downloaded payloads and their content types
- POST data containing exfiltrated information
Connection Map:
- Geographic visualization of C2 server locations
- Connection timeline showing beacon patterns
- Suricata alerts triggered on network traffic
Step 5: Examine IOCs and Threat Intelligence
Extract indicators and map to known threats:
ANY.RUN IOC Categories:
━━━━━━━━━━━━━━━━━━━━━━
Files: Dropped files with hashes, YARA matches, VirusTotal results
Network: IPs, domains, URLs contacted during execution
Registry: Keys created/modified for persistence
Processes: Suspicious process names and command lines
Mutex: Named mutexes created (used for single-instance checking)
Signatures: Suricata rules triggered, behavioral signatures matched
MITRE ATT&CK Mapping:
- ANY.RUN automatically maps observed behaviors to ATT&CK techniques
- Review the ATT&CK matrix tab for technique coverage
- Export ATT&CK Navigator layer for reporting
Step 6: Export Analysis Results
Download comprehensive reports and artifacts:
# Download report via API
curl "https://api.any.run/v1/analysis/$TASK_ID/report" \
-H "Authorization: API-Key $ANYRUN_API_KEY" \
-o report.json
# Download PCAP
curl "https://api.any.run/v1/analysis/$TASK_ID/pcap" \
-H "Authorization: API-Key $ANYRUN_API_KEY" \
-o capture.pcap
# Download dropped files
curl "https://api.any.run/v1/analysis/$TASK_ID/files" \
-H "Authorization: API-Key $ANYRUN_API_KEY" \
-o dropped_files.zip
# Available exports from ANY.RUN web interface:# - HTML Report (shareable standalone page)# - PCAP file (network traffic capture)# - Process dump (memory dumps of processes)# - Dropped files (all files created during execution)# - MITRE ATT&CK Navigator JSON# - IOC export (STIX/JSON/CSV format)
Key Concepts
Term
Definition
Interactive Sandbox
Analysis environment allowing real-time analyst interaction with the executing sample, enabling triggering of user-dependent behaviors
MITM Proxy
Man-in-the-middle TLS interception in ANY.RUN that decrypts HTTPS traffic for visibility into encrypted C2 communications
Residential Proxy
ANY.RUN feature routing malware traffic through residential IP addresses to bypass geo-IP and datacenter-IP evasion checks
Suricata Alerts
Network IDS signatures triggered during execution, providing immediate identification of known malicious traffic patterns
Process Tree
Hierarchical visualization of parent-child process relationships showing the complete execution chain from initial sample to final payloads
Behavioral Tags
ANY.RUN classification labels automatically applied based on observed behavior (e.g., "trojan", "stealer", "ransomware")
Tools & Systems
ANY.RUN: Cloud-based interactive malware sandbox providing real-time execution monitoring, process trees, network capture, and MITRE ATT&CK mapping
ANY.RUN API: REST API for programmatic sample submission, status checking, and report/artifact retrieval
Suricata: Integrated network IDS within ANY.RUN providing signature-based detection of malicious network traffic
MITRE ATT&CK Navigator: Framework integration mapping observed malware behaviors to adversary techniques and tactics
VirusTotal Integration: Automatic hash lookup of sample and dropped files against VirusTotal detection results
Common Scenarios
Scenario: Analyzing a Macro-Enabled Document Requiring User Interaction
Context: Phishing email contains a .docm file that requires clicking "Enable Content" to trigger the macro payload. Traditional non-interactive sandboxes fail to trigger the malicious behavior.
Approach:
Upload .docm to ANY.RUN with Windows 10 environment and Microsoft Office installed
When Word opens and displays the security banner, click "Enable Content" interactively
Observe the macro execution in the process tree (Word -> cmd.exe -> powershell.exe)
Monitor network panel for PowerShell downloading second-stage payload
If a UAC prompt appears, click "Yes" to allow the payload to observe full behavior chain
Review Suricata alerts for known malware signatures on the downloaded payload
