stage-4-dynamic

name

stage-4-dynamic

description

Detonate the sample in CAPE's instrumented Windows VM and retrieve the behavioral report — file/registry events, network callbacks, process injection chains, dropped payloads, API trace, screenshots, timeline. Use this skill whenever static analysis alone isn't enough and you need to see what the sample actually does at runtime — C2 callbacks, persistence mechanisms, dropped payloads, injection targets. Run after Stage 3 unless Stage 2 short-circuited, and skip if Stage 3 conclusively proved the sample is benign (all YARA clean, valid Microsoft Authenticode signature). Pre-M4 deployments where the Windows qcow2 isn't wired into CAPE yet: this will fail with a note, which is expected.

Stage 4 — Dynamic sandbox (CAPE)

Submits the sample to CAPE running on its isolated EC2 host. CAPE executes the sample in a Windows VM on the sandbox network (no internet — INetSim simulates callbacks) and returns a structured behavioral report.

Inputs

Var	Source	Shape
SAMPLE_S3_URI	Stage 1	S3 pointer
CYBER_CAPE_ALB	env	https://internal-adp-dev-cyber-alb-....elb.amazonaws.com
CYBER_CAPE_TOKEN_SECRET	env	adp/cape/api-token in Secrets Manager
CYBER_STAGE4_TIMEOUT_SECONDS	env	default 1800 (30 min)

Outputs

{
  "stage": 4,
  "stage_name" 
   
     
      
       
     
       ...
       ...
         
    
     
       ...
       ...
       ...
    
        ...
        
       
     
     
     ...