performing-dynamic-analysis-with-any-run

使用 ANY.RUN 执行动态分析

何时使用

• 需要交互式恶意软件分析，分析师必须点击对话框、输入凭据或浏览安装程序界面
• 无需维护本地沙箱基础设施，即可快速进行基于云的沙箱分析
• 恶意软件需要用户交互才能通过反沙箱检查（如需要点击“启用内容”的文档宏）
• 通过公开或私有任务 URL 与团队成员共享分析结果
• 对比 ANY.RUN 中不同操作系统版本（Windows 7、10、11）的行为

不要使用于无法上传到云服务的高度敏感样本；请改用 Cuckoo 等本地部署沙箱。

前置条件

• ANY.RUN 账户（免费社区版或付费订阅，访问 https://any.run）
• 支持 WebSocket 的现代 Web 浏览器，用于交互式会话流
• 准备上传的样本文件（免费版最大 100 MB，付费版 256 MB）
• 了解样本类型，以选择适当的执行环境
• 在分析会话期间访问 ANY.RUN 门户所需的 VPN 或安全网络

工作流

步骤 1：配置分析环境

使用适当参数设置 ANY.RUN 任务：

ANY.RUN Task Configuration:
━━━━━━━━━━━━━━━━━━━━━━━━━━
OS Selection:        Windows 10 x64 (recommended default)
                     Windows 7 x64 (for legacy malware)
                     Windows 11 x64 (for modern samples)
Execution Time:      60 seconds (default) / 120-300 for slow-acting malware
Network:             Connected (captures real C2 traffic)
                     Residential Proxy (bypasses geo-blocking)
Privacy:             Public (free tier) / Private (paid - not indexed)
MITM Proxy:          Enable for HTTPS traffic decryption
Fake Net:            Enable to simulate internet services if sample checks connectivity

基于 API 的提交（付费版）：

# Submit file via ANY.RUN API
curl -X POST "https://api.any.run/v1/analysis" \
  -H "Authorization: API-Key $ANYRUN_API_KEY" \
  -F "[email protected]" \
  -F "env_os=windows" \
  -F "env_version=10" \
  -F "env_bitness=64" \
  -F "opt_timeout=120" \
  -F "opt_network_connect=true" \
  -F "opt_privacy_type=bylink"

# Check task status
curl "https://api.any.run/v1/analysis/$TASK_ID" \
  -H "Authorization: API-Key $ANYRUN_API_KEY" | jq '.data.status'

步骤 2：在执行期间与恶意软件交互

使用交互式会话触发恶意软件行为：

Interactive Actions During Analysis:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Document Macros:   Click "Enable Content" / "Enable Editing" when prompted
2. Installer Screens: Click through installation dialogs
3. UAC Prompts:       Click "Yes" to allow elevation (observe privilege escalation)
4. Credential Harvests: Enter fake credentials to observe phishing behavior
5. Browser Redirects:  Navigate to URLs if malware opens browser windows
6. File Dialogs:       Select target files if malware presents file picker
7. Timeout Extension:  Extend analysis time if malware has delayed execution

步骤 3：分析进程树

查看完整的进程执行链：

Process Tree Analysis Points:
━━━━━━━━━━━━━━━━━━━━━━━━━━━
Parent-Child Relationships:
  - WINWORD.EXE -> cmd.exe -> powershell.exe (macro execution chain)
  - explorer.exe -> suspect.exe -> svchost.exe (process injection)

Process Events to Note:
  - Process creation with suspicious command-line arguments
  - PowerShell with encoded commands (-enc / -encodedcommand)
  - cmd.exe executing script files (.bat, .vbs, .js)
  - Legitimate processes spawned from unusual parents
  - Process termination (self-deletion behavior)

步骤 4：审查网络活动

检查 DNS、HTTP/HTTPS 和 TCP/UDP 连接：

ANY.RUN Network Panel Analysis:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DNS Requests:
  - Domain resolutions with threat intelligence tags
  - Fast-flux or DGA domain patterns
  - DNS over HTTPS (DoH) detection

HTTP/HTTPS Traffic (with MITM enabled):
  - Full request/response bodies for HTTP
  - Decrypted HTTPS traffic showing C2 commands
  - Downloaded payloads and their content types
  - POST data containing exfiltrated information

Connection Map:
  - Geographic visualization of C2 server locations
  - Connection timeline showing beacon patterns
  - Suricata alerts triggered on network traffic

步骤 5：检查 IOC 和威胁情报

提取指标并映射到已知威胁：

ANY.RUN IOC Categories:
━━━━━━━━━━━━━━━━━━━━━━
Files:       Dropped files with hashes, YARA matches, VirusTotal results
Network:     IPs, domains, URLs contacted during execution
Registry:    Keys created/modified for persistence
Processes:   Suspicious process names and command lines
Mutex:       Named mutexes created (used for single-instance checking)
Signatures:  Suricata rules triggered, behavioral signatures matched

MITRE ATT&CK Mapping:
  - ANY.RUN automatically maps observed behaviors to ATT&CK techniques
  - Review the ATT&CK matrix tab for technique coverage
  - Export ATT&CK Navigator layer for reporting

步骤 6：导出分析结果

下载综合报告和工件：

# Download report via API
curl "https://api.any.run/v1/analysis/$TASK_ID/report" \
  -H "Authorization: API-Key $ANYRUN_API_KEY" \
  -o report.json

# Download PCAP
curl "https://api.any.run/v1/analysis/$TASK_ID/pcap" \
  -H "Authorization: API-Key $ANYRUN_API_KEY" \
  -o capture.pcap

# Download dropped files
curl "https://api.any.run/v1/analysis/$TASK_ID/files" \
  -H "Authorization: API-Key $ANYRUN_API_KEY" \
  -o dropped_files.zip

# Available exports from ANY.RUN web interface:
# - HTML Report (shareable standalone page)
# - PCAP file (network traffic capture)
# - Process dump (memory dumps of processes)
# - Dropped files (all files created during execution)
# - MITRE ATT&CK Navigator JSON
# - IOC export (STIX/JSON/CSV format)

关键概念

术语	定义
交互式沙箱	允许分析师与执行中的样本实时交互的分析环境，能够触发依赖用户的行为
MITM 代理	ANY.RUN 中的中间人 TLS 拦截，可解密 HTTPS 流量，从而查看加密的 C2 通信
住宅代理	ANY.RUN 功能，通过住宅 IP 地址路由恶意软件流量，以绕过地理 IP 和数据中心 IP 规避检查
Suricata 警报	执行期间触发的网络 IDS 签名，可立即识别已知恶意流量模式
进程树	父子进程关系的层次化可视化，显示从初始样本到最终载荷的完整执行链
行为标签	ANY.RUN 根据观察到的行为自动应用的分类标签（例如“trojan”、“stealer”、“ransomware”）

工具与系统

• ANY.RUN：基于云的交互式恶意软件沙箱，提供实时执行监控、进程树、网络捕获和 MITRE ATT&CK 映射
• ANY.RUN API：用于以编程方式提交样本、检查状态以及获取报告/工件的 REST API
• Suricata：ANY.RUN 中集成的网络 IDS，提供基于签名的恶意网络流量检测
• MITRE ATT&CK Navigator：框架集成，将观察到的恶意软件行为映射到对手技术和战术
• VirusTotal 集成：自动将样本和释放文件的哈希与 VirusTotal 检测结果进行比对查询

常见场景

场景：分析需要用户交互的宏启用文档

背景：钓鱼邮件包含一个 .docm 文件，需要点击“启用内容”才能触发宏载荷。传统的非交互式沙箱无法触发恶意行为。

方法：

1. 将 .docm 上传到 ANY.RUN，使用安装了 Microsoft Office 的 Windows 10 环境
2. 当 Word 打开并显示安全横幅时，交互式点击“启用内容”
3. 在进程树中观察宏执行（Word -> cmd.exe -> powershell.exe）
4. 监控网络面板，查看 PowerShell 下载第二阶段载荷
5. 如果出现 UAC 提示，点击“是”以允许载荷观察完整行为链
6. 查看 Suricata 警报，检查下载载荷上的已知恶意软件签名
7. 导出 IOC（下载 URL、释放文件哈希、C2 域名）用于封锁

陷阱：

• 忘记启用 MITM 代理，导致加密 HTTPS 流量无法可见
• 对具有延迟执行或休眠计时器的恶意软件使用过短的执行超时
• 当样本包含敏感组织数据时上传到公共分析
• 没有点击所有提示；某些恶意软件需要多次用户交互才能完全执行

输出格式

ANY.RUN ANALYSIS REPORT
=========================
Task URL:         https://app.any.run/tasks/<task_id>
Sample:           invoice_q3.docm
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
Verdict:          MALICIOUS (Score: 95/100)
Family:           Emotet
Tags:             [trojan, banker, spam, macro]

PROCESS TREE
WINWORD.EXE (PID: 2184)
  └── cmd.exe (PID: 3456) "/c powershell -enc JABXAG..."
      └── powershell.exe (PID: 4012)
          └── rundll32.exe (PID: 4568) "C:\Users\...\payload.dll,Control_RunDLL"

NETWORK INDICATORS
DNS:    update.emotet-c2[.]com -> 185.220.101.42
HTTPS:  POST hxxps://185.220.101[.]42/wp-content/gate/ (C2 beacon)
HTTP:   GET hxxp://compromised-site[.]com/invoice.dll (payload download)

SURICATA ALERTS
[1:2028401] ET MALWARE Emotet CnC Beacon
[1:2028402] ET MALWARE Win32/Emotet Activity

MITRE ATT&CK TECHNIQUES
T1566.001  Phishing: Spearphishing Attachment
T1204.002  User Execution: Malicious File
T1059.001  Command and Scripting Interpreter: PowerShell
T1218.011  Rundll32 Execution
T1071.001  Application Layer Protocol: Web Protocols

DROPPED FILES
payload.dll  SHA-256: abc123... Detection: 48/72 (VirusTotal)
config.dat   SHA-256: def456... (encrypted configuration)