[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GWNMX7FPMRRWWQA3G57PFX":3,"skill-same:01M6GWNMX7FPMRRWWQA3G57PFX":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6GWNMX7FPMRRWWQA3G57PFX","analyzing-malware-behavior-with-cuckoo-sandbox",null,"Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction. Activates for requests involving dynamic malware analysis, sandbox detonation, behavioral analysis, or automated malware execution.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"with","malware","Cuckoo","analyzing malware behavior with cuckoo sandbox","analyzing","sandbox","behavior","system","communications","creation","runtime","reports","observe","behavioral","ioc extraction","api","analysis","network","registry","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-malware-behavior-with-cuckoo-sandbox\ndescription: >\n  Executes malware samples in Cuckoo Sandbox to observe runtime behavior including\n  process creation, file system modifications, registry changes, network communications,\n  and API calls. Generates comprehensive behavioral reports for malware classification\n  and IOC extraction. Activates for requests involving dynamic malware analysis, sandbox\n  detonation, behavioral analysis, or automated malware execution.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [malware, dynamic-analysis, sandbox, Cuckoo, behavioral-analysis]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Analyzing Malware Behavior with Cuckoo Sandbox\n\n## When to Use\n\n- A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment\n- You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution\n- Determining the full infection chain including second-stage payload downloads and persistence mechanisms\n- Generating behavioral signatures and YARA rules based on observed runtime activity\n- Automated analysis of bulk malware samples requiring consistent reporting\n\n**Do not use** when the sample is a known ransomware variant that may spread via network shares in a misconfigured sandbox; verify network isolation first.\n\n## Prerequisites\n\n- Cuckoo Sandbox 3.x installed on a dedicated analysis server (Ubuntu 22.04 recommended)\n- Guest VMs configured with Windows 10\u002F11 snapshots (Cuckoo agent installed, snapshots taken at clean state)\n- VirtualBox, KVM, or VMware configured as the Cuckoo virtualization backend\n- Isolated network with InetSim or FakeNet-NG for simulating internet services\n- Suricata or Snort integrated for network-level signature matching during analysis\n- Sufficient disk space for PCAP captures and memory dumps (minimum 500 GB recommended)\n\n## Workflow\n\n### Step 1: Submit Sample to Cuckoo\n\nSubmit the malware sample for automated analysis:\n\n```bash\n# Submit via command line\ncuckoo submit \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit with specific analysis timeout (300 seconds)\ncuckoo submit --timeout 300 \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit with specific VM and analysis package\ncuckoo submit --machine win10_x64 --package exe --timeout 300 \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit via REST API\ncurl -F \"file=@suspect.exe\" -F \"timeout=300\" -F \"machine=win10_x64\" \\\n  http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fcreate\u002Ffile\n\n# Submit URL for analysis\ncurl -F \"url=http:\u002F\u002Fmalicious-site.com\u002Fpayload\" -F \"timeout=300\" \\\n  http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fcreate\u002Furl\n\n# Check task status\ncurl http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fview\u002F1 | jq '.task.status'\n```\n\n### Step 2: Monitor Execution in Real-Time\n\nTrack the analysis progress and observe live behavior:\n\n```bash\n# Watch Cuckoo analysis log\ntail -f \u002Fopt\u002Fcuckoo\u002Flog\u002Fcuckoo.log\n\n# Monitor analysis task status\ncuckoo status\n\n# Access Cuckoo web interface for live screenshots and process tree\n# Navigate to http:\u002F\u002Flocalhost:8080\u002Fanalysis\u002F\u003Ctask_id>\u002F\n```\n\nKey behavioral events to watch during execution:\n- Process creation chain (parent-child relationships)\n- Network connection attempts to external IPs\n- File drops in temporary directories or system folders\n- Registry modifications to Run keys or service entries\n- API calls related to encryption (CryptEncrypt), injection (WriteProcessMemory), or evasion\n\n### Step 3: Analyze Process Activity\n\nReview the process tree and API call trace from the Cuckoo report:\n\n```python\n# Parse Cuckoo JSON report programmatically\nimport json\n\nwith open(\"\u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Freports\u002Freport.json\") as f:\n    report = json.load(f)\n\n# Process tree analysis\nfor process in report[\"behavior\"][\"processes\"]:\n    pid = process[\"pid\"]\n    ppid = process[\"ppid\"]\n    name = process[\"process_name\"]\n    print(f\"PID: {pid} PPID: {ppid} Name: {name}\")\n\n    # Extract suspicious API calls\n    for call in process[\"calls\"]:\n        api = call[\"api\"]\n        if api in [\"CreateRemoteThread\", \"VirtualAllocEx\", \"WriteProcessMemory\",\n                    \"NtCreateThreadEx\", \"RegSetValueExA\", \"URLDownloadToFileA\"]:\n            args = {arg[\"name\"]: arg[\"value\"] for arg in call[\"arguments\"]}\n            print(f\"  [!] {api}({args})\")\n```\n\n### Step 4: Review Network Activity\n\nExamine network connections, DNS queries, and HTTP requests:\n\n```python\n# Network analysis from Cuckoo report\nnetwork = report[\"network\"]\n\n# DNS resolutions\nprint(\"DNS Queries:\")\nfor dns in network.get(\"dns\", []):\n    print(f\"  {dns['request']} -> {dns.get('answers', [])}\")\n\n# HTTP requests\nprint(\"\\nHTTP Requests:\")\nfor http in network.get(\"http\", []):\n    print(f\"  {http['method']} {http['uri']} (Host: {http['host']})\")\n    if http.get(\"body\"):\n        print(f\"    Body: {http['body'][:200]}\")\n\n# TCP connections\nprint(\"\\nTCP Connections:\")\nfor tcp in network.get(\"tcp\", []):\n    print(f\"  {tcp['src']}:{tcp['sport']} -> {tcp['dst']}:{tcp['dport']}\")\n\n# Extract PCAP for deeper Wireshark analysis\n# PCAP location: \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fdump.pcap\n```\n\n### Step 5: Examine File System and Registry Changes\n\nDocument persistence mechanisms and dropped files:\n\n```python\n# File operations\nprint(\"Files Created\u002FModified:\")\nfor f in report[\"behavior\"].get(\"summary\", {}).get(\"files\", []):\n    print(f\"  {f}\")\n\n# Dropped files with hashes\nprint(\"\\nDropped Files:\")\nfor dropped in report.get(\"dropped\", []):\n    print(f\"  Path: {dropped['filepath']}\")\n    print(f\"  SHA-256: {dropped['sha256']}\")\n    print(f\"  Size: {dropped['size']} bytes\")\n    print(f\"  Type: {dropped['type']}\")\n\n# Registry modifications\nprint(\"\\nRegistry Keys Modified:\")\nfor key in report[\"behavior\"].get(\"summary\", {}).get(\"keys\", []):\n    print(f\"  {key}\")\n```\n\n### Step 6: Review Signatures and Scoring\n\nCheck Cuckoo's behavioral signatures and threat scoring:\n\n```python\n# Behavioral signatures triggered\nprint(\"Triggered Signatures:\")\nfor sig in report.get(\"signatures\", []):\n    severity = sig[\"severity\"]\n    name = sig[\"name\"]\n    description = sig[\"description\"]\n    marker = \"[!]\" if severity >= 3 else \"[*]\"\n    print(f\"  {marker} [{severity}\u002F5] {name}: {description}\")\n    for mark in sig.get(\"marks\", []):\n        if mark.get(\"call\"):\n            print(f\"      API: {mark['call']['api']}\")\n        if mark.get(\"ioc\"):\n            print(f\"      IOC: {mark['ioc']}\")\n\n# Overall score\nscore = report.get(\"info\", {}).get(\"score\", 0)\nprint(f\"\\nOverall Threat Score: {score}\u002F10\")\n```\n\n### Step 7: Extract Memory Dump Artifacts\n\nAnalyze the full memory dump captured during execution:\n\n```bash\n# Memory dump is saved at:\n# \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp\n\n# Use Volatility to analyze the memory dump\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.pslist\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.malfind\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.netscan\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Dynamic Analysis** | Executing malware in a controlled environment to observe runtime behavior including system calls, network activity, and file operations |\n| **Sandbox Evasion** | Techniques malware uses to detect virtual\u002Fsandbox environments and alter behavior to avoid analysis (sleep timers, VM checks, user interaction checks) |\n| **API Hooking** | Cuckoo's method of intercepting Windows API calls made by the malware to log function names, parameters, and return values |\n| **InetSim** | Internet services simulation tool that responds to malware network requests (HTTP, DNS, SMTP) within the isolated analysis network |\n| **Process Injection** | Malware technique of injecting code into legitimate processes; detected by monitoring VirtualAllocEx and WriteProcessMemory API sequences |\n| **Behavioral Signature** | Rule-based detection matching specific sequences of API calls, file operations, or network activity to known malware behaviors |\n| **Analysis Package** | Cuckoo module defining how to execute a specific file type (exe, dll, pdf, doc) within the guest VM for proper behavioral capture |\n\n## Tools & Systems\n\n- **Cuckoo Sandbox**: Open-source automated malware analysis system providing behavioral reports, network captures, and memory dumps\n- **InetSim**: Internet services simulation suite providing fake HTTP, DNS, SMTP, and other services for isolated malware analysis networks\n- **FakeNet-NG**: FLARE team's network simulation tool that intercepts and redirects all network traffic for analysis\n- **Suricata**: Network IDS\u002FIPS integrated with Cuckoo for real-time signature-based detection of malicious network traffic\n- **Volatility**: Memory forensics framework used to analyze memory dumps captured during Cuckoo analysis\n\n## Common Scenarios\n\n### Scenario: Analyzing a Multi-Stage Dropper\n\n**Context**: Static analysis reveals a packed executable with minimal imports and high entropy. The sample needs sandbox execution to observe unpacking, payload delivery, and C2 establishment.\n\n**Approach**:\n1. Submit sample to Cuckoo with extended timeout (600 seconds) to capture slow-acting behavior\n2. Review process tree for child process creation (dropper spawning payload processes)\n3. Identify dropped files in %TEMP%, %APPDATA%, or system directories\n4. Extract dropped files and compute hashes for separate analysis\n5. Map network connections to identify C2 infrastructure contacted after initial execution\n6. Check for persistence mechanisms (Run keys, scheduled tasks, services) in registry modifications\n7. Compare behavioral signatures against known malware families\n\n**Pitfalls**:\n- Using insufficient analysis timeout causing the sandbox to terminate before second-stage payload executes\n- Not configuring InetSim to respond to DNS and HTTP requests, preventing the malware from progressing past C2 check-in\n- Ignoring sandbox evasion detections; if the sample exits immediately, it may be detecting the virtual environment\n- Not analyzing dropped files separately; the initial dropper may be less interesting than the final payload\n\n## Output Format\n\n```\nDYNAMIC ANALYSIS REPORT - CUCKOO SANDBOX\n==========================================\nTask ID:          1547\nSample:           suspect.exe (SHA-256: e3b0c44298fc1c149afbf4c8996fb924...)\nAnalysis Time:    300 seconds\nVM:               win10_x64 (Windows 10 21H2)\nScore:            8.5\u002F10\n\nPROCESS TREE\nsuspect.exe (PID: 2184)\n  └── cmd.exe (PID: 3456)\n      └── powershell.exe (PID: 4012)\n          └── svchost_fake.exe (PID: 4568)\n\nFILE SYSTEM ACTIVITY\n[CREATED]  C:\\Users\\Admin\\AppData\\Local\\Temp\\payload.dll\n[CREATED]  C:\\Windows\\System32\\svchost_fake.exe\n[MODIFIED] C:\\Windows\\System32\\drivers\\etc\\hosts\n\nREGISTRY MODIFICATIONS\n[SET] HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate = \"C:\\Windows\\System32\\svchost_fake.exe\"\n[SET] HKLM\\SYSTEM\\CurrentControlSet\\Services\\FakeService\\ImagePath = \"C:\\Windows\\System32\\svchost_fake.exe\"\n\nNETWORK ACTIVITY\nDNS:    update.malicious[.]com -> 185.220.101.42\nHTTP:   POST hxxps:\u002F\u002F185.220.101[.]42\u002Fgate.php (beacon)\nTCP:    10.0.2.15:49152 -> 185.220.101.42:443 (237 connections)\n\nBEHAVIORAL SIGNATURES\n[!] [4\u002F5] injection_createremotethread: Injects code into remote process\n[!] [4\u002F5] persistence_autorun: Modifies Run registry key for persistence\n[!] [3\u002F5] network_cnc_http: Performs HTTP C2 communication\n[*] [2\u002F5] antiav_detectfile: Checks for antivirus product files\n\nDROPPED FILES\npayload.dll    SHA-256: abc123... Size: 98304  Type: PE32 DLL\nsvchost_fake.exe SHA-256: def456... Size: 184320 Type: PE32 EXE\n```\n","# Analyzing Malware Behavior with Cuckoo Sandbox\n\n## When to Use\n\n- A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment\n- You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution\n- Determining the full infection chain including second-stage payload downloads and persistence mechanisms\n- Generating behavioral signatures and YARA rules based on observed runtime activity\n- Automated analysis of bulk malware samples requiring consistent reporting\n\n**Do not use** when the sample is a known ransomware variant that may spread via network shares in a misconfigured sandbox; verify network isolation first.\n\n## Prerequisites\n\n- Cuckoo Sandbox 3.x installed on a dedicated analysis server (Ubuntu 22.04 recommended)\n- Guest VMs configured with Windows 10\u002F11 snapshots (Cuckoo agent installed, snapshots taken at clean state)\n- VirtualBox, KVM, or VMware configured as the Cuckoo virtualization backend\n- Isolated network with InetSim or FakeNet-NG for simulating internet services\n- Suricata or Snort integrated for network-level signature matching during analysis\n- Sufficient disk space for PCAP captures and memory dumps (minimum 500 GB recommended)\n\n## Workflow\n\n### Step 1: Submit Sample to Cuckoo\n\nSubmit the malware sample for automated analysis:\n\n```bash\n# Submit via command line\ncuckoo submit \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit with specific analysis timeout (300 seconds)\ncuckoo submit --timeout 300 \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit with specific VM and analysis package\ncuckoo submit --machine win10_x64 --package exe --timeout 300 \u002Fpath\u002Fto\u002Fsuspect.exe\n\n# Submit via REST API\ncurl -F \"file=@suspect.exe\" -F \"timeout=300\" -F \"machine=win10_x64\" \\\n  http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fcreate\u002Ffile\n\n# Submit URL for analysis\ncurl -F \"url=http:\u002F\u002Fmalicious-site.com\u002Fpayload\" -F \"timeout=300\" \\\n  http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fcreate\u002Furl\n\n# Check task status\ncurl http:\u002F\u002Flocalhost:8090\u002Ftasks\u002Fview\u002F1 | jq '.task.status'\n```\n\n### Step 2: Monitor Execution in Real-Time\n\nTrack the analysis progress and observe live behavior:\n\n```bash\n# Watch Cuckoo analysis log\ntail -f \u002Fopt\u002Fcuckoo\u002Flog\u002Fcuckoo.log\n\n# Monitor analysis task status\ncuckoo status\n\n# Access Cuckoo web interface for live screenshots and process tree\n# Navigate to http:\u002F\u002Flocalhost:8080\u002Fanalysis\u002F\u003Ctask_id>\u002F\n```\n\nKey behavioral events to watch during execution:\n- Process creation chain (parent-child relationships)\n- Network connection attempts to external IPs\n- File drops in temporary directories or system folders\n- Registry modifications to Run keys or service entries\n- API calls related to encryption (CryptEncrypt), injection (WriteProcessMemory), or evasion\n\n### Step 3: Analyze Process Activity\n\nReview the process tree and API call trace from the Cuckoo report:\n\n```python\n# Parse Cuckoo JSON report programmatically\nimport json\n\nwith open(\"\u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Freports\u002Freport.json\") as f:\n    report = json.load(f)\n\n# Process tree analysis\nfor process in report[\"behavior\"][\"processes\"]:\n    pid = process[\"pid\"]\n    ppid = process[\"ppid\"]\n    name = process[\"process_name\"]\n    print(f\"PID: {pid} PPID: {ppid} Name: {name}\")\n\n    # Extract suspicious API calls\n    for call in process[\"calls\"]:\n        api = call[\"api\"]\n        if api in [\"CreateRemoteThread\", \"VirtualAllocEx\", \"WriteProcessMemory\",\n                    \"NtCreateThreadEx\", \"RegSetValueExA\", \"URLDownloadToFileA\"]:\n            args = {arg[\"name\"]: arg[\"value\"] for arg in call[\"arguments\"]}\n            print(f\"  [!] {api}({args})\")\n```\n\n### Step 4: Review Network Activity\n\nExamine network connections, DNS queries, and HTTP requests:\n\n```python\n# Network analysis from Cuckoo report\nnetwork = report[\"network\"]\n\n# DNS resolutions\nprint(\"DNS Queries:\")\nfor dns in network.get(\"dns\", []):\n    print(f\"  {dns['request']} -> {dns.get('answers', [])}\")\n\n# HTTP requests\nprint(\"\\nHTTP Requests:\")\nfor http in network.get(\"http\", []):\n    print(f\"  {http['method']} {http['uri']} (Host: {http['host']})\")\n    if http.get(\"body\"):\n        print(f\"    Body: {http['body'][:200]}\")\n\n# TCP connections\nprint(\"\\nTCP Connections:\")\nfor tcp in network.get(\"tcp\", []):\n    print(f\"  {tcp['src']}:{tcp['sport']} -> {tcp['dst']}:{tcp['dport']}\")\n\n# Extract PCAP for deeper Wireshark analysis\n# PCAP location: \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fdump.pcap\n```\n\n### Step 5: Examine File System and Registry Changes\n\nDocument persistence mechanisms and dropped files:\n\n```python\n# File operations\nprint(\"Files Created\u002FModified:\")\nfor f in report[\"behavior\"].get(\"summary\", {}).get(\"files\", []):\n    print(f\"  {f}\")\n\n# Dropped files with hashes\nprint(\"\\nDropped Files:\")\nfor dropped in report.get(\"dropped\", []):\n    print(f\"  Path: {dropped['filepath']}\")\n    print(f\"  SHA-256: {dropped['sha256']}\")\n    print(f\"  Size: {dropped['size']} bytes\")\n    print(f\"  Type: {dropped['type']}\")\n\n# Registry modifications\nprint(\"\\nRegistry Keys Modified:\")\nfor key in report[\"behavior\"].get(\"summary\", {}).get(\"keys\", []):\n    print(f\"  {key}\")\n```\n\n### Step 6: Review Signatures and Scoring\n\nCheck Cuckoo's behavioral signatures and threat scoring:\n\n```python\n# Behavioral signatures triggered\nprint(\"Triggered Signatures:\")\nfor sig in report.get(\"signatures\", []):\n    severity = sig[\"severity\"]\n    name = sig[\"name\"]\n    description = sig[\"description\"]\n    marker = \"[!]\" if severity >= 3 else \"[*]\"\n    print(f\"  {marker} [{severity}\u002F5] {name}: {description}\")\n    for mark in sig.get(\"marks\", []):\n        if mark.get(\"call\"):\n            print(f\"      API: {mark['call']['api']}\")\n        if mark.get(\"ioc\"):\n            print(f\"      IOC: {mark['ioc']}\")\n\n# Overall score\nscore = report.get(\"info\", {}).get(\"score\", 0)\nprint(f\"\\nOverall Threat Score: {score}\u002F10\")\n```\n\n### Step 7: Extract Memory Dump Artifacts\n\nAnalyze the full memory dump captured during execution:\n\n```bash\n# Memory dump is saved at:\n# \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp\n\n# Use Volatility to analyze the memory dump\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.pslist\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.malfind\nvol3 -f \u002Fopt\u002Fcuckoo\u002Fstorage\u002Fanalyses\u002F1\u002Fmemory.dmp windows.netscan\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Dynamic Analysis** | Executing malware in a controlled environment to observe runtime behavior including system calls, network activity, and file operations |\n| **Sandbox Evasion** | Techniques malware uses to detect virtual\u002Fsandbox environments and alter behavior to avoid analysis (sleep timers, VM checks, user interaction checks) |\n| **API Hooking** | Cuckoo's method of intercepting Windows API calls made by the malware to log function names, parameters, and return values |\n| **InetSim** | Internet services simulation tool that responds to malware network requests (HTTP, DNS, SMTP) within the isolated analysis network |\n| **Process Injection** | Malware technique of injecting code into legitimate processes; detected by monitoring VirtualAllocEx and WriteProcessMemory API sequences |\n| **Behavioral Signature** | Rule-based detection matching specific sequences of API calls, file operations, or network activity to known malware behaviors |\n| **Analysis Package** | Cuckoo module defining how to execute a specific file type (exe, dll, pdf, doc) within the guest VM for proper behavioral capture |\n\n## Tools & Systems\n\n- **Cuckoo Sandbox**: Open-source automated malware analysis system providing behavioral reports, network captures, and memory dumps\n- **InetSim**: Internet services simulation suite providing fake HTTP, DNS, SMTP, and other services for isolated malware analysis networks\n- **FakeNet-NG**: FLARE team's network simulation tool that intercepts and redirects all network traffic for analysis\n- **Suricata**: Network IDS\u002FIPS integrated with Cuckoo for real-time signature-based detection of malicious network traffic\n- **Volatility**: Memory forensics framework used to analyze memory dumps captured during Cuckoo analysis\n\n## Common Scenarios\n\n### Scenario: Analyzing a Multi-Stage Dropper\n\n**Context**: Static analysis reveals a packed executable with minimal imports and high entropy. The sample needs sandbox execution to observe unpacking, payload delivery, and C2 establishment.\n\n**Approach**:\n1. Submit sample to Cuckoo with extended timeout (600 seconds) to capture slow-acting behavior\n2. Review process tree for child process creation (dropper spawning payload processes)\n3. Identify dropped files in %TEMP%, %APPDATA%, or system directories\n4. Extract dropped files and compute hashes for separate analysis\n5. Map network connections to identify C2 infrastructure contacted after initial execution\n6. Check for persistence mechanisms (Run keys, scheduled tasks, services) in registry modifications\n7. Compare behavioral signatures against known malware families\n\n**Pitfalls**:\n- Using insufficient analysis timeout causing the sandbox to terminate before second-stage payload executes\n- Not configuring InetSim to respond to DNS and HTTP requests, preventing the malware from progressing past C2 check-in\n- Ignoring sandbox evasion detections; if the sample exits immediately, it may be detecting the virtual environment\n- Not analyzing dropped files separately; the initial dropper may be less interesting than the final payload\n\n## Output Format\n\n```\nDYNAMIC ANALYSIS REPORT - CUCKOO SANDBOX\n==========================================\nTask ID:          1547\nSample:           suspect.exe (SHA-256: e3b0c44298fc1c149afbf4c8996fb924...)\nAnalysis Time:    300 seconds\nVM:               win10_x64 (Windows 10 21H2)\nScore:            8.5\u002F10\n\nPROCESS TREE\nsuspect.exe (PID: 2184)\n  └── cmd.exe (PID: 3456)\n      └── powershell.exe (PID: 4012)\n          └── svchost_fake.exe (PID: 4568)\n\nFILE SYSTEM ACTIVITY\n[CREATED]  C:\\Users\\Admin\\AppData\\Local\\Temp\\payload.dll\n[CREATED]  C:\\Windows\\System32\\svchost_fake.exe\n[MODIFIED] C:\\Windows\\System32\\drivers\\etc\\hosts\n\nREGISTRY MODIFICATIONS\n[SET] HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate = \"C:\\Windows\\System32\\svchost_fake.exe\"\n[SET] HKLM\\SYSTEM\\CurrentControlSet\\Services\\FakeService\\ImagePath = \"C:\\Windows\\System32\\svchost_fake.exe\"\n\nNETWORK ACTIVITY\nDNS:    update.malicious[.]com -> 185.220.101.42\nHTTP:   POST hxxps:\u002F\u002F185.220.101[.]42\u002Fgate.php (beacon)\nTCP:    10.0.2.15:49152 -> 185.220.101.42:443 (237 connections)\n\nBEHAVIORAL SIGNATURES\n[!] [4\u002F5] injection_createremotethread: Injects code into remote process\n[!] [4\u002F5] persistence_autorun: Modifies Run registry key for persistence\n[!] [3\u002F5] network_cnc_http: Performs HTTP C2 communication\n[*] [2\u002F5] antiav_detectfile: Checks for antivirus product files\n\nDROPPED FILES\npayload.dll    SHA-256: abc123... Size: 98304  Type: PE32 DLL\nsvchost_fake.exe SHA-256: def456... Size: 184320 Type: PE32 EXE\n```\n",{"name":5,"tags":43,"author":46,"domain":37,"license":14,"version":47,"subdomain":48,"description":49},[19,44,23,20,45],"dynamic-analysis","behavioral-analysis","mahipal","1.0.0","malware-analysis","Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction. Activates for requests involving dynamic malware analysis, sandbox detonation, behavioral analysis, or automated malware execution.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add micsapp\u002Fmicstec-skills --skill analyzing-malware-behavior-with-cuckoo-sandbox",{"tool":63,"command":64},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill analyzing-malware-behavior-with-cuckoo-sandbox",{"tool":66,"command":67},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill analyzing-malware-behavior-with-cuckoo-sandbox","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox\u002FSKILL.md",true,[71,76,82],{"path":72,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox\u002FLICENSE",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fapi-reference.md","REFERENCE","参考文档",2664,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox\u002Freferences\u002Fapi-reference.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fagent.py","SCRIPT","脚本",9324,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fanalyzing-malware-behavior-with-cuckoo-sandbox\u002Fscripts\u002Fagent.py",[89,125,155,176,196,221],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":106,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[96,101],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[107,108,109,110,111,112,113,114,35,33,115,116,117,118,119,120,121,122,123,124],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":139,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[131,132,135,138],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":133,"categoryName":134,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":136,"categoryName":137,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[140,141,142,143,108,144,145,146,147,148,149,150,33,115,121,151,152,122,153,154],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[161],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},[163,164,165,166,108,111,33,115,167,168,169,170,171,172,173,122,174,175,154,124],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":184,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[182,183],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[185,166,186,33,170,187,108,140,188,189,190,191,115,192,122,193,194,195,123,124],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[203,204,205,142,206,207,208,209,33,210,211,212,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,168,234,235],"npm","js","calculate","node","math","user","compute","errors"]