In this lesson, we will see the demonstration of how Any.Run simplifies the process of Malware
analysis.
To start with, let's visit the website www.any.run
We would need to create an account to use the service, there is a free version, too.
However, there are few limitations of using the free version.
We will talk about the limitations in a bit.
So I register giving my email address and set a password and also verify my email address.
Then I will login with my account credentials.
Here, I will have to set up a new task and it just asks for two details.
First, what operating system do you want to use to run the malware sample?
Second, to submit the actual malware sample
Simple and easy, if you notice all the other operating systems are greyed out except for Windows 7
and also I can only select 32 bit machine.
These are the limitations of free versions on Any.Run.
The moment I try to slide it to 64 bit, it throws me the message this feature is available on higher
plans, upgrade to use the feature.
So I select Windows 7, 32 bit for this demo, and then we need to submit the sample.
So I will click on choose a file link and select the file in question.
Finally, I have to click on Run.
Again, it throws a warning that all the data we submit that is the file sample, its contents and the
details will be available for public access.
And if you want to run the analysis in private, then you need to choose a plan.
So I don't want the paid plan now, so we'll click on I agree, and then the fun begins.
Take a look at all the installed software like Acrobat Reader and MS office package, VLC media player, etc..
This will help in creating a near real replica of what our users use in the everyday work life.
On the right here, we see the countdown timer, it'll run for one minute by default and we can add
more time by clicking on this button.
As expected, the malware is throwing the message your computer is in danger.
Windows Security Center has detected spyware or adware infection.
It is strongly recommended to use special anti spyware.
As learned during string analysis, the same message appears a couple of times.
Now, the execution of the file is complete and we have let it run for two minutes.
Let's check the reports of Any.Run, one's the allotted time is completed, we can look at the reports of
the sample here.
We see some network activity like a http request going to download.bravesentry.com looks like the website
is hosted in Canada.
There is one TCP request going to the IP 69 50 175 181 on
port 80 and we have 93 bytes downloaded.
Not a lot because as you see here, the request did not get any response.
Maybe the website is not functioning at this point in time.
Further onto the right, we see the name of the submitted sample, if necessary, we could download
the sample again and a password protected file will be downloaded.
All the indicators of compromise that is IOC 's are listed here.
We can start the whole submission again and export the process graph.
We can also download a text report which will highlight all the details of the sample and its behavior.
For example, here we see the static analysis information like.
Any.Run is 64 percent confident that this is a UPX compressed windows 32 bit executable.
It also gives DOS header information like magic number, that is MZ, PE header information like it has
three different sections.
The compile time is 7th May 2007.
Down here, we see the details of the sections.
We notice there are two resources highlighted named 1 and 101 details can be expanded.
List of all the libraries used in applications are highlighted here and also a few screenshots taken
while running the sample.
There were a total of 34 processors running during execution of this malware and one process that is
the malware itself was being monitored.
Here we see the behavior information like the process graph.
It does a total of 7 registered activity, 6 read and 1 write, one such registry write
operation is highlighted.
Even though the file activity says here zero, we know by static analysis that the sample was infact
trying to download a few files like bravesentry.exe, bravesentry.lic, install.dat and xpupdate.exe
Because the website is not operational, the malware could not download the other files.
Further down here, we see the same network activity as highlighted before.
Going back to Any.Run, it will give similar data in various other formats at different places, like
if you click on this PE icon, we get the same details in different format.
Also, we noticed a hex format of the file.
Again, we see the first few bytes to be MZ confirming it is an executable file.
Upon clicking on the name of the sample, we get the detailed report here, I click on more information
and get all the details again in different tabs.
On the left here, we see the indicators, this sample exhibits one such behaviour.
Which talks about creating a new file install.dat at this highlighted location.
Even though Any.Run does not give us a verdict on the sample, we are very sure that this invoice.xlsx
file is definitely a Malware.