## Dynamic Analysis\n\nExecuting malware to observe behavior.\n\n### Sandbox Environments\n\n**Public Sandboxes**:\n- Any.Run (interactive)\n- Hybrid Analysis\n- Joe Sandbox\n- Triage\n- VirusTotal (automated)\n\n**Private Sandboxes**:\n- Cuckoo Sandbox\n- CAPE Sandbox\n- FireEye AX\n\n### What Sandboxes Capture\n\n| Category | Examples |\n|----------|----------|\n| **Network** | DNS queries, HTTP requests, C2 traffic |\n| **Files** | Dropped files, modifications |\n| **Registry** | Persistence mechanisms |\n| **Processes** | Spawned processes, injection |\n| **Memory** | Unpacked code, strings |\n\n### Manual Dynamic Analysis\n\n**Tools for Windows VMs**:\n\n| Tool | Purpose |\n|------|--------|\n| **Process Monitor** | File/registry/network activity |\n| **Process Hacker** | Process inspection |\n| **Wireshark** | Network traffic capture |\n| **Regshot** | Registry changes |\n| **FakeNet-NG** | Simulate network services |\n\n### Sandbox Evasion\n\nMalware may detect sandboxes:\n- Check VM artifacts (VMware tools)\n- Check username/hostname\n- Time delays (sleep for 10 min)\n- Human interaction required\n- Environment checks\n\n**Countermeasures**:\n- Use realistic hostnames/usernames\n- Simulate user activity\n- Accelerate sleep calls\n- Use bare-metal analysis for sophisticated samples