## Dynamic Analysis (Sandboxing)

When Static Analysis hits a wall (obfuscation), we detonate the bomb in a box.

### 1. Automated Sandboxes (Cuckoo / Cuckoo-Modified)
*   **Concept**: You submit a file. The system spins up a VM, runs the file, records everything for 5 minutes, kills the VM, and gives you a report.
*   **The Report**:
    *   **Screenshots**: Did it pop up a Ransomware note?
    *   **Network**: PCAPs of traffic.
    *   **Dropped Files**: Copies of any files it created.
    *   **API Calls**: Every interaction with Windows.

### 2. Interactive Analysis (Any.Run)
*   **Concept**: A web-based sandbox where *you* interact with the VM.
*   **Scenario**: The malware is a Word Doc that says "Click Enable Content".
    *   In Cuckoo, no one clicks it, so nothing happens.
    *   In Any.Run, you watch the screen, you click "Enable Content", and BAM, the malware runs. You see the process tree explode in real-time.
*   **Pros**: instant visibility, handles user-interaction triggers.

### 3. Monitoring Tools (Manual Sandbox)
If you are running the malware in your own FlareVM:
*   **Process Hacker**: Task Manager on steroids. Shows parent-child trees, memory strings, and coloring for packed processes.
*   **Procmon (Process Monitor)**: The holy grail. Records *every* File System, Registry, and Process event.
    *   *Tip*: It generates millions of events. Filter is your friend. `ProcessName is evil.exe`.
*   **Regshot**:
    1.  Take "Shot 1" (Registry before malware).
    2.  Run Malware.
    3.  Take "Shot 2".
    4.  Compare. It shows you exactly what registry keys were added (Persistence).
*   **Fiddler / Wireshark**: Capture the network traffic. Fiddler is great for decrypting HTTPs if you install its root cert.

### Indicators of Compromise (IOCs)
The goal of Dynamic analysis is to extract IOCs to put into your SIEM/EDR.
*   **Network IOCs**: C2 IPs, Domains, URLs to block.
*   **Host IOCs**: File Hashes, Mutex names, Registry keys, Filenames.
*   **Behavioral IOCs**: "Powershell.exe connecting to the internet".