Dynamic Analysis in a Sandbox
Run malware in Any.run or Cuckoo Sandbox; observe process creation, network calls, and file writes.
Dynamic Analysis in a Sandbox is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is Dynamic Analysis?
Dynamic analysis executes malware in a controlled environment to observe its actual behavior: files created, registry keys modified, network connections made, and processes spawned. It reveals what static analysis cannot.
Sandbox Architecture
A sandbox wraps the OS with monitoring hooks that intercept system calls. Behavioral logs capture every file, registry, network, and process event. Popular sandboxes: Any.run (interactive), Cuckoo (self-hosted), Joe Sandbox.
Setting Up an Isolated Lab
Use VMware or VirtualBox with host-only networking or a dedicated VLAN. Take a clean snapshot before running samples. Never connect your analysis VM to production networks — malware may attempt lateral movement.
Running a Sample in Any.run
Submit the sample, observe it in a live interactive VM, and download the full behavioral report. Any.run highlights network indicators, process trees, dropped files, and MITRE ATT&CK technique tags automatically.
Process Tree Analysis
The process tree shows parent-child relationships. Seeing word.exe spawning powershell.exe spawning cmd.exe indicates a macro-based dropper. Unexpected child processes are a key indicator of compromise.
Network Traffic Analysis
Sandbox network captures show DNS queries (C2 domain resolution), HTTP/S beaconing, and data exfiltration. Note destination IPs, ports, user-agent strings, and URI patterns — all become network IOCs.
File System Changes
Malware often drops payloads to %TEMP%, %APPDATA%, or system directories. It may replace legitimate binaries (DLL hijacking) or add persistence scripts. Monitor created, modified, and deleted files carefully.
Registry Modifications
Persistence via Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), service installation (HKLM\SYSTEM\CurrentControlSet\Services), and COM hijacking all appear as registry events in sandbox logs.
Cuckoo Sandbox Self-Hosted
Cuckoo runs on Linux and manages Windows VMs as analysis guests. The REST API accepts samples, returns JSON reports, and integrates with threat intel platforms. Customizable modules capture memory dumps and network PCAPs.
Evading Sandbox Detection
Sophisticated malware checks for sandbox artifacts: low process count, no mouse movement, VM registry keys (VMware Tools), specific username patterns, or short uptime. Use real hardware or long-run sandboxes to defeat evasion.
Combining Static and Dynamic Analysis
Dynamic analysis confirms what static analysis suggested. If static analysis found suspicious imports, dynamic analysis shows whether they were actually called and with what parameters — building a complete behavioral profile.
Knowledge Check
What does a sandbox primarily record during dynamic malware analysis?
Summary
Dynamic analysis runs malware safely in an isolated sandbox to capture its real behavior. Process trees, network traffic, registry changes, and file operations together paint a full picture of malware functionality and IOCs.
Frequently asked questions
Is the “Dynamic Analysis in a Sandbox” lesson free?
Yes — the full text of “Dynamic Analysis in a Sandbox” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Dynamic Analysis in a Sandbox”?
Run malware in Any.run or Cuckoo Sandbox; observe process creation, network calls, and file writes. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Dynamic Analysis in a Sandbox” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.