AnyRun_Sandbox_Analysis.json

{
  "name": "AnyRun_Sandbox_Analysis",
  "version": "1.1",
  "author": "Andrea Garavaglia, Davide Arcuri, LDO-CERT; Nate Olsen, WSECU",
  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
  "license": "AGPL-V3",
  "description": "Any.Run Sandbox file analysis",
  "dataTypeList": ["file", "url"],
  "command": "AnyRun/anyrun_analyzer.py",
  "baseConfig": "AnyRun",
  "configurationItems": [
    {
      "name": "token",
      "description": "API token",
      "type": "string",
      "multi": false,
      "required": false
    },
    {
      "name": "privacy_type",
      "description": "Define the privacy setting (Allowed values: public, bylink, owner)",
      "type": "string",
      "multi": false,
      "required": true,
      "defaultValue": "bylink"
    },
    {
      "name": "verify_ssl",
      "description": "Verify SSL certificate",
      "type": "boolean",
      "multi": false,
      "required": true,
      "defaultValue": true
    },
    {
      "name": "env_bitness",
      "description": "default OS bitness; 32 or 64",
      "type": "number",
      "multi": false,
      "required": false,
      "defaultValue": 32
    },
    {
      "name": "env_version",
      "description": "Which version of Windows do you want to use by default? allowed values: \"vista\", \"7\", \"8.1\", \"10\"",
      "type": "string",
      "multi": false,
      "required": false,
      "defaultValue": "7"
    },
    {
      "name": "env_type",
      "description": "How much do you want pre-installed in the runtime environment? allowed values: \"clean\", \"office\", \"complete\"",
      "type": "string",
      "multi": false,
      "required": false,
      "defaultValue": "complete"
    },
    {
      "name": "opt_network_connect",
      "description": "Do you want to disable networking? set false to disable",
      "type": "boolean",
      "multi": false,
      "required": false,
      "defaultValue": true
    },
    {
      "name": "opt_network_fakenet",
      "description": "FakeNet feature status; set true to enable.",
      "type": "boolean",
      "multi": false,
      "required": false,
      "defaultValue": false
    },
    {
      "name": "opt_network_tor",
      "description": "TOR using.",
      "type": "Boolean",
      "multi": false,
      "required": false,
      "defaultValue": false
    },
    {
      "name": "opt_network_mitm",
      "description": "HTTPS MITM proxy option.",
      "type": "Boolean",
      "multi": false,
      "required": false,
      "defaultValue": false
    },
    {
      "name": "opt_network_geo",
      "description": "Geo location option. Allowed values: \"fastest\", \"AU\", \"BR\", \"DE\", \"CH\", \"FR\", \"KR\", \"US\", \"RU\", \"GB\", \"IT\"",
      "type": "String",
      "multi": false,
      "required": false,
      "defaultValue": "fastest"
    },
    {
      "name": "opt_kernel_heavyevasion",
      "description": "Heavy evasion option.   Default value: false",
      "type": "Boolean",
      "multi": false,
      "required": false,
      "defaultValue": false
    },
    {
      "name": "opt_timeout",
      "description": "Timeout option. Size range: 10-660",
      "type": "Number",
      "multi": false,
      "required": false,
      "defaultValue": "60"
    },
    {
      "name": "obj_ext_startfolder",
      "description": "Start object from. Allowed values: \"desktop\", \"home\", \"downloads\", \"appdata\", \"temp\", \"windows\", \"root\"",
      "type": "String",
      "multi": false,
      "required": false,
      "defaultValue": "temp"
    },
    {
      "name": "obj_ext_browser",
      "description": "Choose which browser to use. Allowed values: \"Google Chrome\", \"Mozilla Firefox\", \"Opera\", \"Internet Explorer\"",
      "type": "String",
      "multi": false,
      "required": false,
      "defaultValue": "Internet Explorer"
    }
  ],
  "registration_required": true,
  "subscription_required": true,
  "free_subscription": false,
  "service_homepage": "https://any.run/",
  "service_logo": {
      "path": "assets/anyrun.png",
      "caption": "AnyRun logo"
  },
  "screenshots": [
      {
          "path": "assets/short_report.png",
          "caption": "AnyRun: Short report template"
      },
    
      {
          "path": "assets/long_report.png",
          "caption": "AnyRun: Long report template"
      }
  ]
}