Advice Request Triage Sandbox - Have you tried it?

[simmerskool]

Triage | Triage

Explore Triage's Malware Analysis Sandbox to dissect your malware samples. Access malware trends, and a customizable environment for in-depth analysis and classification.

tria.ge

tirage sandbox, anyone using it, aware of it. a friend (online) linked me to it. I submitted two exe that were not signed, but which are not malware, and just now seeing the report, it took a few minutes. Developer is "hatching" and I understand he was involved with cuckoo sandbox. Report says score= 1/10 for both with lots more sandbox info.

 

[upnorth]

tirage sandbox, anyone using it, aware of it.

Sure thing, but personal not on a regular base as for most samples I'm used with other services.

 

[likeastar20]

Yes, i use it everytime. It's my go to sandbox.

 

[Andrezj]

Triage | Triage

Explore Triage's Malware Analysis Sandbox to dissect your malware samples. Access malware trends, and a customizable environment for in-depth analysis and classification.

tria.ge

tirage sandbox, anyone using it, aware of it. a friend (online) linked me to it. I submitted two exe that were not signed, but which are not malware, and just now seeing the report, it took a few minutes. Developer is "hatching" and I understand he was involved with cuckoo sandbox. Report says score= 1/10 for both with lots more sandbox info.

all the sandboxes are similar, but differ greatly in the amount of detail and the presentation

any.run is popular because of process graph
any.run description of what process does is written in a way that is more understandable
hybrid-analysis focuses heavily on reverse engineering, the http (outbound connections) graph is well liked

use multiple sandboxes can compare output until you determine which you like best

 

[simmerskool]

Sure thing, but personal not on a regular base as for most samples I'm used with other services.

which other? I know of Intezer & hybrid analysis both free. which one(s) you use and prefer??

 

[upnorth]

which other? I know of Intezer & hybrid analysis both free. which one(s) you use and prefer??

Intezer still has a free account option, but they decided to drop the amount of free tests per month from 50 down to 10. For me that was enough poor treatment of their free account users and made me leave them and haven't looked back since. Hybrid on the other hand is an old favorite and extra now since they include Windows 10 64bit. It's a extreme huge difference and member @struppigel has a very good video about Hybrid that I can highly recommend.

App Review - Using Hybrid Analysis for Initial Malware Assessment

Automatic sandbox systems like Hybrid-Analysis are a great way to speed up malware analysis. We find a file flagged as keylogger that has almost no antivirus detections. Report: Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for...

malwaretips.com

The next basic one, I would recommend more or less for anyone, is AnyRun. Extra much when curious on urls. Unless one already have a VM that's up and running, it's silly fast to start, login and add a url and see what happens. It has a free account, but one sadly only get access to Windows 7 32bit. The premium accounts is a bit expensive.

Interactive Online Malware Analysis Sandbox - ANY.RUN

Cloud-based malware analysis service. Take your information security to the next level. Analyze suspicious and malicious activities using our innovative tools.

app.any.run

Still, with Triage one can get a result at the same time for both W10 and W7 64bit.

 

[simmerskool]

Intezer still has a free account option, but they decided to drop the amount of free tests per month from 50 down to 10. For me that was enough poor treatment of their free account users and made me leave them and haven't looked back since. Hybrid on the other hand is an old favorite and extra now since they include Windows 10 64bit. It's a extreme huge difference and member @struppigel has a very good video about Hybrid that I can highly recommend.

App Review - Using Hybrid Analysis for Initial Malware Assessment

Automatic sandbox systems like Hybrid-Analysis are a great way to speed up malware analysis. We find a file flagged as keylogger that has almost no antivirus detections. Report: Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for...

malwaretips.com

The next basic one, I would recommend more or less for anyone, is AnyRun. Extra much when curious on urls. Unless one already have a VM that's up and running, it's silly fast to start, login and add a url and see what happens. It has a free account, but one sadly only get access to Windows 7 32bit. The premium accounts is a bit expensive.

Interactive Online Malware Analysis Sandbox - ANY.RUN

Cloud-based malware analysis service. Take your information security to the next level. Analyze suspicious and malicious activities using our innovative tools.

app.any.run

Still, with Triage one can get a result at the same time for both W10 and W7 64bit.

Thanks!! Yes I have used hybrid analysis free for long time but not really regularly. AnyRun first time there earlier today, me awkward user there, so was going to return tonight and get better acquainted with it. I saw same thing, free win7 only, would not let me select win10. I haven't checked their prices. For this, free is better! Intezer I started using a week or 2 ago, yes 10/mo for free which is probably enough for me. I also need to spend more time at triage. I now have more than enough to keep me busy!! Big thanks for the howto link

 

[Andrezj]

which other? I know of Intezer & hybrid analysis both free. which one(s) you use and prefer??

hatching triage offers individuals to run analysis on windows 10 and 11 virtual machines for free, this is an advantage because malware can behave differently on different windows version
hybrid-analysis allows running of windows 10 analysis for free users
hybrid-analysis is the best if you know how to read the reports
hybrid-analysis uses crowdstrike ai which produces results that appear better than free metadefender.opswat and virustotal
hybrid-analysis allows free user to run additional customized analysis of already submitted samples inside crowdstrike falcon, limitation though is only windows 7 os available to free user
the behavior summary on virustotal is easier to understand
there is github virustotal uploader by trusted third party Releases · SamuelTulach/VirusTotalUploader

https://support.virustotal.com/hc/en-us/articles/115002179065-Desktop-apps#windows-uploader

 

[Sandbox Breaker]

I use:
Checkpoint Threat Emulation
Kaspersky Threat Intelligence Sandbox
Comodo Valkyrie
Any.Run
Triage
JoeSandbox
Microsoft ATP Cloud Sandbox
Virus Total Sandbox Tab - Has great info

Sometimes they get bypassed but rarely. In those cases one of them catch the sample in question. Human Analysis combined with Dynamic Execution is King.

If sample is too targeted then we get the guys at Kaspersky, Checkpoint or Microsoft engaged after all OSINT and Intel fails.

 

[likeastar20]

I use:
Checkpoint Threat Emulation
Kaspersky Threat Intelligence Sandbox
Comodo Valkyrie
Any.Run
Triage
JoeSandbox
Microsoft ATP Cloud Sandbox
Virus Total Sandbox Tab - Has great info

Sometimes they get bypassed but rarely. In those cases one of them catch the sample in question. Human Analysis combined with Dynamic Execution is King.

If sample is too targeted then we get the guys at Kaspersky, Checkpoint or Microsoft engaged after all OSINT and Intel fails.

where do you submit for Checkpoint?

 

[Andrezj]

where do you submit for Checkpoint?

enterprise paid, must have checkpoint account and product subscription
same with kaspersky and microsoft

 

[Sandbox Breaker]

where do you submit for Checkpoint?

Threat Emulation Page or Support Portal

 

[Sunshine-boy]

where do you submit for Checkpoint?

it was free before (online demo) but not exist anymore.

 

[Sandbox Breaker]

it was free before (online demo) but not exist anymore.

Yeah we have licenses. It's great because there's no limits. You can zip as many samples and submit them. We have 7 VMs per file that analyze the vm