Any.Run is an Interactive Online Malware Analysis Tool

Any.Run is a malware analysis tool or scanner that allows users to play with malware and viruses in a secure environment. This interactive tool allows both dynamic and static research on Windows; it analyses the events that happen during task execution, not the file itself. Two weeks ago, the free community version of this tool was opened to the public.

Any.Run – An Online Malware Analysis Tool

Any.Run is founded by security researcher Alexey Lapshin. His team now comprises of five developers who work on advancing the platform.  This tool is unique from other sandbox analysis tools because it is interactive. It implies that instead of uploading a file and waiting for a sandbox to spit out a report, Any.Run allows the users to simply upload a file and have real-time interactions with the sandbox while it analyses the file. Note, no installation is needed.

Simply put, Any.Run allows you to interactively watch the investigation process and make adjustments when needed, just like you would do it on a real system, rather than depending on an automated sandbox.

Using Any.Run is very simple.

Step 1 – Click On New Task

First, click on the new task icon which displays on the basic task dialog.

Step 2 – Set Up A New Analysis Task

The users can set up a new task by going to the advanced mode to:

1. Select the file or URL that needs to be analyzed
2. Select the operating system (Windows 7/8.1/10/11) for the sandbox
3. Choose connectivity options
4. Select software that should be preloaded
5. Define the duration of the interactive session

Step 3: Launch Sandbox

Click the ‘Run” button when ready. Any.Run will start building the configured environment, display the sandbox environment which the users can interact with, and then launch the requested program.

Step4: Monitor Application Activity

Once launched, the users can interact with the desktop, click on buttons, open the start menu and user browsers, open the registry editor, open the task manager, and run applications just like they would normally do. The only difference is that the sandbox would record all the network requests, process calls, file activity, and registry activities.

This way, users can view any network requests, processes being created, and file activity in real-time. For detailed network request information, users can click on it to see the request and the response. Users can also click on a launched process to see which files have been modified, what registry changes were made, which libraries were used, and more.

Any.Run’s Free Community Version Has A Few Limitations

• It only supports Windows 7 32-bit as a virtual environment, which means users cannot use it to analyze the behavior of 64-bit files in that version.
• The maximum file size is set to 16 Megabyte.
• Any file that is uploaded to the service can be downloaded by anyone, making confidentiality an issue.

Irrespective of the fact that Any.Run has a few limitations it still is a good option for those who want to analyze a few files before they can run it on their machines.