-
-
- Any.Run Sandbox
-
-
-
-
- - Score:
- {{content.analysis.scores.verdict.score}}/100
- - Threat Score:
- - {{content.analysis.scores.verdict.threatLevelText}}
- - Tags:
- {{tag.tag}}
-
-
-
-
-
-
-
Counters
-
-
-
Registry
-
- - Read:
- {{content.counters.registry.read}}
- - Write:
- {{content.counters.registry.write}}
- - Delete:
- {{content.counters.registry.delete}}
- - Total:
- {{content.counters.registry.total}}
-
-
-
-
Processes
-
- - Monitored:
- {{content.counters.processes.monitored}}
- - Suspicious:
- {{content.counters.processes.suspicious}}
- - Malicious:
- {{content.counters.processes.malicious}}
- - Total:
- {{content.counters.processes.total}}
-
-
-
-
Files
-
- - Text:
- {{content.counters.files.text}}
- - Suspicious:
- {{content.counters.files.suspicious}}
- - Malicious:
- {{content.counters.files.malicious}}
- - Unknown:
- {{content.counters.files.unknown}}
-
-
-
-
Network
-
- - Dns:
- {{content.counters.network.dns}}
- - Http:
- {{content.counters.network.http}}
- - Connections:
- {{content.counters.network.connections}}
- - Threats:
- {{content.counters.network.threats}}
-
-
-
-
-
-
-
Scores
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Any.Run Sandbox Error
-
-
-
- - Error:
- - {{content.errorMessage}}
-
-
-
\ No newline at end of file
diff --git a/thehive-templates/AnyRun_Sandbox_Analysis_1_0/short.html b/thehive-templates/AnyRun_Sandbox_Analysis_1_0/short.html
deleted file mode 100644
index 3dfae10bf..000000000
--- a/thehive-templates/AnyRun_Sandbox_Analysis_1_0/short.html
+++ /dev/null
@@ -1,3 +0,0 @@
-
- {{t.namespace}}:{{t.predicate}}="{{t.value}}"
-
diff --git a/thehive-templates/AnyRun_Sandbox_File_Android_1_0/long.html b/thehive-templates/AnyRun_Sandbox_File_Android_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_File_Android_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_Sandbox_File_Linux_1_0/long.html b/thehive-templates/AnyRun_Sandbox_File_Linux_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_File_Linux_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_Sandbox_File_Windows_1_0/long.html b/thehive-templates/AnyRun_Sandbox_File_Windows_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_File_Windows_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_Sandbox_URL_Android_1_0/long.html b/thehive-templates/AnyRun_Sandbox_URL_Android_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_URL_Android_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_Sandbox_URL_Linux_1_0/long.html b/thehive-templates/AnyRun_Sandbox_URL_Linux_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_URL_Linux_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_Sandbox_URL_Windows_1_0/long.html b/thehive-templates/AnyRun_Sandbox_URL_Windows_1_0/long.html
new file mode 100644
index 000000000..363a0e494
--- /dev/null
+++ b/thehive-templates/AnyRun_Sandbox_URL_Windows_1_0/long.html
@@ -0,0 +1,236 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Sandbox Analysis Report
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.verdict || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
MITRE ATT&CK
+
+ {{ m.trim() }}
+
+
+
+
+
+
+
+ Main Object: {{ content.mainObject.type }}
+
+
+
+
+
+ URL:
+
+
+ {{ content.mainObject.url }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.mainObject.hashes.sha256 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.mainObject.hashes.md5 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.mainObject.hashes.sha1 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.mainObject.hashes.ssdeep }}
+
+
+
+
+
+
+
Execution Activity
+
+
+
+
+
+
Processes
+
+
+
+ Total: {{ content.counters.processes.total || 0 }}
+
+
+ Monitored: {{ content.counters.processes.monitored || 0 }}
+
+
+ Suspicious: {{ content.counters.processes.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.processes.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Network
+
+
+
+ Connections: {{ content.counters.network.connections || 0 }}
+
+
+ HTTP Reqs: {{ content.counters.network.http || 0 }}
+
+
+ DNS Reqs: {{ content.counters.network.dns || 0 }}
+
+
+ Threats: {{ content.counters.network.threats || 0 }}
+
+
+
+
+
+
+
+
+
+
Files
+
+
+
+ Text: {{ content.counters.files.text || 0 }}
+
+
+ Unknown: {{ content.counters.files.unknown || 0 }}
+
+
+ Suspicious: {{ content.counters.files.suspicious || 0 }}
+
+
+ Malicious: {{ content.counters.files.malicious || 0 }}
+
+
+
+
+
+
+
+
+
+
Registry
+
+
+
+ Total Events: {{ content.counters.registry.total || 0 }}
+
+
+ Read: {{ content.counters.registry.read || 0 }}
+
+
+ Write: {{ content.counters.registry.write || 0 }}
+
+
+ Delete: {{ content.counters.registry.delete || 0 }}
+
+
+
+
+
+
+
Related Entities
+
+
+
+
+
Domains
+
+ {{ dom.trim() }}
+
+
+
+
IP Addresses
+
+ {{ ip.trim() }}
+
+
+
+
URLs
+
+ {{ url.trim() }}
+
+
+
+
+
+
+
diff --git a/thehive-templates/AnyRun_TI_Lookup_1_0/long.html b/thehive-templates/AnyRun_TI_Lookup_1_0/long.html
new file mode 100644
index 000000000..55e0a5107
--- /dev/null
+++ b/thehive-templates/AnyRun_TI_Lookup_1_0/long.html
@@ -0,0 +1,268 @@
+
+
+ {{ artifact.data }}
+
+
+ Execution Error: {{ errorMessage }}
+
+
+
+
+
+
+
+
+ ANY.RUN Threat Intelligence Lookup
+
+
+
+
+
+
+
+
+
+
+ Verdict: {{ content.treat_level || 'Unknown' }}
+
+
+
+
+ {{ t.trim() }}
+
+
+
+
+
+
+
+
+ Main Object
+
+
+
+
+
+ Object:
+
+
+ {{ content.detected_type }}
+
+
+
+
+
+ Name:
+
+
+ {{ content.filename }}
+
+
+
+
+
+ Last Seen:
+
+
+ {{ content.last_seen }}
+
+
+
+
+
+ GEO:
+
+
+ {{ content.geo }}
+
+
+
+
+
+ ASN:
+
+
+ {{ content.asn }}
+
+
+
+
+
+
+
+ Path:
+
+
+ {{ content.filepath }}
+
+
+
+
+
+ SHA256:
+
+
+ {{ content.sha256 }}
+
+
+
+
+
+ SHA1:
+
+
+ {{ content.sha1 }}
+
+
+
+
+
+ MD5:
+
+
+ {{ content.md5 }}
+
+
+
+
+
+ SSDEEP:
+
+
+ {{ content.ssdeep }}
+
+
+
+
+
+
+ Risk score by industry
+
+
+
+ {{ ind.trim() }}
+
+
+
+
+ Intelligence Context
+
+
+
+
+
+
+ Related URLs ({{ content.related_urls.length }})
+
+
+
+
+
+ | URL |
+ Verdict |
+ Date |
+ Threat Name |
+ Malconf |
+
+
+
+
+ | {{ pU }} |
+
+ Malicious
+ Suspicious
+ Info
+ |
+ {{ pD }} |
+
+ {{ pN }}-
+ |
+
+ Yes-
+ |
+
+
+
+
+
+
+
+
+
+
+ Related IPs ({{ content.related_ips.length }})
+
+
+
+
+
+ | IP Address |
+ Verdict |
+ Date |
+ Threat Name |
+ Malconf |
+
+
+
+
+ | {{ pI }} |
+
+ Malicious
+ Suspicious
+ Info
+ |
+ {{ pD }} |
+
+ {{ pN }}-
+ |
+
+ Yes-
+ |
+
+
+
+
+
+
+
+
+
+
+ Recent ANY.RUN Sandbox Analysis
+
+
+
+
+
+
+
+