{"id":7179,"date":"2024-02-29T06:56:11","date_gmt":"2024-02-29T06:56:11","guid":{"rendered":"\/cybersecurity-blog\/?p=7179"},"modified":"2025-06-30T14:00:56","modified_gmt":"2025-06-30T14:00:56","slug":"how-to-create-a-sandbox","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-to-create-a-sandbox\/","title":{"rendered":"How to Create a Sandbox Environment (for Malware Analysis)\u00a0"},"content":{"rendered":"\n

Working with malware is quite similar to analyzing dangerous pathogens \u2014 without proper security measures, your sample could escape and cause a potentially harmful infection. That’s why malware hunters utilize sandboxes \u2014 isolated environments where you can safely work with malware. Today, we’ll guide you through all the steps of creating a malware sandbox. <\/p>\n\n\n

\n
\"\"
ANY.RUN is a cloud interactive malware sandbox <\/figcaption><\/figure><\/div>\n\n\n

(Spoiler: you use ANY.RUN<\/a> to replace a local setup in 95% of cases) <\/p>\n\n\n\n

Why do you need a sandbox for malware research? <\/h2>\n\n\n\n

Why do you need a sandbox for malware research? <\/p>\n\n\n\n

The purpose of a sandbox is to execute malicious code and observe its behavior within a controlled environment. This is particularly important when dealing with zero-day exploits, where the malware’s impact and payload are unknown. The sandbox environment is designed to be isolated from the host system, to prevent any compromise of critical infrastructure or even your personal computer. <\/p>\n\n\n\n

When creating a sandbox, there are two main approaches you can take: <\/p>\n\n\n\n

    \n
  1. Build a custom sandbox from scratch. <\/li>\n<\/ol>\n\n\n\n
      \n
    1. Use a turnkey solution.  <\/li>\n<\/ol>\n\n\n\n

      Both options are valid. What\u2019s more, they can be utilized within the same research session for different purposes: <\/p>\n\n\n\n

      Custom sandbox: <\/strong>This approach allows you to bring your own tools into the environment, such as debuggers, disassemblers, and packet sniffers. However, setting up a custom sandbox requires a configuration process. You will need to create multiple VM instances with different operating systems: Windows 10 64-bit, Windows 10 32-bit sandbox, Windows 11, and so on. It takes a lot of time. <\/p>\n\n\n\n

      Turn-key solution: <\/strong>Come with all the necessary analysis tooling pre-installed and conveniently located in one place. They make it extremely simple to launch new analysis sessions and change the OS configuration whenever needed and then \u2014 collect IOCs that the malware left behind during execution.<\/p>\n\n\n

      \n
      \"\"
      ANY.RUN<\/a> is an example of a turnkey sandbox  <\/figcaption><\/figure><\/div>\n\n\n

      For example, ANY.RUN (above) offers an interactive virtual machine that you can launch directly in the browser. The service comes with a powerful analysis toolkit; You can easily: <\/p>\n\n\n\n