Detonate File - Cuckoo

Detonating file with Cuckoo

Cuckoo Sandbox · 10 tasks · 3 inputs · 32 outputs

Details

IDDetonate File - Cuckoo
From Version5.0.0
Tasks10

README

Detonates a file with Cuckoo.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

  • Sleep

Commands

  • cuckoo-get-task-report
  • cuckoo-task-screenshot
  • cuckoo-create-task-from-file
  • cuckoo-view-task

Playbook Inputs

Name Description Default Value Required
File The file to detonate. ${File} Optional
interval How often to poll for results. 1 Optional
timeout How long to wait before giving up waiting for results. 10 Optional

Playbook Outputs

Path Description Type
Cuckoo.Task.Category The category of the task. unknown
Cuckoo.Task.Machine The machine of the task. unknown
Cuckoo.Task.Errors The errors of the task. unknown
Cuckoo.Task.Traget The traget of the task. unknown
Cuckoo.Task.Package The package of the task. unknown
Cuckoo.Task.SampleID The sample ID of the task. unknown
Cuckoo.Task.Guest The task of the guest. unknown
Cuckoo.Task.Custom The custom values of the task. unknown
Cuckoo.Task.Owner The task of the owner. unknown
Cuckoo.Task.Priority The priority of the task. unknown
Cuckoo.Task.Platform The platform of the task. unknown
Cuckoo.Task.Options The task of the options. unknown
Cuckoo.Task.Status The task of the status. unknown
Cuckoo.Task.EnforceTimeout Whether the timeout of the task is enforced. unknown
Cuckoo.Task.Timeout The task timeout. unknown
Cuckoo.Task.Memory The task memory. unknown
Cuckoo.Task.Tags The task tags. unknown
Cuckoo.Task.ID The ID of the task. unknown
Cuckoo.Task.AddedOn The date the task was added. unknown
Cuckoo.Task.CompletedOn The date the task was completed. unknown
Cuckoo.Task.Score The reported score of the task. unknown
Cuckoo.Task.Monitor The monitor of the reported task. unknown
File.Size The size of file. unknown
File.SHA1 The file’s SHA1 hash of the file. unknown
File.SHA256 The file’s SHA256 hash of the file. unknown
File.Name The file’s name. unknown
File.SSDeep The file’s SSDeep hash of the file. unknown
File.EntryID The file’s entry ID. unknown
File.Info The file’s info. unknown
File.Type The file’s type. unknown
File.MD5 The file’s MD5 hash of the file. unknown
File.Extension The file’s extension. unknown

Playbook Image

Detonate_File_Cuckoo

Inputs

  • File — The file to detonate
  • interval — How often to poll for results
  • timeout — How long to wait before giving up waiting for results

Outputs

  • Cuckoo.Task.Category — Category of task
  • Cuckoo.Task.Machine — Machine of task
  • Cuckoo.Task.Errors — Errors of task
  • Cuckoo.Task.Traget — Traget of task
  • Cuckoo.Task.Package — Package of task
  • Cuckoo.Task.SampleID — Sample ID of task
  • Cuckoo.Task.Guest — Task guest
  • Cuckoo.Task.Custom — Custom values of task
  • Cuckoo.Task.Owner — Task owner
  • Cuckoo.Task.Priority — Priority of task
  • Cuckoo.Task.Platform — Platform of task
  • Cuckoo.Task.Options — Task options
  • Cuckoo.Task.Status — Task status
  • Cuckoo.Task.EnforceTimeout — Is timeout of task enforced
  • Cuckoo.Task.Timeout — Task timeout
  • Cuckoo.Task.Memory — Task memory
  • Cuckoo.Task.Tags — Task tags
  • Cuckoo.Task.ID — ID of task
  • Cuckoo.Task.AddedOn — Date on which the task was added
  • Cuckoo.Task.CompletedOn — Date on which the task was completed
  • Cuckoo.Task.Score — Reported score of the the task
  • Cuckoo.Task.Monitor — Monitor of the reported task
  • File.Size — Size of file
  • File.SHA1 — File's SHA1
  • File.SHA256 — File's SHA256
  • File.Name — File's name
  • File.SSDeep — File's SSDeep
  • File.EntryID — File's entry id
  • File.Info — File's info
  • File.Type — File's type
  • File.MD5 — File's MD5
  • File.Extension — File's Extension

Commands used

cuckoo-create-task-from-file cuckoo-get-task-report cuckoo-task-screenshot cuckoo-view-task

Flowchart

yes yes Start Start GenericPolling - GenericPolling GenericPolling GenericPolling Is there any active Cuckoo instance? Is there any active Cucko... Is there any file to detonate? Is there any file to deto... Send file to Cuckoo - cuckoo-create-task-from-file Send file to Cuckoo cuckoo-create-task-from-file Done Done Get task report - cuckoo-get-task-report Get task report cuckoo-get-task-report Sleep (let the sandbox create the task) - Sleep Sleep (let the sandbox cr... Sleep View task - cuckoo-view-task View task cuckoo-view-task Get Screenshots - cuckoo-task-screenshot Get Screenshots cuckoo-task-screenshot

Source

playbook-Detonate_File_-_Cuckoo.yml
Download History Raw 
id: Detonate File - Cuckoo
version: -1
name: Detonate File - Cuckoo
description: "Detonating file with Cuckoo"
fromversion: "5.0.0"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c1de2f2b-64cb-4df5-8490-07c49e7255b6
    type: start
    task:
      description: start
      id: c1de2f2b-64cb-4df5-8490-07c49e7255b6
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
  "1":
    id: "1"
    taskid: edb32e9f-570f-4418-8522-b121f7bd5233
    type: playbook
    task:
      id: edb32e9f-570f-4418-8522-b121f7bd5233
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        simple: ${Cuckoo.Task.ID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: id
      PollingCommandName:
        simple: cuckoo-view-task
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: Cuckoo.Task(val.CompletedOn == null).ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
  "3":
    id: "3"
    taskid: c8400cff-bb6a-4ba7-8032-69e0322c54cf
    type: condition
    task:
      description: Check for active instance
      id: c8400cff-bb6a-4ba7-8032-69e0322c54cf
      version: -1
      name: Is there any active Cuckoo instance?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cuckoo Sandbox
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
  "4":
    id: "4"
    taskid: 087ea815-c0b4-4604-8b43-099927639fa9
    type: condition
    task:
      description: Check if file exist
      id: 087ea815-c0b4-4604-8b43-099927639fa9
      version: -1
      name: Is there any file to detonate?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.File
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
  "6":
    id: "6"
    taskid: 4d966bd6-db01-4c5f-8cb3-da14e5f1058b
    type: regular
    task:
      description: send file to Cuckoo
      id: 4d966bd6-db01-4c5f-8cb3-da14e5f1058b
      version: -1
      name: Send file to Cuckoo
      script: '|||cuckoo-create-task-from-file'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      enforce_timeout: {}
      entryID:
        simple: ${inputs.File.EntryID}
      fileID: {}
      machine: {}
      memory: {}
      options: {}
      package: {}
      platform: {}
      tags: {}
      timeout: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
  "7":
    id: "7"
    taskid: b5eb756b-903d-4f8e-8b09-f8bcad28627c
    type: title
    task:
      description: Done
      id: b5eb756b-903d-4f8e-8b09-f8bcad28627c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
  "8":
    id: "8"
    taskid: f1f53022-58b9-4d86-82f1-89ef2b0d7da2
    type: regular
    task:
      description: get task report
      id: f1f53022-58b9-4d86-82f1-89ef2b0d7da2
      version: -1
      name: Get task report
      script: '|||cuckoo-get-task-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
  "9":
    id: "9"
    taskid: d2d7357c-0e0f-472f-89fd-e2ac9d46bcc4
    type: regular
    task:
      description: sleep
      id: d2d7357c-0e0f-472f-89fd-e2ac9d46bcc4
      version: -1
      name: Sleep (let the sandbox create the task)
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
  "10":
    id: "10"
    taskid: fb2f1eb0-0d65-4367-8df7-40a015704047
    type: regular
    task:
      description: view task
      id: fb2f1eb0-0d65-4367-8df7-40a015704047
      version: -1
      name: View task
      script: '|||cuckoo-view-task'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
  "11":
    id: "11"
    taskid: c530de05-cebe-438a-81f8-9c19f317cbbe
    type: regular
    task:
      id: c530de05-cebe-438a-81f8-9c19f317cbbe
      version: -1
      name: Get Screenshots
      script: '|||cuckoo-task-screenshot'
      type: regular
      iscommand: true
      description: "Get screenshots from the machine running the file"
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
      screenshot: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1420
        }
      }
    note: false
view: |-
  {
    "linkLabelsPosition": {
      "4_6_yes": 0.89
    },
    "paper": {
      "dimensions": {
        "height": 1610,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: File
  value:
    simple: ${File}
  required: false
  description: The file to detonate
- key: interval
  value:
    simple: "1"
  required: false
  description: How often to poll for results
- key: timeout
  value:
    simple: "10"
  required: false
  description: How long to wait before giving up waiting for results
outputs:
- contextPath: Cuckoo.Task.Category
  description: Category of task
- contextPath: Cuckoo.Task.Machine
  description: Machine of task
- contextPath: Cuckoo.Task.Errors
  description: Errors of task
- contextPath: Cuckoo.Task.Traget
  description: Traget of task
- contextPath: Cuckoo.Task.Package
  description: Package of task
- contextPath: Cuckoo.Task.SampleID
  description: Sample ID of task
- contextPath: Cuckoo.Task.Guest
  description: Task guest
- contextPath: Cuckoo.Task.Custom
  description: Custom values of task
- contextPath: Cuckoo.Task.Owner
  description: Task owner
- contextPath: Cuckoo.Task.Priority
  description: Priority of task
- contextPath: Cuckoo.Task.Platform
  description: Platform of task
- contextPath: Cuckoo.Task.Options
  description: Task options
- contextPath: Cuckoo.Task.Status
  description: Task status
- contextPath: Cuckoo.Task.EnforceTimeout
  description: Is timeout of task enforced
- contextPath: Cuckoo.Task.Timeout
  description: Task timeout
- contextPath: Cuckoo.Task.Memory
  description: Task memory
- contextPath: Cuckoo.Task.Tags
  description: Task tags
- contextPath: Cuckoo.Task.ID
  description: ID of task
- contextPath: Cuckoo.Task.AddedOn
  description: Date on which the task was added
- contextPath: Cuckoo.Task.CompletedOn
  description: Date on which the task was completed
- contextPath: Cuckoo.Task.Score
  description: Reported score of the the task
- contextPath: Cuckoo.Task.Monitor
  description: Monitor of the reported task
- contextPath: File.Size
  description: Size of file
- contextPath: File.SHA1
  description: File's SHA1
- contextPath: File.SHA256
  description: File's SHA256
- contextPath: File.Name
  description: File's name
- contextPath: File.SSDeep
  description: File's SSDeep
- contextPath: File.EntryID
  description: File's entry id
- contextPath: File.Info
  description: File's info
- contextPath: File.Type
  description: File's type
- contextPath: File.MD5
  description: File's MD5
- contextPath: File.Extension
  description: File's Extension
tests:
- CuckooTest