# Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques
## 6 Comparison between MORRIGU and Cuckoo  
To further support the utilisation of MORRIGU, we perform a comparison against existing malware analysis platforms. Cuckoo Sandbox is widely used by researchers for malware analysis, and allows for monitoring of virtualised environments using an agent plug-in. As a key comparison between the two environments, Cuckoo is recognised to require extensive configuration in order to make this usable for analysis, and so there is a steep learning curve required before analysts can utilised the environment. There is significant documentation available on Cuckoo; however, to quote the documentation: _\"Cuckoo is not meant to be a point-and-click tool: it's designed to be a highly customizable and configurable solution for somewhat experienced users and malware analysts.\"_ To be able to fully utilise Cuckoo Sandbox an end-user needs to go through setup for both the host machine, the guest machine (which will be used to run the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{3}{c}{**Configuration Options**} & \\ \multirow{2}{*}{**Malware Classification**} & **Guest** & **Time** & **Reverse** & **Registry** & **Common** & **Sample** \\  & **Additions** & **Jump** & **Turing** & **Edit** & **Artefacts** & **Count** \\  & **Uninstalled** & & **Test** & & **1** & **1** \\ \hline Adware & & & 8 & 4 & 1 & **11** \\ Banking Trojan & & & 2 & 1 & & **3** \\ Bot Net & 1 & & & & **1** \\ Cryptocurrency Miner & 1 & & & & **1** \\ DGA & & & 1 & 1 & & **2** \\ Ransomware & 1 & 1 & 1 & & & **4** \\ Trojan Downloader & 4 & & 1 & 1 & & **6** \\ Trojan Infostealer & 5 & 3 & 5 & & **12** \\
**Total** & **12** & **4** & **18** & **8** & **2** & **40** \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Results from 40 evasive malware samples to show the anti-evasion configurations required to trigger a malicious response against each of the 8 malware classification types that utilise evasion. malware samples) and the virtual network setup that links the two. By comparison MORRIGU is designed as a point-and-click tool. Once the server is started, the system performs the network setup automatically and all configuration options can be managed through the GUI. Cuckoo is highly customisable however it often requires command line interface (CLI) and manually configuration through the use of configuration files. MORRIGU is designed to be user-friendly with a lower barrier to entry for researchers new to malware analysis. Regarding analysis, Cuckoo is designed to execute a malware sample against the environment for a given period of time, and then terminate this environment, which is also the same approach adopted by MORRIGU. However, MORRIGU will then perform multiple iterations of the same test with different configuration parameters, and the results are visualised using the visual analytics tools to observe whether there is deviation in behaviours. Cuckoo is designed to provide a score between 0 and 10 for each sample, based on a predefined signature rule-based system. Cuckoo documentation suggests that these can be treated as three classifications: low (0-4), medium (4-7) or high (7-10). However, as reported by [PERSON] et al. [37] this scoring classification can be misleading due to the underlying methodology of severity classification. They suggest that greater emphasis is required on analysing the behaviour of the malware, which is the objective of MORRIGU. Using the generated visual analytics, system metrics can be visualised and contextualised to highlight key network and process activity in a manner that Cuckoo does not currently provide. Furthermore, Cuckoo currently only offers limited anti-evasion methods, such as randomised mouse movement, which could easily be identified by evasive malware. MORRIGU is specifically designed to focus on the analysis of anti-evasion methods, and provides a flexible manner for extending this through the use of PowerShell scripting given the continually evolving nature of malware analysis and malware development.