{
  "sandbox": {
    "name": "malware-analysis-sandbox",
    "version": "1.0",
    "description": "Template configuration for malware analysis sandbox"
  },
  "vm": {
    "platform": "virtualbox",
    "os": "windows10_x64",
    "memory_mb": 4096,
    "cpus": 2,
    "disk_gb": 60,
    "snapshot_name": "clean_baseline",
    "network_mode": "hostonly",
    "network_adapter": "vboxnet0"
  },
  "anti_detection": {
    "modify_bios_vendor": true,
    "modify_system_product": true,
    "disable_paravirt": true,
    "randomize_mac": true,
    "modify_disk_serial": true,
    "realistic_hostname": true,
    "realistic_username": true,
    "install_common_software": true,
    "populate_documents": true,
    "set_wallpaper": true,
    "simulate_browser_history": true
  },
  "monitoring": {
    "process": {
      "enabled": true,
      "track_children": true,
      "track_injection": true,
      "record_cmdline": true,
      "record_resource_usage": true,
      "polling_interval_ms": 500
    },
    "filesystem": {
      "enabled": true,
      "watch_paths": [
        "C:\\Windows\\Temp",
        "C:\\Users\\analyst\\AppData",
        "C:\\Users\\analyst\\Desktop",
        "C:\\Users\\analyst\\Documents",
        "C:\\Users\\analyst\\Downloads",
        "C:\\ProgramData",
        "C:\\Windows\\System32\\drivers",
        "C:\\Windows\\System32\\Tasks"
      ],
      "recursive": true,
      "track_created": true,
      "track_modified": true,
      "track_deleted": true,
      "track_renamed": true,
      "hash_new_files": true,
      "max_depth": 5
    },
    "registry": {
      "enabled": true,
      "watch_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
        "HKLM\\SYSTEM\\CurrentControlSet\\Services",
        "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",
        "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options"
      ]
    },
    "network": {
      "enabled": true,
      "capture_packets": true,
      "capture_filter": "",
      "log_dns": true,
      "log_http": true,
      "log_tls_handshake": true,
      "max_pcap_size_mb": 500,
      "rotate_pcap": true
    },
    "api_calls": {
      "enabled": true,
      "categories": [
        "process_creation",
        "process_injection",
        "file_operations",
        "registry_operations",
        "network_operations",
        "crypto_operations",
        "anti_analysis",
        "privilege_escalation",
        "service_operations"
      ]
    }
  },
  "execution": {
    "timeout_seconds": 300,
    "min_runtime_seconds": 120,
    "simulate_user_activity": true,
    "human_interaction": {
      "move_mouse": true,
      "click_dialogs": true,
      "type_input": false
    },
    "trigger_methods": [
      "direct_execution",
      "rundll32",
      "regsvr32",
      "powershell",
      "cmd_shell"
    ]
  },
  "network_simulation": {
    "enabled": true,
    "backend": "inetsim",
    "inetsim_host": "10.10.0.1",
    "fake_dns": true,
    "dns_default_ip": "10.10.0.1",
    "services": {
      "http": { "port": 80, "enabled": true },
      "https": { "port": 443, "enabled": true },
      "dns": { "port": 53, "enabled": true },
      "smtp": { "port": 25, "enabled": true },
      "ftp": { "port": 21, "enabled": true },
      "irc": { "port": 6667, "enabled": true }
    }
  },
  "output": {
    "directory": "./analysis_results",
    "formats": ["json", "html"],
    "include_pcap": true,
    "include_dropped_files": true,
    "include_memory_dumps": true,
    "include_screenshots": true,
    "screenshot_interval_seconds": 10,
    "generate_timeline": true
  }
}