Building a Malware Analysis lab

Hey folks, today I’ll be writing about the creation of your first Malware analysis home lab. First of all, this is not the only way to do the home lab, but, in my opinion, it’s the easiest one.

It is very important to have a safe computer where you can create the home lab, because errors can occur, and won’t be a good result if the malware escapes into your personal computer or the company one. Besides that, it’s also important to use a different network in the host machine due to the same reason.

So let’s start our journey!!! First things first, you’ll need a virtualization software, at this document we’ll be using VirtualBox

VirtualBox installation packages for each OS

After downloading and installing VBox you’ll need to download the OVA file of Remnux, this VM will be our network analysis platform, helping the analysts with network based indicators, running wireshark, internet simulator, and so on. Besides Remnux, you’ll need to install Flare VM to gather the host based indicators of the malware.

Installing Remnux

https://docs.remnux.org/install-distro/get-virtual-appliance

After the download, you’ll import the .ova file into VBox and start the installation. When the Virtual Machine ends its installation, the most important setting you need to take care is the network, but we’re talk about this latter in a different article.

Ipmport REMnux .ova file into VBox

INSTALLING WINDOWS 10 PRO

If you don’t have any idea about what is flare-vm, you can imagine that this virtual machine will be your swiss army knife, for malware analysis. It’s based on a Windows OS, firstly we need to download a windows ISO for our VBox.

I’ll be using here the Windows 10 pro ISO, because this instance allows the user to use administrative configurations into de GPO, and we need this “power” to correctly deactivate the Windows Defender and firewall. To have the Windows 10 Pro ISO, you’ll need to download the Media Creation Tool.

https://www.microsoft.com/en-us/software-download/windows10?msockid=372f1c1a6a986ccd0bd00a5c6bce6d0b

Bellow is how the file should looks like at your computer

Downloaded file

Accept

Bellow it’s a very important step, click on the second option “Create installation media (pen drive, DVD or ISO file) for another computer”

After those steps, you’ll have the ISO file. At this point, you’ll need to open your VBox and select the “new” option to start the windows installation. At the hardware section, you want to allocate the minimum of 5000MB of base memory and 2 CPU cores, after that, in the Disk section, you should allocate at least 80GB of space.

Creating the Virtual Machine

Creating the Virtual Machine

Creating the Virtual Machine

Now I’ll be presenting a quick step-by-step of the Windows 10 configuration

After the initial installation, we want to see this at our VBox left corner

Malware_analysis VM

Double click on it

choose the option that best fit for you

“I don’t have a product key”

Windows 10 Pro

Advanced option

Split the partitions

this process takes a while

After this, the Windows OS will start the final steps

Personal Use

Offline account

privacy settings

you made it!!!

Now Let’s make your life easier, this settings bellow are opitional, their goal is to make the screen bigger and better to work.

Insert Guest additional CD image

Double click on it

Double click on it

After those steps you’ll have finished the first task, so you’ll need to take your first snapshot, to save the basic configuration of Windows 10 pro.

Create snapshot

Flare-VM Installation

First of all, we need to deactivate the security of our Windows 10 pro.

step 1: disable the proxy settings

proxy settings

Turn it off

step 2: Turn off the Virus & Threat Protection

Virus & Threat Protection deactivation

Click on “Manage Settings”

Turn off everything

Step 3: Edit Group Policies

group policy

Windows Components

Microsoft Defender Antivirus

It’s a non intuitive configuration, but you’ll need to turn on the rule below

Enable the “turn off Microsoft Defender Antivirus”

Then you’ll come back to the “Administrative Templates” and choose “Network”

Network

Network Connections

You’ll need to make changes at the Domain and Standard Profile, let’s begin with the first one:

Windows Defender Firewall

Double click on it and Disable the rule

Double click on it and Disable the rule

Take another snapshot, and then install the flare-vm

Credits to the TCM PMAT course

With the Flare-VM and the REMnux installed, we have accomplished our first step of building a malware analysis homelab. In the next article, we’re gonna talk about the network settings for the environment be safe to deploy malware.