Images seem small in the page, but can be clicked to expand.
This project is based on Grant Collins's "Malware Analysis Project". The goal of this project is to statically and dynamically analyze various malwares via virtual machines. The target system will be a virtual machine running the Windows 10 Enterprise operating sytsem with the FLARE-VM software suite installed to provide malware analysis capabilities. We will also be using REMnux in a virtual machine as a C2 server. Below will be documentation regarding the setup for this lab.
To ensure that relevant systems can only communicate with each other and not the internet, a new network adapter is created in Virtualbox. The adapter is set to the home IP address, 10.0.0.1, as seen below.
The server is then configured to be set to 10.0.0.2, with the range of addresses set between 10.0.0.3 and 10.0.0.254, as seen below.
As previously mentioned, our target system will be running the Windows 10 Enterprise operating system. Thus, our first step was obtaining the ISO. To do this, we go on Microsoft's website and download the 64-bit Enterprise ISO.
We then give Virtualbox the ISO, and go through all the standard configuration steps. This includes allocating space (in my case, 75 gigabytes), memory (8 gigabytes), and processors (6 cores).
After this setup, we go through Windows' setup steps. Then, we have our functional virtual machine.
Now, our first steps are ensuring this system is vulnerable by disabling Windows Defender and Firewall. We go into Windows' settings and disable relevant protections, as seen below.
Then, we go into the group policy settings. We proceed to access "Administrative Templates"/"Windows Components"/"Microsoft Defender Antivirus", and then enable the "Turn off Microsoft Defender Antivirus" policy.
Following this, we access "Administrative Templates"/"Network"/"Network Connections"/"Windows Defender Firewall", and then disable the "Protect all network connections" policy within both Domain Profile and Standard Profile.
Now that our machine is vulnerable, we set up a snapshot incase our next steps fail. This functions as a backup for us.
Now, we install FlareVM, which contains all the tools that we need to properly analyze malware. We grab the script from Github, unblock the file, and then run it.
We then install all the tools that we want:
And then wait for it to run before getting our completed target system, as seen below.
This concludes the setup for our target system. We take a snapshot here to have a fall-back once our malware detonates.
As previously mentioned, our C2 server will be the software suite REMnux, built as a virtual appliance. We can get the OVA from their website.
And we provide this to VirtualBox to quickly get our C2 server.
Now that we have our C2 server, we are going to make some changes to make sure it fits our needs. Specifically, configuring INetSim. The first change we make is uncommenting the line that prevents the DNS service from being started, allowing REMnux to impersonate DNS.
Next, we bind services to address 0.0.0.0
Finally, we set the DNS IP address to 10.0.0.4
Now, we have a function C2 server.
Now that our machines are properly set up, we need to ensure that they can communicate with - and only with - each other. To do this, we set the network adapeters to the one established previously.
In our target system, we also establish the DNS to be from the C2 server, the address 10.0.0.4
To test, we can have the machines ping each other, as you can see below.
Thus, our machines are properly in communication. This concludes the setup for this project.