> For the complete documentation index, see [llms.txt](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/guide/safety-procedures/what-should-i-do-and-use.md).

# What should I do and use?

You know, you are now preparing yourself to test malware samples, so what? Definitely, you will not test these samples on your PC, or will you?

{% hint style="warning" %}
Follow these instructions one by one!
{% endhint %}

## Virtualization and Lab environment

We will be needing the things below:

1. Hyper-Visor (e.g. VirtualBox, VMWare, etc.)
2. 64-bit Windows 10/11 Virtual Machine(s) 
3. 64-bit [REMnux](https://remnux.org/#distro) Virtual Machine(s), follow the installation steps via this link [Install REMnux](https://docs.remnux.org/install-distro/get-virtual-appliance#direct-import)
4. Take a snapshot of the virtual machines, this is important to revert back to the clean installation you have 

## Network and interfaces

Of course, you don't want the malware that you detonate to reach your physical hosts, right? 

Of Course, so you need to configure your virtual machines to not be able to see your physical host, to do so follow the section that explains the steps in the **Hyper-Visor** that you use

### On VMWare

For this we will have a little bit special setup to make sure you are safe from that:

1. Go to `Virtual Network Editor` 
2. Go to `Change Settings` to get more options in administrative mode
3. Press `Add Network` 
4. Select a network to add 
5. Optional: Press on the network and go to `Rename network`
6. For the `VMnet Information` ,  set whatever `subnet IP` you want except for the IPs that are similar to your network IP, I did like in the image below:

<figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FnpDCyp6AwZgkBhUJ2HcA%2Fimage.png?alt=media&amp;token=007863c4-23df-468a-969f-95cd859f86f7" alt=""><figcaption></figcaption></figure>

7. Optional: Edit the network starting and ending IP addresses&#x20;

<figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FjjHgUS2FpdWKvB0hdGpT%2Fimage.png?alt=media&amp;token=3c694219-56d5-4f22-912a-74625b6ec4b3" alt=""><figcaption></figcaption></figure>

8. Click `Apply` then wait for the changes to take effect.
9. Finally, click `ok`

***

## REMnux Setup

1. If you are not logged in, use `remnux` as the username and `malware` as the password
2. Edit your `inetsim` configuration to enable **DNS Service** and enable the tool on all the interfaces, this can be done using the following command:

```bash
sudo nano /etc/inetsim/inetsim.conf
```

3. Scroll down a bit and un-comment the line that mentions the DNS Service in the `main configuration` section:

   <figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FDrI456wWG7DZ8PQ9WMKl%2Fimage.png?alt=media&amp;token=47a9696b-e890-41a8-a11b-5dc9f65eb6e2" alt=""><figcaption></figcaption></figure>
4. Scroll down under the services to find this section, set the `default_bind_address` to `0.0.0.0` to listen on all the interfaces:

<figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FlONuC7vKoeFI0JLUIzdK%2Fimage.png?alt=media&amp;token=43013f51-5df0-4b54-9684-cb095a417928" alt=""><figcaption></figcaption></figure>

5. Then, scroll down to the `Service DNS` section and set the `default_dns_ip` to match the IP address of your `REMnux` machine, here I have the IP address of `10.0.0.3` :

   <figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FgDxbunT0TFNpYKYyuXhc%2Fimage.png?alt=media&amp;token=2c6049b4-611c-4037-9131-237b0915084b" alt=""><figcaption></figcaption></figure>

6. Finally, launch the application by typing `inetsim` in the terminal then press `Enter` , you will find the launched services and one of them is the **DNS Service**:&#x20;

<figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FlAHjSSxcbXY4bKqANC9A%2Fimage.png?alt=media&amp;token=58b39774-8711-48a9-a839-4cd8c021b96a" alt=""><figcaption></figcaption></figure>

***

## Flare-VM installation

* Download Chrome: [`https://www.google.com/chrome/`](https://www.google.com/chrome)
* Download Windows Terminal:
  * Download the VCLibs package. In a PowerShell window, run: `wget https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx -usebasicparsing -o VCLibs.appx`
  * Download the Windows Terminal MSIX bundle from the provided link: `wget https://github.com/microsoft/terminal/releases/download/v1.15.3465.0/Microsoft.WindowsTerminal_Win10_1.15.3465.0_8wekyb3d8bbwe.msixbundle -UseBasicParsing -o winterminal.msixbundle`
  * In a PowerShell admin window, add the VCLibs package: `Add-AppxPackage [C:\path\to\downloaded\VCLibs.appx]`
  * In a PowerShell admin window, run: `Add-AppxPackage [C:\path\to\downloaded\winterminal.msixbundle]`
  * (Optional) Pin Windows Terminal to the task bar
* Disable proxy auto detect setting:
  * In the Windows search bar, search “proxy settings”,
  * Switch "Automatically detect settings" button off
* Disable Tamper Protection
  * Search "Defender", open Defender settings and set all Defender Settings to off
* Disable AV/Defender in GPO
  * In Windows search bar, search "group policy"
  * In GPO, navigate to → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Enable “Turn off Microsoft Defender Antivirus”
* Disable Windows Firewall
  * GPO → Administrative Templates → Network → Network Connections → Windows Defender Firewall → Domain Profile → Disable “Protect All Network Connections”
  * Do the same but for the Standard profile
* TAKE A SNAPSHOT!
* Download and install FLARE-VM:
  * In PowerShell Admin prompt, run: `(New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")`
  * Change directories to the Desktop
  * Run: `Unblock-File .\install.ps1`
  * Run: `Set-ExecutionPolicy Unrestricted`
  * Accept the prompt to set the ExecPol to unrestricted if one appears
  * Run: `.\install.ps1 -customConfig https://raw.githubusercontent.com/HuskyHacks/PMAT-labs/main/config.xml`
  * Follow the rest of the prompts and continue with the installation.
* When the installation is done, TAKE ANOTHER SNAPSHOT!

***

## Windows Setup

1. Install [#flare-vm-installation](#flare-vm-installation "mention")
2. Configure the machine settings to use the interface you set before for this lab
3. Inside the control panel, have your Preferred DNS be pointing at the IP of the `REMnux` machine

   <figure><img src="https://3687673605-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIL0b8wPkvjYvwtuOPCCx%2Fuploads%2FKbXQ5l7OYry4vws6CRiS%2Fimage.png?alt=media&amp;token=01773a06-6653-4b79-841c-ef0cf18e79d5" alt=""><figcaption></figcaption></figure>