Malware Analysis Lab Setup

# Internal network: guests see each other and nothing else - no host adapter exists
VBoxManage modifyvm "MalwareAnalysis" --nic1 intnet --intnet1 MalwareLab

# Repeat on the INetSim and victim VMs so all three share the same "MalwareLab" segment
VBoxManage modifyvm "INetSim" --nic1 intnet --intnet1 MalwareLab

# Edit vmnetcfg or use Virtual Network Editor
# Create custom VMnet (e.g., VMnet2) for the analysis pair
# Settings:
#   - Host-only type with "Connect a host virtual adapter" UNCHECKED
#     (VMware's closest equivalent to an Internal Network - guests only)
#   - Subnet: 10.0.0.0/24
#   - DHCP disabled

# Assign VMs to this custom network in VM settings

# Install INetSim
sudo apt update && sudo apt install inetsim

# Edit configuration
sudo nano /etc/inetsim/inetsim.conf

# Key settings to modify:
service_bind_address    10.0.0.1
dns_default_ip          10.0.0.1
dns_default_hostname    inetsim

# Enable services
start_service dns
start_service http
start_service https
start_service smtp
start_service pop3
start_service irc

# Start INetSim
sudo inetsim

# Analysis VM only: reduce host controls after snapshotting and isolating the network
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -SubmitSamplesConsent NeverSend

  # Analysis VM only: disable Windows Firewall after confirming no route to your LAN
netsh advfirewall set allprofiles state off

# Install analysis tools via Chocolatey
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

# Install tools (run before isolating network)
choco install -y procexp procmon autoruns wireshark x64dbg.portable

# Take a CLEAN SNAPSHOT before any malware execution
# Name it: "Clean-Baseline-YYYYMMDD"

# Start with a fresh, fully patched Windows 11 VM
# Analysis VM only: follow FLARE VM prerequisites after snapshotting and isolating the host
# Run PowerShell as Administrator:

# Download and run FLARE VM installer
(New-Object net.webclient).DownloadFile(
  'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
  "$env:TEMP\install.ps1"
)
Unblock-File "$env:TEMP\install.ps1"
Set-ExecutionPolicy Unrestricted -Force
& "$env:TEMP\install.ps1"

# Follow prompts - installation takes 1-2 hours
# Take snapshot after installation completes

# CAPE recommends a dedicated Ubuntu 24.04 host or VM
# Full installation guide: https://capev2.readthedocs.io

# Native install from the cloned repository (not a Docker container)
git clone https://github.com/kevoreilly/CAPEv2.git
cd CAPEv2

# Use the provided installer script
sudo ./installer/cape2.sh base
sudo ./installer/cape2.sh cape

# Configure analysis VMs in conf/virtualbox.conf or conf/kvm.conf
# Submit samples via web UI at https://localhost:8443

# Hash a file (PowerShell)
Get-FileHash -Algorithm SHA256 sample.exe

# Hash a file (Linux)
sha256sum sample.exe
md5sum sample.exe

# Extract strings (Linux)
strings -a sample.exe | less
floss sample.exe  # Better string extraction

# Check PE headers (REMnux ships the pefile Python library)
python3 - <<'PY'
import pefile
pe = pefile.PE("sample.exe")
print(hex(pe.FILE_HEADER.Machine))
for section in pe.sections:
    print(section.Name.decode(errors="replace").rstrip("\x00"), hex(section.VirtualAddress))
PY

# Binutils alternative (no extra packages needed)
objdump -x sample.exe | head -40

# Start Wireshark capture
wireshark -i eth0 -k -w capture.pcap

# YARA scan
yara -r rules/ sample.exe