decrypting…# 🦠Provisioning A Malware Lab 🖥️🧪 #KA #MA ### 😕 Flare, what is it? Flare VM is a specialized toolkit developed by FireEye's Mandiant team for malware analysis on Windows systems. It provides a suite of tools for reverse engineering and understanding malware, including debuggers like OllyDbg and x64dbg, disassemblers like IDA Pro, and the network analyser Wireshark. It is designed to be used in a virtual machine environment, making it a safe and isolated platform for malware analysts. The toolkit simplifies the setup process through a straightforward installation and a package management system for easy updates and maintenance of tools. Flare VM is ideal for professionals in cybersecurity, particularly those focused on analysing malicious software. #### Prerequisites - Hypervisor - In this walkthrough we will use Virtual box by oracle - https://www.virtualbox.org/ - Windows 10 ISO Image - can be downloaded from - https://www.microsoft.com/en-gb/software-download/windows10 - REMnux ova Image - can be downloaded from - https://app.box.com/s/am8a5gmibsw8dj6xn2x0thxes6a46bp6 ## Step 1 - Installing Windows VM Create a standard Windows 10 Virtual Machine using your Hypervisor of choice > Tip: Install the guest editions CD image to allow for Dynamic Scaling of your VM window and bi-lateral copy and paste Recommended Specs - RAM MIN: 2GB REC: 8GB - Storage MIN: 60GB REC: 100GB - Processors MIN: 1 REC: 2 Install Google Chrome - [Google Chrome](https://www.google.com/chrome/) After Creating This Machine **Take a Snapshot** of the machine, This will be used as our pre-Flare VM snapshot in case installation fails ## Step 2 - Installing REMnux (Linux Malware Analysis) Import the REMnux ova file into Oracle box & create a separate REMnux Virtual Machine This machine comes pre-configured with standard specifications that are light and manageable by most machines ## Step 3 - Installing Flare (Windows Malware Analysis) ### Preparing the install Open an Administrator PowerShell Window Conduct all commands from the Windows desktop, therefore Change Current Directory to Desktop using: ```bash cd ~/Desktop ``` #### Install The Windows Terminal (NOT REQUIRED) > This step is not essential but can prove to be very helpful Windows Terminal is a modern terminal application that enhances the functionality of traditional command-line interfaces like CMD and PowerShell by supporting multiple tabs, extensive customization, and integration of various shells in a single interface. It offers a modern UI with GPU-accelerated text rendering, advanced features like emoji support, and richer customization options compared to the basic interfaces of CMD and PowerShell. Windows Terminal allows for the seamless use of different command-line environments simultaneously and is designed to improve productivity and user experience for developers and IT professionals. First we need to install the VCLibs Package from Microsoft using: ```bash wget https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx -usebasicparsing -o VCLibs.appx ``` The we need to install the Windows Terminal MSIX bundle using: ```bash wget https://github.com/microsoft/terminal/releases/download/v1.15.3465.0/Microsoft.WindowsTerminal_Win10_1.15.3465.0_8wekyb3d8bbwe.msixbundle -UseBasicParsing -o winterminal.msixbundle ``` Then we need to add the VCLibs Package, using: ```bash Add-AppxPackage VCLibs.appx ``` Then we need to add the the terminal package, using: ```bash Add-AppxPackage winterminal.msixbundle ``` #### Disable Anti-Virus & Proxy Proxy settings and Windows antivirus can impede malware analysis by blocking or altering malware's network communication and automatically deleting or quarantining the malware samples. To conduct effective analysis, researchers often disable antivirus and use isolated environments, such as virtual machines, to prevent these tools from interfering with the natural behaviour of malware. - **Disabling Proxy** Search for "Proxy Settings" Within the Windows search bar Disable the "Automatically detect settings" Option - **Disabling Anti-Virus** Search for "Defender" Within the Windows search bar - Go to the Windows Security application Go To the "Virus & threat protection" tab Within the "Virus & threat protection" section on the page **Click** on "Manage setting" This till take you to the management page for "Virus & threat protection" For all options on this page, disable them Please disable the following options (all) - Real-time protection - Cloud-delivered protection - Automatic sample submission - Tamper protection - **Disabling Microsoft Defender** Search for "Edit group policy" Within the Windows search bar Within the local policy editor, under **Computer Configuration** go to **"Administrative Templates" > "Windows Components" > "Microsoft Defender Antivirus"** Within this policy template we want to **enable** the following policy: "Turn off Microsoft Defender Antivirus" - **Disabling Defenders Firewall** Within the "Local Group Policy Editor", under **Computer Configuration** go to **"Network" > "Network Connections" > "Windows Defender Firewall"** You will notice two profiles contained here, we must disable both. Go to the first profile named "Domain Profile" and **disable** the following policy: "Windows Defender Firewall: Protect all network connections" Now we must also do the same for the other profile called "Standard Profile" and **disable** the following policy: "Windows Defender Firewall: Protect all network connections" (You can now take another Screenshot - at this stage this will be the pre-flarevm stage) ### Installing Flare Open our newly downloaded Window's Terminal (run as administrator - shield icon top left of window) run the following command: ```bash (New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")` ``` Change The current directory to the Desktop using: ```bash cd ~/Desktop ``` Unblock the install file using: ```bash Unblock-File .\install.ps1 ``` Set the execution policy of the file using: ```bash Set-ExecutionPolicy Unrestricted ``` > If it appears Accept the prompt to set the ExecPol to unrestricted if one appears Finally, execute the install script with the custom configuration settings made by "Husky" ```bash .\install.ps1 -customConfig https://raw.githubusercontent.com/HuskyHacks/PMAT-labs/main/config.xml ``` - This will then execute pre-checks to see if everything completed prior is so It will then give you the option to proceed - ENTER: **Y** - This will then ask if you have taken a snapshot in case of installation failure It will then give you the option to proceed - ENTER: **Y** Next it will ask for the administrator password for the default account you created on the machine. You will soon get a pop up to select the required tools for the lab environment, the default tools are acceptable - Click **OK** Utilising Chocolatey this will download the necessary .NET frameworks and tools THIS WILL TAKE A VERY LONG TIME TO INSTALL - But once This is complete: (Take another snapshot) - this will be our final snapshot before detonation of malware and is incredibly important ## Step 4 - Network setup In order to have the machines on a segmented network which will not allow them to interact with the Host machine We require the machines to be on their own network In this case we are going to create a network using Virtual Box Go to the "Tools" section and click on "Create" - you will see a new adapter has been added to the list below In order to segment this network we need to have them visible segmented also. to this set the options for this adapter such as the below: (Leave everything else as default) - Adapter Settings IPv4: 10.0.01 IPv4 Network Mask: 255.255.255.0 - DHCP Settings Server Address: 10.0.02 Subnet Mask: 255.255.255.0 Lower Address Bound: 10.0.0.3 Upper Address Bound: 10.0.0.254 Next we need to assign these networks to the machines Right Click on the host in the menu and select settings Scroll down to the "Network" tab In the network tab switch the current adapter (typically 1) to "Host-only Adapter" The name of this adapter must be set to the one created previously > Ensure No Other Adapters Are Enabled - as this may lead to network communication between our lab and it's host (do the same for the other host/s you want in this network) Once this is completed test the hosts by ensuring they can communicate with each other but not the host or the internet ## Step 5 - Setting up [[INetSim]] ### Config INetSim is a software suite for simulating common internet services in a lab environment to study the behavior of malware without exposing it to the actual internet. It provides fake responses to the malware's network requests, mimicking services like HTTP, HTTPS, SMTP, and DNS. This tool allows researchers to observe how malware interacts with these services while ensuring that the malware does not communicate with real-world servers, thus maintaining a controlled and safe testing environment. INetSim is particularly useful in malware analysis to safely trigger network-related behaviours without risking external communication or contamination. First we will need to edit the config file to enable DNS for the service ```bash sudo nano /etc/inetsim/inetsim.conf ``` Scroll down to the start of the program and un comment the option for "start_service_dns" The next thing we have to change about the config file is binding to all hosts on the network This will allow the simulation of traffic by all hosts on the network Scroll down to the section that begins with "service_bind_address" and un comment the part that assigns it an IP Address Also changing the assigned IP to "0.0.0.0" It should look like the below image ![[Pasted image 20250317215333.png]] The next thing we want to change is the routing of DNS Traffic So we scroll down to the section tiled "Service DNS" We must change the DNS default IP by uncommenting the section that applies this and assigning the IP of the REMnux box to this. It should look like the below image: ![[Pasted image 20250317215719.png]] Once the above is complete we can save and exit the text editor by: - CTRL + O - ENTER This will write to the file - CTRL + X This will save and exit ## Running INetSim To run INetSim we can use the following ```bash inetsim ``` #### Additional DNS Configuration On the Flare VM Machine go to the Ethernet adapter settings Go to Internet Protocol Version 4 and change the DNS Server to the IP of the REMnux box This will ensure all DNS requests are passed to the INetSim process #### Troubleshooting It may occur during analysis, where a particular tool is not available on your lab. In this instance we can re-enable the internet connection and download whatever tools are required. To do this: [ ] Change the VM network adapter configuration settings from "Host-only Adapter" to "NAT" (Network Address Translation) [ ] Restart [ ] this should be complete, if not please follow the next steps [ ] Go to the ethernet settings in the VM and set the IPv4 properties to obtain IP address automatically Please use this step when installing the following tools: - [[PEstudio]] - ## Complete This has now concluded the malware lab provisioning section Your Malware lab has now been configured and ready for use