>> Here, I will be demonstrating how to install VMware,
and Windows XP as
the target malware analysis test virtual machine.
Here I've downloaded VMware Workstation 9.04.
It's a little older,
just fine, and I have a license for it.
It runs about 150,
Right below us is the open-source
>> virtual box, by Oracle.
>> Just fine and free.
I don't want VMware to know what I'm running.
In the meantime, I will show
you all the settings I typically applied [NOISE]
such as what operating systems that I usually create such
as the Chinese versions of
operating systems because some malware will not run
without the Chinese version or will not run correctly.
Turn off "Auto Updates",
so I will update very purposefully whenever I need to.
Install Explorer 8, 9,
and 10 and 11,
Office 2003, 2007, 2010,
tramp the macro settings Flash,
Flash 10, 11,
Adobe Acrobat Reader 9,
10 and 11, Java 6 and 7.
I'll just turn off "Shadow Volume and Copy".
I will run everything
in my virtual machine at least once.
I will turn on "Auto Login".
Turn off "Hide extensions for known file types",
"Hide protected operating system files".
Remove "These files are hidden" banners such
as if you go into C:/windows and XP, all the advances.
Are you sure you want to go here? And you say yes,
turn off the firewall,
disable pop-up blocking,
disable all the Internet Explore privacy things
in case they interfere with the malware,
turn off all the visual effects.
Vmware is really good about that.
But you don't need that slowing down your system.
Then restart the virtual machine and snapshot it.
They'll show the hidden files.
Even open up my Explorer window.
Go to Tools, Older Options,
View, Show Hidden Files, Folders and Drives.
Uncheck Hide Extensions for Non-file Types.
Uncheck Hide Protected Operating
System Files. Are you sure?
Say Okay. You can see
now these hidden files
that you don't normally see to care about are here.
[NOISE]
Now we VMware
tools is automatically installing.
You might want to get rid of these pop-ups too.
The cool thing about VMware Tools,
it's a little dangerous.
It's automatically installing.
Then print drivers,
so it'll automatically profile
your connected printers to
this machine, your host machine.
I recommend disabling that.
You don't want malware gathering intel on your stuff.
If it's VMware doesn't
automatically install VMware Tools,
you can go up here to VM right
here where it says Cancel VMware Tools Installation.
It would normally say install or upgrade tools.
You can click that, and it will
automatically mount a CD drive
with the VMware Tools that you can execute.
In the settings here, you will set up the network.
We'll change MAC to
Custom Virtual Network and choose something like VMnet2.
By default, it's completely isolated and
VMware will automatically have a DHCP,
so you might want to disable that.
You'd want to randomize this,
so it's not a VMware MAC address.
Maybe change this up a little
bit so malware can't detect.
Then a VMware, VM.
Now if we were to resize this,
VMware Tools will automatically
adjust lots of settings across.
Since VMware Tools is installed,
we can drag and drop or execute our tools.
Now, we're going to make
our second virtual machine for our Kali Linux.
Now, you can go to a Kali Linux website and
download a VMware virtual image
with VMware Tools automatically installed,
and I recommend this.
But just in case you want to do it from the ground up,
you can do the same procedure.
Ubuntu is fine with Debian.
Vmware doesn't really care
about what distribution of length it is.
It just chooses what hardware best suits it.
Power it on, and I'll boot
from an ISO that I downloaded.
I can boot live,
so it doesn't actually install.
I'm going to say Install.
It's where all the defaults. You'll notice
that it's taken over my mouse.
If I need to escape from that,
I just hit "Control Alt".
My cursor will appear.
Also, this VM,
it has MAC so it can get to the Internet.
I'm also going to add another network adapter,
so it can talk to my target,
infected or my guest XT virtual machine.
I'm going to set the host custom VMware2,
so it can also talk.
It can talk to Kali,
so it can talk to Windows XP.
Yes, that's fine.
Two password by default it's four,
and I'll just go with that for
now to that route backwards.
>> Close all the defaults.
Write changes to disk?
Yes. That was not the default.
The default is no, so you don't
accidentally overwrite the disk.
Typically, I want to have
as few analysis tools on
my guest VM that will be infected with malware.
Sometimes I'll take a snapshot without
these tools because sometimes
malware will look for tools running or just on the disk,
but usually, it's just malware roulette.
Usually, malware will just look
for running processes it knows to be
monitoring tools for malware analysis
like Capture BAT or system channels tools.
While Kelly is installing,
I would take this time to install some of these tools.
Here's Capture BAT.
[NOISE]
VMs
and VMware and all other software
like VirtualBox would go a lot
faster if you had a solid-state drive.
Solid-state drives aren't great for
handling large files because it's how they work,
but the speed improvement is significant.
I almost always work with solid-state drives when
I'm doing malware analysis in VMs.
[NOISE] Here,
I'm going to show
hidden files folders,
show operating system files and hide the extensions.
I'm going to remove the banners
simply by browsing to them like
this. One time is done.
System32 usually has a banner in system.
I'm not going to install the rest of these tools.
It's pretty self-explanatory.
Does it want to update?
Yeah, I like updating.
Yes, default. Install GRUB. [NOISE] Username is
root, password is toor,
T-O-O-R. Now we need to configure the network.
[NOISE]
The first Ethernet is
how VMs talk to each other.
I'm sorry. Yes,
the first network eth0 is how VMs talk to each other,
so let me just [inaudible] configure that.
Eth0 iface
eth0 inet static.
I like to indent, but you don't have to.
I'm just going to choose the 10. range.
I'm going to make it like this one,.1,
making that mask 255.255.255.0.
This is actually a quasi network,
so it's actually just 255.0.0.0,
but since we're working in such a small environment,
I'll just make this like that.
Gateway is myself.
I don't have to define it,
but [inaudible] Write quit,
say ifconfig
eth0 down and eth0 up.
It brings network interface down, up, down, up.
The second one, eth1.
Now it can talk to the Internet and talk
to the Windows XP machine.
[inaudible] like this.
It looks like it hasn't taken into the IP addresses.
That looks like DHCP account with this.
Since the network manager's trying to fix a few things,
it's a lot easier just to reboot.
In Windows, I'm going to do the same thing.
Make it full screen.
VMware Tools takes over.
It's just a screen resolution.
Go to "Network Connections",
insert the IP address manually.
This one, I'm going to set as 10.0.0.2, 55.255.255
and default gateway, I'll make
my Kelly [inaudible] I'll also
make it my DHCP server because we
might want to spoof DNS requests later.
Ipconfig, it has.2 address.