Yes,
so when we're building this virtual machine, we've got the ISO, the
Windows ISO, what's a good place to get the Windows ISO from in the
first place if that's the one we're talking about? Do you have any
good recommendations for that?
Sure, you can go out to, if you have an MSDN subscription,
you can download it from there.
If you don't, and you need to go out and get a limited version of Windows,
you can go to Microsoft and download trial copies of
Windows. They're limited for 30 to 90 days, and you can
renew those, but at least they're free,
and you can get the modern versions of Windows to test malware out on. And you
just download them and install them into your VM. Excellent.
So some malware,
a lot of current malware is concerned about whether it's on a real machine or
not. Right. And we need to make the machine look real, and even from, we talked
before about it's more common that you're using horizon viewers in desktop or
something like that in your enterprise.
So it's not necessarily looking for just a virtual machine,
but maybe an actual production machine. So your
desktop could be a virtual machine.
But if it only has 1 core and 1 GB of RAM, that's not really realistic.
Yeah,
exactly. A lot of malware, they have techniques in there where
they look to see how many CPUs does the machine that it's on
have? How much RAM does it have?
How big is the disk drive?
And if it's too small, if it's smaller than what it expects,
then it knows that it's either on a system that is being analyzed because we
may not give a virtual machine as many resources as a normal machine would
have, or it's on a system that has so few resources,
why would it want to compromise it anyway, so there's
probably nothing on there that it wants.
So as we go in before we even install our operating system,
we're going to want to configure the hardware for the
virtual machine to look as real as possible.
And so the way that we do that is you want to give it at least 4 GB of RAM,
probably 8 GB of RAM because that's kind of standard now. You want to make
sure that the number of CPUs that you configure for your virtual machine to
have at least two CPUs with two cores each.
And just kind of go in and look at all the other settings. A lot
of virtual machines start off by having a floppy disk connected
to the system still. Take that off.
I haven't seen a computer come with a floppy disk drive in at least a decade,
if not longer.
So that could be another check that malware does to see if these commonly
seen things in virtual machines are on your system.
Yeah, that's a really good note.
Same thing like I know within VMWare and probably within VirtualBox
also, there're different driver sets you can use for your NICs. Is
that something else we're going to look at?
Yeah, we'll look at how we can change some of the virtual machine
settings to kind of hide from these techniques.
And, we'll actually use a tool, a really great tool called Pafish,
which is going to kind of go through some of these checks and
show us whether or not it detects those,
and so we can tell if we're hiding from the malware that's
using these checks. So that's really neat.