Now the thing to keep in mind, too, we've made all these changes, right?
We want to make sure that as we go forward in analysis,
we don't have to do this every single time.
So what we're going to do is we're going to take a snapshot.
Here's the snapshot. So the interesting thing with VMWare is that if you
make changes to the VMWare configuration file and then you revert back to
a previous snapshot, you lose those changes.
So you definitely want to make sure that your snapshot is taken here.
So what I'm going to do is I'm going up,
and I'm going to say I'm going to take a snapshot, and we're just going to call
this snapshot modified VM just just so we know what it is.
And then I'm going to take that snapshot, and then VMWare is going to
go in, in the background, it's kind of taking that snapshot so we can
continue to work. But at least later on,
we can go in, we can kind of revert back to that
snapshot that has all these changes,
or I had taken a snapshot beforehand if we wanted to go to a
point in time where we don't have these changes in place, we
can jump back to that as well.
Absolutely.
Now is this snapshot going to‑‑‑if you revert, will it
actually change the VMX file? Yes,
it will actually change the VMX file back to the original one.
In fact, we can test that out.
Yeah, let's do that.
So what I'm going to do is I'm going to close out my VM.
I'm just going to power it off. So So it's gone in.
It has saved that snapshot for me.
Great.
Let me open VMWare up again.
Now we remember what we saw within the VM software.
I'm going to open up the VMX file, the configuration file in
Notepad++. In here we can see that our changes that we added in are
still in there. And we can, here's the asset tag that you called
out before some of the other ones.
Okay, great.
So what I'm going to do, I'm going to jump back over
to my virtual machine software.
I'm going to go to the snapshots,
and then I'm going to show you what they look like. Here is the
one that we just took about the modified VM.
You can see that I have some more set up of when I infected
my system with trickbot before and after.
But I'm going to go back to my base snapshot.
And this is a snapshot that I took right after I installed
everything that I wanted, and I'm just going to click Go To,
and it's going to restore that.
That's not reverting from an existing snapshot.
We're just going... I'm going back in time to the very first one that I took.
This is going to take 30 seconds to a minute
depending on your system to restore.
However, if we jump over back to Notepad++, we see that, hey,
it's already detected that our VMX file has been changed,
so I'm going to reload it.
It's already changed. It's already changed.
All those settings that we added in are gone.
So if we would jump back to the snapshot that we took with the changes in,
it would put them back in.
So that's something you want to keep in mind is that you definitely
want to take that snapshot and make sure you're in the right snapshot
with those settings set up. That's a really good point too. It's not
just that change disk separation.
It's also your VMX files and your configurations that change
back from different snapshots. Exactly, exactly.