So the next step is the OS on the virtual machine.
So we also need to talk about how we need to make that look real as well.
So when you install your OS, you're going to go through and you're going
to install your operating system. And, again,
we're talking about Windows here, so we're going to talk about things
that we can do to kind of make Windows look normal and not in a VM
and, actually, a system that's used. Now,
there are a couple things that you need to kind of keep in mind
when you're first installing Windows though.
First off, do you want to install patches? And you might not want to.
And we talked about this a little bit where if you're looking at malware
that has some vulnerability that you want to see how it exploits, you may
not want to have that patch in place. Windows,
especially Windows 10, it kind of behaves a little bit
differently with the different versions. Windows 1809
implemented a whole bunch of new stuff into the operating
system, and so malware may react differently,
depending on what patch level you're at. So you want to keep that in mind. But
what you should be able to do is depending on how much work you want to put
into it, it's how really you want it to look, right?
Right.
But you don't want to go too far because the point is that the malware
executes. So if the malware is executing fine, then there's not that
much more work you need to do, right? Exactly.
And you'll be able to notice that, especially when we get to talking about some
of the tools that we're using, we'll be able to see, hey,
this malware actually did execute at this point, and kind of here's why it
accessed the registry key that said it was VMWare or accessed the number of
files that have been accessed in the last X amount of time.
And so that's when we know, okay, well,
maybe that's the next step we need to go to in the OS, right?
Right, exactly.
There're some other configurations that you'll probably want to do. Go in and I
would recommend doing things like turning off Windows update just because even
if you do have it go ahead and install patches,
we're going to be monitoring network traffic, and Windows
generates a lot of network traffic on its own.
So you want to kind of make sure that some of that is turned
off, and Windows update is very noisy?
It goes out all the time to check things.
Just turn that off so we're not seeing that network traffic.
There may be some other things like pop‑ups that you want to turn off,
or you may want to synchronize time between your host OS and your guest
OS or set it into a specific time zone.
You want to think about all these things to set up your system beforehand.
Oh, yeah, that makes a lot of sense.