I know a lot of malware that's produced in certain countries has rules
about offensive cyber capabilities within that country,
but not necessarily outside of that country.
So it's actually legal to use offensive cyber capabilities as a
civilian on any country that's not yours. Right, and the way that
the malware would typically checks that is by looking at the
language that's installed in Windows.
So a lot of malware will actually look, a lot of malware from Eastern Europe
will look to see if the language is Russian or Czechoslovakian or Polish or
some other Eastern European country, Romanian.
And if it is that language, it doesn't run on the system.
So you may want to have that set up in a snapshot even potentially having
one language versus another to see how the malware reacts to that, if it
reacts differently. That's really smart.
And then the other thing,
I guess, we're talking about setting up the OS, one of the basic things when we
have Defender, Windows comes with Defender, comes with antivirus. Is that
something we need to be concerned about turning off?
We're running malware on it, and do we really want it to catch it?
That's exactly the reason why you might want to turn this off.
Whenever I teach a class on malware analysis,
the first thing that I have students do is turn off
Windows Defender because our goal here,
we we do actually want the malware to run,
right?
We do want it to infect our system, so we don't want the Windows
protections like Windows Defender to catch it and to stop it.
So you might want to go in and disable Windows Defender just so
that the malware can run and get around it.
Now you also might want to have Windows Defender running in another
snapshot to see if the malware will go and do something to turn it
off or disable it somehow on its own.
That would be very interesting to see as well. And, again, this just kind
of goes back to having snapshots and making it look real. If your
corporation uses some other antivirus or EDR product,
you may want to have a snapshot with that installed just to see how the
malware reacts to that or if your antivirus or your security software
detects the malware. We'll get into this when we get into very specific
malware in the next play by plays.
But the whole point is you're doing research ahead of time.
You're not just like, Oh, I wonder what this is, and
double‑clicking it. You're going to have some sort,
even if it's a new file that someone asked you what it
was, you're going to be like, Oh, what's current right now,
what could this be?
I'm going to go ahead and check everything that can give me some
indications like if there's a macro, a VBA macro. You can go
ahead and make that document as a file, pull the VBA out, see
what it's doing, and be like, What does this behavior look like?
And understand what you're about to get into so that you can
choose the right snapshot or choose kind of get a theory behind
how you're going to approach it.