And.
Hello everyone.
I'm Tiffany here again.
Now that we understand the fundamentals of reverse engineering and its analysis techniques, let's roll
up our sleeves and set up our own basic analysis lab.
Now this lab will be your digital battleground, a contained, secure environment where we will poke
and prod potentially dangerous files without endangering our actual system or network.
Now, first let's define what this lab actually needs to accomplish.
So it must safely run malware or suspicious programs.
It must isolate these programs from affecting your real machine or external networks, and it should
allow controlled internet access or no access at all, depending on your analysis case.
And finally, it should be easily reset to a clean state after every analysis session.
And to achieve all of this, virtualization is your best friend.
Tools like VMware.
Or VirtualBox allows us to run entire operating systems as isolated virtual machines inside our main
host computer, and each virtual machine can be configured, cloned, reset, and even destroyed without
any impact on the host machine.
Now here's what lab setup will include.
Now, this is not the best practice.
To be honest, this is not the safest way to run.
The safest way would be to use a separate computer, uh, from with separate network access.
But considering what the what malware we will analysis, it is good.
So we will have the host system, uh, which is your real machine?
Uh, and here inside this real machine, we will have a, uh, we were a virtual machine inside this,
uh, which is, this is basically a sandbox environment for analysis.
And, uh, we also need the Wireshark installed on both the, the host machine and on the virtual machine
as well.
Uh, now we are installing packet Wireshark for man in the middle, uh, or packet sniffing.
And we will also need a virtual switch or physical switch in some cases if you are, uh, seeing something
funky on your host machine, just pull the cable.
But again, I am against, uh, like, as I said, I'm against using your host like a daily machine
for malware analysis and the best practice to just use another, uh, system and install the virtual
machine inside it.
But as I said, considering the malware types and the program times, we will try to reverse engineer
and analyze.
Uh, this is enough.
And yeah.
So also, of course, this will have the internet access.
I will try to.
And internet again.
Uh, the best practice is add a switch inside this internet so you can turn it on or off, depending
on your needs.
Also you can use the switch here as well and here as well to turn your internet access on or off.
Now we are going to use VMware in this course, but feel free to substitute with VirtualBox and if you
prefer open source solutions.
And just remember uh, virtual machine image formats differed First, VMware uses that v d k and v m
x, while VirtualBox uses that over and uh VDI.
Now choose the right format when downloading the prebuilt virtual machines or setting up your own.
Now let's talk about your guest host.
So we will be using Windows 11 uh, for our analysis environment.
Uh, now it is modern, compatible with most tools and still represents the what many malware samples
target today.
And also in the virtual machine, we will, uh, set up another, uh, Kali Linux machine, uh, to,
to do more advanced analysis since, uh, Kali Linux is the best machine for this kind of, uh, pen
testing works.
This is this is going to of course, also virtual machine.
Uh, now.
Uh, yes.
Now you will need to download the official Windows 11 ISO file from the Microsoft and install it inside
your virtual machine.
For the Linux side, you can just download uh, from the offensive security website, the Kali Linux
Vmdk file for the VMware or VirtualBox.
And you can just extract it from the zip file and you are ready to go.
The Linux is more easier than windows.
Windows is uh, also VMware.
VMware has automatic installation, uh, tool for the windows.
So you just import the ISO file and VMware just skips the installation process for you.
I don't know if the VirtualBox has the same, but it is not a big deal.
Um, yeah.
And uh, our setup will resemble the diagram I'm driving right now.
The host machine runs Wireshark as well and controls the virtual switch.
The virtual machines runs the suspicious executable.
And, uh, we will also have the Kali Linux virtual machine.
So we will not mainly use, uh, to execute our, uh, windows machine.
Uh, malwares on Linux.
Uh, because it is, uh, not done.
Uh, so the most malwares are intended for windows, since this is where the most users, uh, use their
computer for daily users.
But yeah, there's also almost 90% of the almost over the 90% of the machines today as a servers use
Linux and consider your Android phone as Linux too.
Uh, but yeah, we will also might use Linux for the malware.
Analysis process as well.
But in that case we will use just another Linux, since this is our operation.
Uh, operation, uh, Linux is our Kali Linux.
So we will just analyze the files from the Windows 11.
If we need to.
And yes, um, also the virtual switch here allows us to toggle internet connectivity.
Uh, we can also use the bridged or nat uh, versus no network.
Uh, so the best, best case for this kind of, uh, jobs is to use nat, um, or, uh, no network
at all.
And now this setup forms what we call a sandbox.
So this is a self-contained system where we analyze software behavior, and after each test, uh, we
can revert to previous clean state by using virtual machine snapshots or cloning features.
You can also use just copy the entire folder of the win v 11 to another place before executing malware,
and then revert it back and delete the contained one.
Yes.
Um, and at every malware execution, uh, delete your old, uh, VMware and start a new one.
It is just it will take just seconds to do that.
Um, yes.
Once the virtual machine is infected or modified, you should never trust it again unless it is reverted.
As I said here.
And, uh.
But we want some advanced malware.
Can detect that it's running inside a virtual machine and will behave differently or refuse to execute.
And in those rare cases, you might need a physical machine for analysis.
Now to restore it between test use the imaging tools like Clonezilla, fog, Deep Freeze or Hdclone.
Now this allows you to took a snapshot and restore entire physical hard drives.
Now let's emphasize a key point.
Encapsulation is not optional here.
So even if you are, even if you are not working with known malware, I strongly recommend always using
virtual machine for analysis.
Mistakes happen and seemingly benign executable can still modify system settings, uh, phone home to
suspicious domains or cause instability.
And you want your your real system safe of course.
Now regarding to internet access in early stages of analysis, it's been keep the, uh, it's best to
keep the VM virtual machine offline.
So if a malware sample requires internet communication to fully activate or reveal behavior, or wait
until you have tight control over your environment, that's where Wireshark comes in.
And now you will use it to monitor what malware is trying to do.
You may ask the questions here.
Is it reaching out?
to known command and control servers.
It is attempting DNS lookups for suspicious domains.
Is it uploading data or downloading pilots?
Uh, yes.
We will explore this in depth in the next lectures, but for now, understanding the networks monitoring
is crucial.
You can learn a lot about the suspicious file just by seeing what is trying to connect to.
Now, to summarize your initial lab setup, uh, VMware or VirtualBox for virtualization, Windows 11
ISO installed on the guest.
Uh, Wireshark on both the host and guest.
Uh, the snapshot clone tools.
Uh, to easily revert changes a virtual switch or adapter for network control.
And you are now ready to build your secure reverse engineering sandbox.
And in the next lecture, we will start interacting with this environment and explore static and dynamic
malware behaviors.
Hands on.
Let's go.