VirtualBox: How to Setup your Malware Analysis - Revision history

Carseven: /* Sandboxing on Ubuntu */

2019-12-27T07:34:38Z

Sandboxing on Ubuntu

← Older revision		Revision as of 07:34, 27 December 2019
Line 125:		Line 125:
	If you have a Ubuntu host OS and would like to start analyzing malware on your machine, you are at the right place! The tool we are going to use for hardening the VM on Ubuntu is a bit different than the one running on Windows host (it is better). Essentially, the tool (python script) creates two different scripts:		If you have a Ubuntu host OS and would like to start analyzing malware on your machine, you are at the right place! The tool we are going to use for hardening the VM on Ubuntu is a bit different than the one running on Windows host (it is better). Essentially, the tool (python script) creates two different scripts:

	* One to harden your VM's configuration (just like the Windows ~~tools~~ does too)		* One to harden your VM's configuration (just like the Windows tool does too)
	* The other for to be run inside the VM		* The other for to be run inside the VM

Carseven at 07:31, 27 December 2019

2019-12-27T07:31:20Z

← Older revision		Revision as of 07:31, 27 December 2019
Line 83:		Line 83:
	[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]		[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]

	Before starting the VBoxHardenedLoader script we need to set it up ~~to your~~ host environment. First, go to the downloaded folder and copy the "Binary" folder into your C:\ directory or any other directory. In this tutorial, we copied it to C:\ and renamed the folder to "VBoxHardener". Next go to "C:\VBoxHardener\data\" and edit the hidevm_ahci file. Though be careful, if your guest VM does not use classic bios and uses EFI instead, make sure to pick the right script. Thus, here a short "what to choose, if" from the tool's developer:		Before starting the VBoxHardenedLoader script we need to set it up on our host environment (we still have not started the VM yet!). First, go to the downloaded folder and copy the "Binary" folder into your C:\ directory or any other directory. In this tutorial, we copied it to C:\ and renamed the folder to "VBoxHardener". Next go to "C:\VBoxHardener\data\" and edit the hidevm_ahci file. Though be careful, if your guest VM does not use classic bios and uses EFI instead, make sure to pick the right script. Thus, here a short "what to choose, if" from the tool's developer:

	* hidevm_ahci is for VM with SATA/AHCI controller and classical BIOS		* hidevm_ahci is for VM with SATA/AHCI controller and classical BIOS

Carseven at 12:09, 14 December 2019

2019-12-14T12:09:55Z

← Older revision		Revision as of 12:09, 14 December 2019
Line 83:		Line 83:
	[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]		[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]

	Before starting the VBoxHardenedLoader script we need to set it up to your host environment. First, go to the downloaded folder and copy the "Binary" folder into your C:\ directory or any other directory. In this tutorial, we copied it to C:\ and renamed the folder to "~~VBoxHardeneder~~". Next go to "C:\VBoxHardener\data\" and edit the hidevm_ahci file. Though be careful, if your guest VM does not use classic bios and uses EFI instead, make sure to pick the right script. Thus, here a short "what to choose, if" from the developer:		Before starting the VBoxHardenedLoader script we need to set it up to your host environment. First, go to the downloaded folder and copy the "Binary" folder into your C:\ directory or any other directory. In this tutorial, we copied it to C:\ and renamed the folder to "VBoxHardener". Next go to "C:\VBoxHardener\data\" and edit the hidevm_ahci file. Though be careful, if your guest VM does not use classic bios and uses EFI instead, make sure to pick the right script. Thus, here a short "what to choose, if" from the tool's developer:

	* hidevm_ahci is for VM with SATA/AHCI controller and classical BIOS		* hidevm_ahci is for VM with SATA/AHCI controller and classical BIOS
Line 95:		Line 95:
	* set vmscfgdir=C:\VBoxHardener\data\		* set vmscfgdir=C:\VBoxHardener\data\

	Notice the "\" at the end of "data"! ~~In our case, we set~~ the first variable to ~~our~~ VirtualBox path (where the vboxmanage program is located) and the second to ~~our~~ previous ~~Binary~~\data\ path.		Notice the "\" at the end of "data"! Set the first variable to your VirtualBox path (where the vboxmanage program is located) and the second to your previous VBoxHardener\data\ path.

	Now open cmd as administrator and start your script, in our case hidevm_ahci.cmd with the name of your VM:		Now open cmd as administrator and start your script, in our case hidevm_ahci.cmd with the name of your VM:

Carseven: /* FakeNet */

2019-12-06T18:22:38Z

FakeNet

← Older revision		Revision as of 18:22, 6 December 2019
Line 43:		Line 43:
	=== FakeNet ===		=== FakeNet ===

	Unfortunately, Pafish does not scan for a working network connection. Nonetheless, this does not exclude advanced malware from scanning for it. In addition, in order to analyze sent packets by malware, you would need to extensively mimick a fake network. For this ~~and~~ we have the simple approach of using FakeNet. It allows you to intercepts and analyze the packets (all traffic is stored as .pcap files). "Installing" the standalone executable is straight forward. You download it from [https://github.com/fireeye/flare-fakenet-ng/releases FakeNet/Releases] and run the program as administrator on your VM.		Unfortunately, Pafish does not scan for a working network connection. Nonetheless, this does not exclude advanced malware from scanning for it. In addition, in order to analyze sent packets by malware, you would need to extensively mimick a fake network. For this we have the simple approach of using FakeNet. It allows you to intercepts and analyze the packets (all traffic is stored as .pcap files). "Installing" the standalone executable is straight forward. You download it from [https://github.com/fireeye/flare-fakenet-ng/releases FakeNet/Releases] and run the program as administrator on your VM.

	For our case, we did not need to configure anything different than default. But to tailor it to your needs simply copy the default-config file at "configs\default.ini" and start creating your own. When finished simply start FakeNet with "-c FILE" flag and you are good to go!		For our case, we did not need to configure anything different than default. But to tailor it to your needs simply copy the default-config file at "configs\default.ini" and start creating your own. When finished simply start FakeNet with "-c FILE" flag and you are good to go!

Carseven: /* The Tools */

2019-12-06T18:22:13Z

The Tools

← Older revision		Revision as of 18:22, 6 December 2019
Line 22:		Line 22:
	== The Tools ==		== The Tools ==
	Before diving into the setup, here is a quick guide on what FakeNet and Pafish are and how to use them.		Before diving into the setup, here is a quick guide on what FakeNet and Pafish are and how to use them.

	~~=== FakeNet ===~~

	Unfortunately, Pafish does not scan for a working network connection. Nonetheless, this does not exclude advanced malware from scanning for it. In addition, in order to analyze sent packets by malware, you would need to extensively mimick a fake network. For this and we have the simple approach of using FakeNet. It allows you to intercepts and analyze the packets (all traffic is stored as .pcap files). "Installing" the standalone executable is straight forward. You download it from [https://github.com/fireeye/flare-fakenet-ng/releases FakeNet/Releases] and run the program as administrator on your VM.

	For our case, we did not need to configure anything different than default. But to tailor it to your needs simply copy the default-config file at "configs\default.ini" and start creating your own. When finished simply start FakeNet with "-c FILE" flag and you are good to go!

	=== Pafish ===		=== Pafish ===
Line 46:		Line 40:

	Starting Pafish will automatically run all checks and immediately give you feedback on which tests failed (got detected) on your VM.		Starting Pafish will automatically run all checks and immediately give you feedback on which tests failed (got detected) on your VM.

			=== FakeNet ===

			Unfortunately, Pafish does not scan for a working network connection. Nonetheless, this does not exclude advanced malware from scanning for it. In addition, in order to analyze sent packets by malware, you would need to extensively mimick a fake network. For this and we have the simple approach of using FakeNet. It allows you to intercepts and analyze the packets (all traffic is stored as .pcap files). "Installing" the standalone executable is straight forward. You download it from [https://github.com/fireeye/flare-fakenet-ng/releases FakeNet/Releases] and run the program as administrator on your VM.

			For our case, we did not need to configure anything different than default. But to tailor it to your needs simply copy the default-config file at "configs\default.ini" and start creating your own. When finished simply start FakeNet with "-c FILE" flag and you are good to go!

	== Sandboxing on Windows ==		== Sandboxing on Windows ==

Carseven: /* Harden the VM */

2019-12-06T08:17:01Z

Harden the VM

← Older revision		Revision as of 08:17, 6 December 2019
Line 162:		Line 162:
	Echo as many different computer and usernames as you want. The script will create the random files depending on the names you have in those two files.		Echo as many different computer and usernames as you want. The script will create the random files depending on the names you have in those two files.
	[[File:ubuntu storage.png\|300px\|right\|thumb\|Sandboxing on Ubuntu: Storage structure]]		[[File:ubuntu storage.png\|300px\|right\|thumb\|Sandboxing on Ubuntu: Storage structure]]
	Next, make sure you create your VM with the same configuration as in the Windows guide above. Again, here are the essential points to change:		Next, make sure you create your VM with the same configuration as in the Windows guide above (Basic & Advanced VM setup). Again, here are the essential points to change:

	* No VirtualBox Guest Additions!		* No VirtualBox Guest Additions!

Carseven at 08:16, 6 December 2019

2019-12-06T08:16:18Z

← Older revision		Revision as of 08:16, 6 December 2019
Line 79:		Line 79:
	Now your VM is ready to be hardened!		Now your VM is ready to be hardened!

	=== ~~Starting VBoxHardenedLoader~~ ===		=== Harden the VM ===

	[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]		[[File:vmharden1.png\|800px\|center\|thumb\|Copy the Binary into C:\ and rename it. Next edit lines in hidevm_ahci]]

Carseven: /* Harden the VM */

2019-12-06T08:11:03Z

Harden the VM

← Older revision		Revision as of 08:11, 6 December 2019
Line 157:		Line 157:
	Proceed only if you have successfully completed the steps above. Then create your "computer.lst" and "user.lst" files by echoing your names into it:		Proceed only if you have successfully completed the steps above. Then create your "computer.lst" and "user.lst" files by echoing your names into it:

	echo "some-computername" > computer.lst		~/Documents/antivmdetection-master$ echo "some-computername" > computer.lst
	echo "some-username" > user.lst		~/Documents/antivmdetection-master$ echo "some-username" > user.lst

	Echo as many different computer and usernames as you want. The script will create the random files depending on the names you have in those two files.		Echo as many different computer and usernames as you want. The script will create the random files depending on the names you have in those two files.

Carseven: /* Summary */

2019-12-06T08:02:56Z

Summary

← Older revision		Revision as of 08:02, 6 December 2019
Line 5:		Line 5:
	As advanced malware nowadays is able to detect its environment (e.g. scanning for RAM, CPU cores, disk space, registry keys and even drivers) they are now able to stop their execution if they detect a virtualized environment. Therefore it is critical to setup your malware analysis VM correctly.		As advanced malware nowadays is able to detect its environment (e.g. scanning for RAM, CPU cores, disk space, registry keys and even drivers) they are now able to stop their execution if they detect a virtualized environment. Therefore it is critical to setup your malware analysis VM correctly.

	In order to render your VM undetectable, we have chosen two state-of-the-art tools on Github. One only supports Windows as its host OS and the other is relying on dependencies only available on Ubuntu. Though we will use Windows 7 on both as the ~~host~~ VM as it is the most popular for malware attacks.		In order to render your VM undetectable, we have chosen two state-of-the-art tools on Github. One only supports Windows as its host OS and the other is relying on dependencies only available on Ubuntu. Though we will use Windows 7 on both as the VM's OS as it is the most popular for malware attacks.

	===How to read this documentation===		===How to read this documentation===

Carseven: /* References */

2019-12-06T08:01:44Z

References

← Older revision		Revision as of 08:01, 6 December 2019
Line 216:		Line 216:
	== References ==		== References ==

			* https://www.virtualbox.org/wiki/Downloads
	* https://github.com/hfiref0x/VBoxHardenedLoader		* https://github.com/hfiref0x/VBoxHardenedLoader
	* https://github.com/nsmfoo/antivmdetection		* https://github.com/nsmfoo/antivmdetection
	* https://github.com/fireeye/flare-fakenet-ng		* https://github.com/fireeye/flare-fakenet-ng
	* https://github.com/a0rtega/pafish		* https://github.com/a0rtega/pafish