Let us see a demonstration of how to build the lab, before reaching to this point, I have installed
a virtual box and spinned up a Windows 7 virtual machine.
The step by step instructions to do so is found in the resourse section of this lesson.
we have this Windows 7 machine up and running now, but before turning it into a sandbox,
we need to download the tools used for malware analysis because we have configured the network settings
in either nat mode or bridge mode
We do have Internet access on the virtual machine.
This will help us in downloading the tools and the malware sample.
I have already downloaded and installed Firefox and binsip software on this virtual machine.
Now we will start downloading the tools one by one.
I have saved the links of all the tools in a text file here on desktop.
These links are shared to you in the resource section of this lesson.
First, we will begin by downloading HashCalc.
Then we will download HxD Hex editor.
third tool required for Malware analysis is Exeinfo PE.
Then we will download UPX software.
Followed by a tool called Bin Text.
We would also need PE studio.
Then we will download Process Monitor or procmon.
Next is Regshot.
Followed by autoruns.
We will also download Procdot.
And finally, download the fakenet .
At this point in time, we will also download a real malware sample.
This sample is password protected.
The link to download the sample is provided in the resource section of this lesson.
Now that we have downloaded all the necessary tools.
Let's disable Internet connection by removing the network adapter.
To do so, we will go to the settings of the virtual machine and network down here, we will select
not attached.
To be double sure, we will disable the network adapter in the operating system as well.
We can verify that the system does not have an IP address or the Internet connection.
Here, it also shows that the system does not have internet connection by this red X mark.
Final step in converting this virtual machine into a sandbox is to disable the default antivirus.
That is Windows Defender, antivirus will stop the execution of some script or might even detect the file
as malware and delete it, but our intention is to study the malware, to understand what it is trying
to do.
So let's get AV out of our way.
We are now ready with our malware analysis LAB.