Now you understand what we're saying to is you don't
necessarily want to update your guest OS.
You may want to have Windows be vulnerable.
So let's say you have a piece of malware that
exploits the EternalBlue vulnerability.
You may want to have a version of your guest OS,
your guest Windows,
your sandbox that you're going to run malware in that's
vulnerable to EternalBlue so that you can see how the malware
exploits that and how it works with it.
I got it.
And we're focusing on Windows OS now.
Yes. Obviously, there is malware for Mac OS or different distributions of
Linux. Right. But Windows is more common. Right, absolutely.
And usually the big name malware is more focused on Windows
devices. Right. I think as we move forward,
if the need arises,
if there's some huge Mac OS outbreak of malware that's making news
headlines, then we'll focus on that as well,
but a good point about virtual machines, maybe not for Mac OS, is
that you can virtualize a Linux environment as well.
Yeah, absolutely.
With virtual machines, you can pretty much virtualize any environment.
There are ways to have a virtual Mac, as well,
and the techniques that we're going to talk about,
even though we're focusing on Windows, you can still apply
these techniques to Linux and Mac and pretty much any other
operating system out there.
There're emulators and virtual machines for Android,
for iOS, for pretty much anything out there.
And so as we go through,
we're going to talk about techniques. Some of them
may be very specific to Windows,
but you can still kind of apply them, maybe not with the same
tools or with the same configuration options,
but you can still apply them to other operating systems.
So focused on Windows, we have actually two
major‑‑‑some people are using XP still, but we're not going to talk about them.
We're talking about using Windows 7, Windows 10. And malware will react
differently depending on what type of device it's on,
right?
That's a common behavior. Right. Yeah,
some malware will work differently if you're
running Windows 7 versus Windows 10.
Sometimes there're security updates that get applied to various versions of
Windows. Kind of going back to if you come across some really old
malware‑‑‑and I do incident response for a living, I still come across systems
that are infected with malware that's 20 years old,
like the old IRC bots from the nineties.
And those don't know how to run on Windows 7.
So if you come across one of those, the nice thing about
virtual machines is you can go and get an old copy of
Windows XP and throw it in there.
You don't need to have some old pieces of hardware in order to run this.
You can just run it in your virtual machine and then pretty quickly
get in there and start analyzing that piece of malware that requires
that old version of the operating system.
Absolutely.
That's a really good point.
It's backwards compatibility with virtual machines. And I know
even enterprise, a lot of people are still using 2003 server,
and one of the solutions is that, like newer,
server‑based, like bare‑bones servers don't support 2003.
Exactly. But you can virtualize it on top of ESXi or something.
So that's kind of an enterprise solution, same thing for
malware. Exactly, malware, remember, it's just software.
It has certain requirements that it needs to run.
And sometimes those newer OSes just can't run it, or
they're too restrictive for that.
And so you need to kind of go in and play with it a little bit and sometimes
just fall back to those old Oses and analyze it within there.