[-Hyperion]

Hey guys it's -Hyperion ✌ I have run my own security company doing pen testing and malware removal the past 3 years. I am also a part of the WHHPIT team.

This is part 1 of a 3 part series on analyzing malware and removing it.
Introduction
Part 1. Setting up a malware test box
Part 2. Analyzing malware
Part 3. Removing malware

Requirements

• Virtual Box:Here
  
• Windows XP with SP3( you can download this from various sites if you do not have a CD)
  
• Malware Analysis/Removal Toolkit: Here
  

Setting up the Test Box
I will refer you to this thread Here for setting up a virtual machine. After you have windows XP installed there are a few things to do first to change first.

Start by launching VM and clicking on setting.
PICTURE
Spoiler (Click to View)



Then navigate to Network.
PICTURE
Spoiler (Click to View)



Finally enable Bridged Networking.
PICTURE
Spoiler (Click to View)



That is the only setting that needs to be changed. Now you can boot up the virtual machine. Once loaded into XP there are 3 things you need to do.

First update windows and turn off AV by going to Security Center.
PICTURE
Spoiler (Click to View)



Second select "Check for the latest updates from Windows Update" and then click on Recommendations and choose I have my AV software.
PICTURE
Spoiler (Click to View)



Go Here and run the installer.

Last is to download and install the programs in the Toolkit that need installing and placing the others on the Desktop.

Now you can restart the VM then turn it off.

Creating a snapshot of the Test Box

Now I will walk your through taking a snapshot of the VM. You will restore to this snapshot after every file you test. This will take the VM back to its state before you tested anything allowing you a clean environment each time and a back up if something goes wrong.

First click on the snapshot button with the machine powered off.
PICTURE
Spoiler (Click to View)



Then click on Take Snapshot.
PICTURE
Spoiler (Click to View)



Finally type in a name and description then hit okay.
PICTURE
Spoiler (Click to View)



To restore to this snapshot any time you power off the machine just select restore.
PICTURE
Spoiler (Click to View)



Conclusion
That's it you now have a test box set up with all the necessary tools and a way to restore after each test. In lesson 2 we will go over using these tools and analyzing a piece of malware. Stay tuned 🎉

[Jagster™]

Nice work buddy cant wait to see the other 2 parts of this series!

[-zERAiT]

Great work, can't wait to see the other parts!

-zERAiT🤝

[Ｔ ｅ ｓ ｓ ｅ ｒ ａ ｃ ｔ]

I like this tutorial, I support Virtual Machine use. HF users should do it more often, however, I support VMware over all other vendors. You just can't beat them.

[cyberducky]

I like this tutorial, I support Virtual Machine use. HF users should do it more often, however, I support VMware over all other vendors. You just can't beat them.

VirtualBox is good for simple users but VMWare has a boat load of features.

[Mittens]

Thanks for this tutorial, I always wondered how members tested files on a virtual machine.

[Roger Waters]

Nice tutorial, -Hyperion. Hope to see some more tutorials like this from you.

[Aura]

Thanks for this tutorial, I always wondered how members tested files on a virtual machine.

All the smart one does. The WHHPIT at least do and the common helpers here too 😝

[Abdilo]

I did this a few weeks ago when i accidently infected my self, I found the guys ip address and I geolocated his ip and spammed the keylog file till the keylog file was 30mb then i waited for him to connect and download the 30mb keylog file... then i removed the virus from my virtual machine :P

[Ｔ ｅ ｓ ｓ ｅ ｒ ａ ｃ ｔ]

I did this a few weeks ago when i accidently infected my self, I found the guys ip address and I geolocated his ip and spammed the keylog file till the keylog file was 30mb then i waited for him to connect and download the 30mb keylog file... then i removed the virus from my virtual machine :P

That is so rude to the poor phisher. Why would you do that? 😠

Jk. 😏 That was pretty cool. You should have made the file 1GB and let it go spam overnight next time.

[Darc]

I really like this tutorial. I really like Virtual Machines and this is a really good tutorial. My favorite VM is VMware but there are other great ones out there.

[kingpin69]

anyone got a link for just a straight up .iso of xp sp3?

all i can seem to find is zip files with setup.exe inside 😠

[ihearyou]

Just be care if you bridge your connection, You can still infect the host which is VM's are running on. I use Vmware Workstation and i Vlan the box off so there is no communication to any other PC's on my network.

[-Hyperion]

Just be care if you bridge your connection, You can still infect the host which is VM's are running on. I use Vmware Workstation and i Vlan the box off so there is no communication to any other PC's on my network.

This is a test box I specifically set it up as a bridged connection for monitoring purposes.

[Abdilo]

This is a test box I specifically set it up as a bridged connection for monitoring purposes.

You could setup fakenet on your host computer then bridge the connections through that.
Or what I do is lock it to a dmz and use fiddler to mess with the traffic :P