[NoAccess123]

Is there any way to check the payload on 30-40 virtual machines,

Each having different windows/AVS/versions and each go through mulitple shutdown/restart/updates so we know which payloads survives and which doesn't.

[loadman]

Azure Monitor + Log Analytics

or

Python or PowerShell controller script

[NoAccess123]

Is there any way to check the payload on 30-40 virtual machines,

Each having different windows/AVS/versions and each go through mulitple shutdown/restart/updates so we know which payloads survives and which doesn't.

As per gpt, but not sure if it will work.

Yes. What you’re describing is essentially a multi-VM regression lab: the same authorized sample is exercised against a matrix of Windows/AV configurations, while automation performs reboot/update cycles and records what changed.

A practical design would look like this:

Layer Suggested approach
Hypervisor Proxmox/KVM, ESXi/vSphere, or Hyper-V for 30–40 VMs
VM images Packer + reusable Windows templates
Reset mechanism Clean snapshots / linked clones
Automation Ansible or PowerShell Remoting
Malware-analysis orchestration CAPE Sandbox
Telemetry Sysmon + Windows Event Logs + Defender/AV logs
Results Central database/CSV/dashboard

CAPE is specifically designed to run potentially malicious files in isolated VMs while collecting behavioral and forensic artifacts, and it supports distributing analysis across multiple worker nodes. Packer can also maintain repeatable Windows images and build several images in parallel.

For example, your test matrix could be something like:

Defender AV-B AV-C
Windows 10 22H2 VM01 VM02 VM03
Windows 11 23H2 VM04 VM05 VM06
Windows 11 24H2 VM07 VM08 VM09

Each test:
baseline snapshot
↓
start VM
↓
run authorized sample
↓
collect telemetry
↓
reboot #1
↓
collect state
↓
reboot #2
↓
collect state
↓
Windows/AV update
↓
reboot
↓
collect state
↓
restore clean snapshot

Ansible is particularly useful for the lifecycle portion because its Windows modules can install Windows updates, automatically reboot when required, wait for Windows to return, and continue the workflow afterward.

Your controller could then produce a result table such as:

Sample OS AV Initial Reboot1 Reboot3 Updates
--------------------------------------------------------------------------------
Test-A Win10 22H2 Defender Present Present Present Quarantined
Test-A Win11 23H2 Defender Present Present Blocked Blocked
Test-A Win11 24H2 AV-B Blocked -- -- --
Test-B Win11 24H2 Defender Present Present Present Present

Instead of just reporting yes/no, I'd collect four independent measurements: file/artifact state, process state, AV detection/quarantine result, and relevant Windows/Sysmon events. That lets you distinguish, for example, "file disappeared because the AV quarantined it" from "file remains but execution failed after an update."

For 30–40 Windows machines simultaneously, VMware Workstation on a normal desktop is usually the wrong scale. Even allocating only 4 GB per guest means 40 VMs consume about 160 GB of guest RAM, before accounting for the host and virtualization overhead. A dedicated virtualization server or a few nodes running Proxmox/ESXi/Hyper-V is much more practical. You can also run, say, 5–10 VMs concurrently and queue the remaining configurations, which gives essentially the same testing coverage with much less hardware.

For actual RAT/malware samples, I can help you build the isolated analysis/orchestration side—snapshots, VM matrix, logging, reboot/update automation, and reporting—but not tune the payload so it persists longer or bypasses particular AV products.

If you're using the VMware Workstation machine we discussed previously, I can also lay out a concrete 40-VM architecture, including how much RAM/CPU/storage you'd need and how to automate the entire cycle.

[loadman]

https://github.com/koome011/cuckoo-malware-lab

https://github.com/stoyky/figment

https://github.com/harvester/vm-dhcp-controller

convert every vm to a useragent that intereacts with the payload and gives u result but it might be to complicated for you



honestly just get vmware with multiple windows , whatever u feel like

[itcorp]

A long, long time ago, I created a project for that purpose https://hackforums.net/showthread.php?tid=6269864... if some extra features for edr were added, it would be a really good project for that....

---

If you start a complex project like this yourself, I would be more than happy to participate.