reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/sandbox_setup.md

# Sandbox Setup Guide

Quick reference for building and maintaining isolated malware analysis environments.

---

## REMnux - Linux Analysis VM

REMnux is a curated Ubuntu-based distro pre-loaded with reverse engineering and network simulation tools.

### Installation

```bash
# Option 1: Download pre-built OVA (recommended)
# https://remnux.org/#distro
# Import via VirtualBox/VMware: File → Import Appliance → remnux-vX.X.ova

# Option 2: Add REMnux to existing Ubuntu 22.04 LTS
wget https://REMnux.org/remnux-cli
mv remnux-cli /usr/local/bin/remnux
chmod +x /usr/local/bin/remnux
sudo remnux install
```

### Key Pre-Installed Tools

| Category | Tools |
|----------|-------|
| Network simulation | INetSim, FakeNet-NG |
| Traffic analysis | Wireshark, tshark, tcpdump, NetworkMiner |
| Static analysis | FLOSS, strings, binwalk, file, ssdeep |
| PDF analysis | pdf-parser, pdfid, peepdf |
| Office analysis | olevba, mraptor, msodde |
| Disassembly | Ghidra, Binary Ninja (trial) |
| Scripting | Python 3, Ruby, Node.js |
| Memory forensics | Volatility 3, bulk_extractor |

### Initial Configuration

```bash
# Update REMnux tools
sudo remnux upgrade

# Set timezone to UTC for consistent timestamps
sudo timedatectl set-timezone UTC

# Disable automatic updates (prevent unintended network activity)
sudo systemctl disable apt-daily.timer
sudo systemctl disable apt-daily-upgrade.timer

# Verify INetSim is ready
sudo systemctl status inetsim
```

### INetSim Configuration on REMnux

```bash
sudo nano /etc/inetsim/inetsim.conf
```

Key settings to configure:

```
# Bind to interface facing Windows analysis VM
service_bind_address    192.168.56.1

# DNS: respond to all queries with INetSim's own IP
dns_default_ip          192.168.56.1
dns_version             "Microsoft DNS 6.1.7601"

# HTTP/HTTPS
http_bind_port          80
https_bind_port         443
http_fakemode           yes

# SMTP
smtp_bind_port          25
smtp_banner             "220 mail.example.com ESMTP"
```

```bash
# Start INetSim
sudo inetsim

# View INetSim logs
tail -f /var/log/inetsim/service.log
```

---

## FlareVM - Windows Analysis VM

FlareVM is a Chocolatey-based installer that transforms Windows into a malware analysis workstation.

### Prerequisites

- Windows 10 (version 1903 or later) — fresh install strongly preferred
- At minimum 60 GB disk, 4 GB RAM (8 GB recommended)
- PowerShell 5+ with execution policy set to unrestricted
- .NET 4+ installed
- Disable Windows Defender and Windows Update before installing

### Disable Defender Before Installation

```powershell
# Run PowerShell as Administrator

# Disable real-time protection (temporary, for installation)
Set-MpPreference -DisableRealtimeMonitoring $true

# Disable all Defender components
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableScriptScanning $true

# Disable Windows Update
sc.exe config wuauserv start=disabled
sc.exe stop wuauserv
```

### Installation

```powershell
# Run PowerShell as Administrator
Set-ExecutionPolicy Unrestricted -Force

# Download and run FlareVM installer
(New-Object net.webclient).DownloadFile(
    'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
    "$env:temp\install.ps1"
)
Unblock-File "$env:temp\install.ps1"
& "$env:temp\install.ps1"
```

The installer opens a GUI for package selection. Installation takes 1-2 hours.

### Key Installed Tools

| Category | Tools |
|----------|-------|
| Debuggers | x64dbg, WinDbg, OllyDbg |
| Disassemblers | IDA Free, Ghidra, Binary Ninja (trial) |
| Process analysis | System Informer (formerly Process Hacker), ProcDOT, Process Monitor |
| Network | Wireshark, FakeNet-NG, TCPView |
| Static analysis | PE-bear, CFF Explorer, PEiD, Detect-It-Easy |
| String extraction | FLOSS, strings |
| .NET | dnSpy, de4dot |
| Office | olevba, oletools |
| Hex editors | HxD, 010 Editor |
| Scripting | Python 3, Ruby |

### Post-Installation Hardening

```powershell
# Disable Windows Firewall (analysis VM only — never production)
netsh advfirewall set allprofiles state off

# Disable UAC prompts that interrupt malware execution
Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0

# Show hidden files and extensions
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name Hidden -Value 1
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0
```

---

## Network Isolation Configuration

### VirtualBox Host-Only Network Setup

Host-only networking creates a private network between the host and VMs only — no internet access.

**Create Host-Only Adapter (VirtualBox):**

```
File → Host Network Manager → Create
  IPv4 Address: 192.168.56.1
  IPv4 Network Mask: 255.255.255.0
  DHCP Server: Disabled (assign static IPs manually)
```

**Configure Windows Analysis VM:**

```
VM Settings → Network
  Adapter 1: Host-Only Adapter → vboxnet0
```

**Set static IP on Windows VM:**

```
Network and Sharing Center → Change adapter settings
→ Right-click adapter → Properties → IPv4 → Manual:
  IP Address:   192.168.56.10
  Subnet Mask:  255.255.255.0
  Gateway:      192.168.56.1   (REMnux INetSim)
  DNS Server:   192.168.56.1   (REMnux INetSim)
```

**Configure REMnux VM:**

```
VM Settings → Network
  Adapter 1: Host-Only Adapter → vboxnet0
  (Static IP: 192.168.56.1 — set during OS install or via netplan)
```

### VMware Host-Only Network Setup

```
Edit → Virtual Network Editor → Add Network → VMnet1 (Host-only)
  Subnet IP: 192.168.56.0
  Subnet mask: 255.255.255.0
  Disable: Use local DHCP service
```

**Assign to analysis VM:**

```
VM Settings → Network Adapter → Custom: VMnet1
```

### Verifying Isolation

From the Windows analysis VM, confirm no external connectivity:

```cmd
# Should resolve (INetSim responds)
nslookup google.com

# Should fail (no external routing)
ping 8.8.8.8

# Verify gateway is INetSim, not external router
tracert google.com
```

From REMnux, confirm INetSim is intercepting:

```bash
# Watch live connections from Windows VM
tail -f /var/log/inetsim/service.log
```

---

## Snapshot Management

Snapshots are the single most important operational practice. A corrupted or infected baseline wastes hours.

### Snapshot Strategy

**Baseline snapshot** — taken once after clean VM build, before any analysis:
- OS fully patched (final time)
- All analysis tools installed and tested
- INetSim/FakeNet configured
- Sysmon installed with SwiftOnSecurity config
- Defender disabled
- Named: `BASELINE-CLEAN-YYYY-MM-DD`

**Pre-execution snapshot** — taken at the start of each analysis session:
- All monitoring tools open and ready (Procmon capturing, Wireshark running)
- INetSim running on REMnux
- Sample copied to VM but not yet executed
- Named: `PRE-EXEC-<sample-hash>-YYYY-MM-DD`

**Mid-analysis snapshots** — optional, taken at significant milestones:
- After installation phase completes
- Before triggering a specific behavior
- Named: `MID-<phase>-<sample-hash>`

### VirtualBox Snapshot Commands

```bash
# List snapshots
VBoxManage snapshot "Windows10-Analysis" list

# Take snapshot
VBoxManage snapshot "Windows10-Analysis" take "PRE-EXEC-abc123-2024-01-15" \
  --description "Sample abc123 loaded, tools running"

# Restore snapshot
VBoxManage snapshot "Windows10-Analysis" restore "BASELINE-CLEAN-2024-01-01"

# Delete old snapshots (free disk space)
VBoxManage snapshot "Windows10-Analysis" delete "MID-install-abc123"
```

### VMware Snapshot Commands

```bash
# Take snapshot (VMware CLI)
vmrun snapshot /path/to/vm.vmx "PRE-EXEC-abc123-2024-01-15"

# Revert to snapshot
vmrun revertToSnapshot /path/to/vm.vmx "BASELINE-CLEAN-2024-01-01"

# List snapshots
vmrun listSnapshots /path/to/vm.vmx
```

### Discipline Rules

- **Always revert to baseline after each sample** — never analyze two samples in the same session without reverting
- **Never take a snapshot while malware is running** — the snapshot captures infected state
- **Store baseline OVA/OVF off the analysis machine** — backup in case of host compromise
- **Label snapshots with dates** — baselines age; tools need updates

---

## VM Detection Countermeasures

Malware commonly fingerprints VMs to avoid analysis. See `references/anti_analysis_bypass.md` for full bypass techniques. Common baseline hardening steps:

### Hardware Fingerprint Spoofing

**VirtualBox — spoof BIOS/hardware strings:**

```bash
# Run on host before starting VM
VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor" "American Megatrends Inc."

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "MS-7B86"

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor" "MSI"

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiChassisVendor" "MSI"
```

**Spoof MAC address (remove VirtualBox OUI 08:00:27:xx:xx:xx):**

```
VM Settings → Network → Advanced → MAC Address → Generate new
```

Or set manually to a real vendor OUI (e.g., Intel: `8C:8D:28`):

```bash
VBoxManage modifyvm "Windows10-Analysis" --macaddress1 "8C8D28AABBCC"
```

### Remove VM Artifacts on Windows Guest

```powershell
# Remove VirtualBox Guest Additions (if installed)
# Control Panel → Programs → Uninstall VirtualBox Guest Additions

# Remove VMware Tools
# Control Panel → Programs → Uninstall VMware Tools

# Remove obvious registry keys
Remove-Item -Path "HKLM:\SOFTWARE\Oracle\VirtualBox Guest Additions" -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SOFTWARE\VMware, Inc." -Recurse -ErrorAction SilentlyContinue

# Remove VBox/VMware processes from autostart
# Check: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
```

### Screen Resolution and User Activity

```
Set VM resolution to common values: 1920x1080 or 1366x768
Create desktop shortcuts, browser history, recent documents
Place realistic-looking files in Downloads, Documents, Desktop
Add a few installed applications (Chrome, 7-Zip, Notepad++)
```

### Testing VM Hardening

Use pafish (Paranoid Fish) to verify detection resistance:

```
# Download: https://github.com/a0rtega/pafish
# Run pafish.exe in the VM
# Each red "FAIL" is a detectable artifact
# Aim for all green before analyzing evasive samples
```

---

## CAPE Sandbox - Local Automated Sandbox

CAPE (Config And Payload Extraction) automates dynamic analysis at scale.

### Quick Install (Docker)

```bash
# Clone CAPE
git clone https://github.com/kevoreilly/CAPEv2.git
cd CAPEv2

# Use Docker Compose (simplest setup)
sudo docker-compose up -d

# Web interface available at:
# http://localhost:8000
```

### Submit Sample via CLI

```bash
# Submit file
python3 utils/submit.py --file /path/to/sample.exe

# Submit with options
python3 utils/submit.py \
  --file /path/to/sample.exe \
  --timeout 120 \
  --options "procmemdump=yes,extraction=yes"
```

### Submit via Web UI

```
http://localhost:8000/submit
→ Upload file
→ Set timeout (60-300 seconds)
→ Select package (exe, dll, doc, pdf, etc.)
→ Submit
```

### Retrieve Report

```bash
# List tasks
python3 utils/process.py -r <task_id>

# Reports stored at:
# /opt/CAPEv2/storage/analyses/<task_id>/reports/report.json
```

---

## Troubleshooting

**Windows VM has internet access (should not):**
- Verify adapter is Host-Only, not NAT or Bridged
- Check default gateway points to INetSim IP, not router IP
- Disable any secondary adapters

**INetSim not responding to DNS queries:**
- Confirm `service_bind_address` matches REMnux's host-only IP
- Check INetSim is running: `sudo systemctl status inetsim`
- Verify no firewall blocking port 53 on REMnux: `sudo ufw status`

**Snapshot restore fails (VirtualBox):**
- Ensure VM is fully powered off before restoring
- Verify sufficient disk space on host
- Try: `VBoxManage snapshot <vm> restorecurrent`

**FlareVM installation fails partway through:**
- Re-run installer — Chocolatey packages are idempotent
- Check Windows Update is fully disabled
- Verify Defender exclusions cover `C:\ProgramData\chocolatey`

**pafish detects VM even after hardening:**
- Check CPUID hypervisor bit: requires CPU passthrough or nested virt disabled
- VMware: add `hypervisor.cpuid.v0 = FALSE` to .vmx file
- VirtualBox: `VBoxManage modifyvm <vm> --paravirtprovider none`