{"id":14,"date":"2022-01-13T22:39:21","date_gmt":"2022-01-13T22:39:21","guid":{"rendered":"https:\/\/blogs.oregonstate.edu\/lauramaree\/?p=14"},"modified":"2022-01-13T22:42:55","modified_gmt":"2022-01-13T22:42:55","slug":"pro-tip-dont-do-malware-analysis-directly-on-your-machine","status":"publish","type":"post","link":"https:\/\/blogs.oregonstate.edu\/lauramaree\/2022\/01\/13\/pro-tip-dont-do-malware-analysis-directly-on-your-machine\/","title":{"rendered":"Pro Tip: Don’t do Malware Analysis Directly on your Machine."},"content":{"rendered":"\n

Some exciting news: the topic I will be focusing on for the Capstone project is malware analysis. This will be a great opportunity to dissect some malicious software, learn from it, gain experience using analysis tools, and report my findings and recommendations. This is all fine and dandy, but there’s an issue here. Interacting with malware and even having it on your machine could be very harmful and dangerous. So what do we do? <\/p>\n\n\n\n

Well, Using virtual machines is not new to me, so I’m familiar with setting up a VM with VMware. Just doing this is not sufficient due to the risk of the malware escaping to the network your own machine runs on. But after some research, I was able to find a way to define a virtual network separate from my local network with multiple virtual machines. This separate virtual network has not connection to my local network, preventing malware escape.<\/p>\n\n\n\n

To set this up, VMware should be installed (you can also create a few VM’s with your OS of choice). You need to navigate to the Virtual Network Editor<\/em> either via the search bar in Windows, <\/p>\n\n\n\n

\"\"
Search for Virtual Network Editor App<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

or in VMware via Edit > Virtual Network Editor<\/em>. <\/p>\n\n\n\n

\"\"
Virtual Network Editor App via VMware<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

Now, it’s really important to either choose a network not being used, or add a new network we can edit the specifications of. Here, I decided to add the VMnet4 network via Add Network<\/em>:<\/p>\n\n\n\n

\"\"
Select\/create VMnet not currently being used<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

Now, we can edit the VMnet information and specifications to fit our use case. First, selected Host-only<\/em> to ensure the virtual network does not connect to the external local network. Second, uncheck Connect a host virtual adapter to this network<\/em> as it is not needed. Lastly, we want to make sure Use local DHCP service to distribute IP address to VMs<\/em> is checked so that IP’s are assigned automatically to our VM’s via DHCP (Dynamic Host Configuration Protocol). Select OK<\/em> to setup this new virtual network.<\/p>\n\n\n\n

\"\"
Edit options for custom VMnet<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

So the network is set up, but we need to assign the VM’s that we have created to use that network, and that network only. In VMware, before starting a VM, go to VM > Settings<\/em>:<\/p>\n\n\n\n

\"\"
Navigate to VM Settings<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

This will bring up a Settings window where you can navigate to the Network Adapter <\/em>menu. In this menu, under Network connection<\/em>, select Custom<\/em> and the virtual network we just set up (in this case VMnet4<\/em>). Select OK<\/em>, and the VM is now on our custom virtual network! <\/p>\n\n\n\n

\"\"
Select custom VMnet to run on<\/figcaption><\/figure><\/div>\n\n\n\n

<\/p>\n\n\n\n

We can now feel confident that our VM is on a virtual network that is isolated from our local network and that the malware we will be interacting with will stay on this same virtual network. <\/p>\n\n\n\n

<\/p>\n\n\n\n

References:<\/p>\n\n\n\n

L. Zeltser, \u201cVirtualized network isolation for a malware analysis lab,\u201d Lenny Zeltser Content<\/em>, 09-Feb-2015. [Online]. Available: https:\/\/zeltser.com\/vmware-network-isolation-for-malware-analysis\/. [Accessed: 13-Jan-2022].<\/p>\n","protected":false},"excerpt":{"rendered":"

Some exciting news: the topic I will be focusing on for the Capstone project is malware analysis. This will be a great opportunity to dissect some malicious software, learn from it, gain experience using analysis tools, and report my findings and recommendations. This is all fine and dandy, but there’s an issue here. Interacting with … Continue reading Pro Tip: Don’t do Malware Analysis Directly on your Machine.<\/span><\/a><\/p>\n","protected":false},"author":11902,"featured_media":26,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/users\/11902"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/comments?post=14"}],"version-history":[{"count":2,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/posts\/14\/revisions"}],"predecessor-version":[{"id":23,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/posts\/14\/revisions\/23"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/media\/26"}],"wp:attachment":[{"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/media?parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/categories?post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/lauramaree\/wp-json\/wp\/v2\/tags?post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}