cs7038 malware analysis wk01 2 virtualbox lab setup and
play

CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash - PowerPoint PPT Presentation

Dec 17, 2023 •406 likes •557 views

CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash Course Coleman Kane kaneca@mail.uc.edu January 12, 2017 VirtualBox Virtualization is a feature present in nearly all consumer CPUs these days that enables you to

  1. CS7038 - Malware Analysis - Wk01.2 VirtualBox Lab Setup and Crash Course Coleman Kane kaneca@mail.uc.edu January 12, 2017 � �

  2. VirtualBox Virtualization is a feature present in nearly all consumer CPUs these days that enables you to virtualize a whole hardware system, using software features of your computer, yet still run at near-native execution speeds. I’ll be using Oracle’s VirtualBox product ( https://virtualbox.org ) for the labs in this class, and you are strongly encouraged to learn this tool as well, even if you already are more familiar with the competing VMWare product from Dell. Some reasons I prefer VirtualBox: Open-sourced GPL community-driven project, with minimal usage • restrictions Same UI across Windows, Linux, FreeBSD, MacOS • Supports creating complex virtual network layouts • Supports some Paravirtualization (PVM) features • Full command-line interface alternative, fully scriptable • � �

  3. VirtualBox Resources Since it is a community-supported project, with some vendor assistance from Oracle, there’s an awful lot of documentation. Download: • https://www.virtualbox.org/wiki/Downloads User Manual: • https://www.virtualbox.org/manual/UserManual.html Community Support: • https://www.virtualbox.org/wiki/Community Once installed, a good place to visit would be the walkthroughs and overview in Chapter 1: https://www.virtualbox.org/manual/ch01.html • � �

  4. VirtualBox for Your Lab The following features of VirtualBox will be helpful for your lab environment: Snapshots & Cloning • Import/Export of Appliances • Virtual networking options • Shared Folders • VirtualBox Guest Additions • 2D (& even 3D) acceleration • A well organized malware lab is an effective malware lab. Always handle with care. � �

  5. Getting a Virtual Machine There are three common methods to getting a Virtual Machine set up: Import an appliance: Imports disk image + VirtualBox system • config in one bundle Install from media: Create an empty disk, custom VM, and use • installation media supplied by OS provider, just like building a new computer Attach Disk Image: OS and software already installed on disk • image, but need to configure a new VM to attach it to The method used will vary depending upon how the media is provided to you from your software provider. We will cover the first two methods in our lecture. � �

  6. Most Familiar: Install from media It is most common to install software into VirtualBox using installation media, such as an ISO9660 DVD image. We can easily get copies of GNU/Linux from various distribution websites. For Windows images, those of you with a UC account can download the Windows 10 student edition using DreamSpark. Others may be able to download Windows 10 images from Microsoft’s website, and use the product code provided with their laptop/desktop to install a “registered” OS. GNU/Linux offerings: Ubuntu Desktop: https://www.ubuntu.com/download/ • desktop Linux Mint: https://www.linuxmint.com/download.php • LUbuntu Desktop: http://lubuntu.net/ • Unless specifically noted, it is recommended to always download the 64-bit images. No significant resource savings are gained by trying to use a 32-bit OS, and this might introduce complications. � �

  7. Steps to install from media This approach typically takes a few steps: Download install media • Create new VM with proper configuration for your OS choice, and • sufficient hard disk space Attach the downloaded ISO media to the virtual CD drive of the VM • Boot the VM (you may need to press F12 on boot if the VM doesn’t • automatically try booting off the CD) Walk through the install, just like if you did it on a real computer • Upon completion, shut down the VM and then modify the VM • configuration to “eject” the virtual CD � �

  8. Notes on Installing Windows 10 Education Edition When you install Windows 10 in your lab, you will want to be sure to turn off a lot of the telemetry features and some common security mitigations that may interfere with malware analysis. During the first stage of setup, after install from media completed and the system reboots the first time, I chose the customize settings option and explicitly turned off ALL of the features that it asked about. It may ask how you intend to connect to a network. I chose Join a local Active Directory domain . After that, it let me create a new local user account and never asked about Domain-specific credentials. � �

  9. Easiest: OVA Import In general, you download a file from the provider that has a *.ova extension. This single file contains the hard disk image(s) and all the configuration options that were chosen by the original VM author. The process for importing these is straightforward: Download the OVA file • In VirtualBox go to the File menu, and choose the Import • Appliance... option Use the form to select the downloaded OVA file for import • Tweak the configuration (if desired) prior to import • Click Import button • � �

  10. Sources for OVA Images Useful OVA sources: Microsoft Modern.IE Website • https://developer.microsoft.com/en-us/microsoft-edge/ tools/vms/ Offensive Security Kali Download • https://www.offensive-security.com/ kali-linux-vmware-virtualbox-image-download/ Remnux Distribution https://remnux.org/#distro • Remember - these are installed OS images, and typically have very basic default usernames/passwords and even running services that you may want to tweak before using them. � �

  11. OVA Export You may also choose to create your own OVA files. This can be very helpful after you’ve set up your VirtualBox labs with tools and configurations. The process for exporting: In VirtualBox go to the File menu, and choose the Export • Appliance... option Use the form to select the VM you’d like to export • Choose the OVF 1.0 format (the 2.0 format is experimental, as of • 2017-01-12) Add descriptive information about your appliance • Click Export button • You now have an appliance that can be imported into another VirtualBox session, or even re-imported into this one. � �

  12. Snapshots A VM execution instance consists of three components: Persistent storage (disk) • VM configuration (HW to simulate, behavior, etc.) • Run-time state (what’s going on in memory) • The snapshots feature in VirtualBox allows us to save copies of varying run-time versions of suspended and powered-off virtual machines, enabling us to revert back to them in the future. This functionality will be used heavily when doing run-time execution analysis of malware samples. Since malware frequently can make irreperable and even unexpected changes to a system, the feature enabling reverting to a “ known clean ” state is very helpful, in that it eliminates unnecessary VM rebuilds. � �

  13. Virtual Networking VirtualBox offers numerous network configurations, and each VM can have up to 4 virtualized network interfaces configured each to be any one of the following: Detached • NAT • NAT Network • Bridged • Internal Network • Host-only Network • 3rd-party driver support • Ones that we will primarily focus on during class are highlighted in bold above. More elaborate discussion of the above modes is provided here: https://www.virtualbox.org/manual/ch06.html � �

  14. Functional OVA Images As with OVA files we can now distribute pre-installed OS images, we also have the capability to prepare the OS environment for specific purposes. It is becoming increasingly popular to distribute function-specific OS configurations. Some of these are listed below: Kali : A linux distribution that is preloaded with a number of common • penetration-testing tools, including malware creation - https://www.kali.org Remnux : A linux distribution pre-loaded with tools for analyzing • malware and system forensics - https://remnux.org VulnHub : An archive of a large amount of pre-configured vulnerable • system images that can be attacked with malware. Many distributed as OVA files - https://www.vulnhub.com � �

Recommend

CS7038 - Malware Analysis - Wk02.2 Attack Introduction Coleman Kane kaneca@mail.uc.edu January

CS7038 - Malware Analysis - Wk02.2 Attack Introduction Coleman Kane kaneca@mail.uc.edu January

CS7038 - Malware Analysis - Wk02.2 Attack Introduction Coleman Kane kaneca@mail.uc.edu January 18, 2018 Content This lecture covers the following concepts: Demo setting up specific lab environments in VirtualBox Utilizing

393 views • 11 slides
CS7038 - Malware Analysis - Wk02.1 Attack Introduction Coleman Kane kaneca@mail.uc.edu January

CS7038 - Malware Analysis - Wk02.1 Attack Introduction Coleman Kane kaneca@mail.uc.edu January

CS7038 - Malware Analysis - Wk02.1 Attack Introduction Coleman Kane kaneca@mail.uc.edu January 17, 2017 Content This lecture covers the following concepts: Setting up lab environments in VirtualBox Utilizing networking and

226 views • 8 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu February 22, 2018 Exploring the Online Ecosystem One nice aspect of malware analysis is that, since much of it originates online and

119 views • 10 slides
CS7038 - Malware Analysis - Wk09.1 Analysis of PDF and Office Documents Coleman Kane

CS7038 - Malware Analysis - Wk09.1 Analysis of PDF and Office Documents Coleman Kane

CS7038 - Malware Analysis - Wk09.1 Analysis of PDF and Office Documents Coleman Kane kaneca@mail.uc.edu March 20, 2018 PDF Document Overview We looked at PDF documents briefly during Week 2. PDF documents are intended to be a

515 views • 13 slides
CS7038 - Malware Analysis - Wk04.1 Static Analysis Introduction Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk04.1 Static Analysis Introduction Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk04.1 Static Analysis Introduction Coleman Kane kaneca@mail.uc.edu February 1, 2017 Static Analysis Static Analysis is the process of documenting your observations about what identifying characteristics a

575 views • 8 slides
CS7038 - Malware Analysis - Wk08 Analysis of C Data Types Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk08 Analysis of C Data Types Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk08 Analysis of C Data Types Coleman Kane kaneca@mail.uc.edu February 28, 2017 Data Structures Explained Computing systems are built around data, and in particular, structured data . This has the feature

659 views • 7 slides
CS7038 - Malware Analysis - Wk06 Deeper Dive: x86 32/64 Assembly Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk06 Deeper Dive: x86 32/64 Assembly Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk06 Deeper Dive: x86 32/64 Assembly Coleman Kane kaneca@mail.uc.edu February 22, 2017 A Deeper Look Previous lecture focused on introducing assembly language and how program can be broken up from source

252 views • 7 slides
CS7038 - Malware Analysis - Wk05.1 Static Analyzers Coleman Kane kaneca@mail.uc.edu February 7,

CS7038 - Malware Analysis - Wk05.1 Static Analyzers Coleman Kane kaneca@mail.uc.edu February 7,

CS7038 - Malware Analysis - Wk05.1 Static Analyzers Coleman Kane kaneca@mail.uc.edu February 7, 2017 Signature-based Anti-Virus Systems By far, the most popular weapon against cyber attacks is signature-based antivirus software. When

709 views • 12 slides
CS7038 - Malware Analysis - Wk03 Container Model of Data Files Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk03 Container Model of Data Files Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk03 Container Model of Data Files Coleman Kane kaneca@mail.uc.edu January 25, 2018 Data Organization Models Data organization in a computing system is frequently standardized, so that applications can

320 views • 9 slides
Suricata Tutorial FloCon 2016 Agenda Setup Introduction to Suricata Suricata as

Suricata Tutorial FloCon 2016 Agenda Setup Introduction to Suricata Suricata as

Suricata Tutorial FloCon 2016 Agenda Setup Introduction to Suricata Suricata as a SSL monitor Suricata as a passive DNS probe Suricata as a flow probe Suricata as a malware detector VirtualBox setup File ->

1.16k views • 78 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
Hands on Virtualization with Ganeti OSCON 2011 Setup Guide This setup guide covers installing and

Hands on Virtualization with Ganeti OSCON 2011 Setup Guide This setup guide covers installing and

Hands on Virtualization with Ganeti OSCON 2011 Setup Guide This setup guide covers installing and running Ganeti and Ganeti Web Manager . Well be using three VirtualBox images to simulate a 3-node cluster using DRBD. You can download the images

519 views • 12 slides
MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me Malware RE @ Trusteer, IBM, Seculert binary analysis automation sandbox development Now in vEYE Security on software container

591 views • 48 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Setup your laptop for PDF workshop Copy directory files from DVD to your HD Unzip

Setup your laptop for PDF workshop Copy directory files from DVD to your HD Unzip

Setup your laptop for PDF workshop Copy directory files from DVD to your HD Unzip VM\BT4-R1.zip from DVD to your HD Return DVD to me Start VM (VirtualBox: create new VM, use .vmdk) Logon BackTrack4: user root

84 views • 4 slides
Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev

Examples of modern malware Malware Analysis Seminar Meeting 7 Cody Cutler, Anton Burtsev Stuxnet (2009) Organization Core a large .dll file 2 encrypted configuration files Dropper component Core in a stub section

703 views • 43 slides
T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide Balzarotti ACSAC, Orlando, Florida, 3-7 December 2012 Malware Analysis Scenario Analysis based on Sandboxes (API Hooking, Emulation)

798 views • 23 slides

More recommend