Cloud-Hosted-Malware-Analysis

Cloud Hosted Malware Analysis Machine

The Objectives of this Project :

Set up an Amazon server that will host a Windows with FlareVM and a server running Apache Guacamole that can be used to supply a virtual network that can transfer malicious files.

Expectations :

You should already have an AWS account that is verified and ready to set up Cloud-Based Virtual Machines.

The Machines that will be used :

A windows machine with FlareVM will be installed that does not have access to the internet.

Step 1 : Create the Windows AWS Machine Instance with EC2

We are going to configure a new VM instance in the AWS Instance Manager with Windows 2022 Base Selected.

We are then going to create a new RSA key pair with defualt settings and put the instance type to medium.

Then, Keep all of the Network Settings default and change the storage size to 60 gb.

Next, we use our Private Key that we generated to get the password to the VM

Now your Cloud-Hosted Virtual Machine is up and running!

Once our VM is powered up and ready, we can go to microsoft edge and download this github script : https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1

After our installer for FLareVM is installed, we can run the file in Powershell with .\install.ps1. This process might take a while...

Now, we can create a image so that we can revert to a version not affected by malware.

At this point we have to download a plugin for Apache Guacamole through Amazon Marketplace :

(image via cyberacademy)

We will now add a new user to AmazonEC2FullAccess user group with a new access key and make sure console sign in is true.

Now, we will move onto an ubuntu terminal and setup Terraform, it is recommended that you make a new folder for this project, and the Terraform setup can be found at https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli

After Terraform is installed, you can download aws client through this command : sudo apt install awscli -y, and you can clone this repo for the network preset : git clone https://github.com/adanalvarez/AWS-malware-lab

Finally, we can configure Terraform with a new file in your folder : nano shared.auto.tfvars.json, and add this configuration file with all of your current account information updated :

{ "environment": "malware-lab", "ami": "ami-xxxxxxxxxxxxxxxxx", "account" : "222222222222", "region": "us-east-1", "enable_guacamole": false, "enable_inetsim": true }

To wrap up, run terraform init to initialize the environment,

$ terraform init, to initize environment

- $ terraform plan, to upload the changes

- $ terraform apply, to update your configs to AWS

- $ terraform destroy, to shutdown systems

Have fun uploading and analyzing malicious files in your new network!

Resources used :

Youtube Video : https://www.youtube.com/watch?v=rmSIm3BKu3Y

Terraform : https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli

Preset for AWS Network : https://github.com/adanalvarez/AWS-malware-lab

PDF : Cloud-Hosted-Malware-Analysis-Lab.pdf