MAA
Start free

Windows Analysis VM with VirtualBox

WindowsHypervisor: VirtualBoxToolchain: FLARE-VM

Windows Analysis VM with VirtualBox

Prerequisites

  • Host machine with at least 16GB RAM and 100GB free disk space
  • VirtualBox 7.x installed from virtualbox.org
  • Windows 10/11 ISO (evaluation version from Microsoft)

Step 1: Create the VM

  1. Open VirtualBox → New
  2. Name: MalwareAnalysis-Win10
  3. Type: Microsoft Windows, Version: Windows 10 (64-bit)
  4. Memory: 4096 MB minimum (8192 MB recommended)
  5. Hard disk: Create a virtual hard disk (VDI, dynamically allocated, 60GB)

Step 2: VM Settings

  1. System → Processor: 2+ CPUs
  2. Network → Adapter 1: Host-only Adapter
  3. Shared Folders: DISABLED (critical for safety)
  4. General → Advanced: Disable clipboard sharing

Step 3: Install Windows

  1. Mount Windows ISO to optical drive
  2. Boot and install Windows
  3. Skip product key activation
  4. Disable Windows Update (for analysis stability)
  5. Disable Windows Defender protections (see below)

Step 4: Pre-Install Safety Settings (FLARE-VM Requirements)

FLARE-VM recommends disabling the following Windows Defender features:

  • Real-time protection
  • Cloud-delivered protection
  • Automatic sample submission
  • Add C: to the exclusion list

Take a clean snapshot after these changes.

Step 5: Install FLARE-VM

# Open PowerShell as Administrator
Set-ExecutionPolicy Unrestricted -Force
# Download installer to Desktop
(New-Object net.webclient).DownloadFile(
  'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
  "$([Environment]::GetFolderPath("Desktop"))\install.ps1"
)
cd $([Environment]::GetFolderPath("Desktop"))
Unblock-File .\install.ps1
.install.ps1
# Optional: pass password and run in CLI-only mode
# .install.ps1 -password <password> -noWait -noGui

Step 6: Install Additional Tools

  • Procmon & Process Explorer: Included in FLARE-VM
  • FakeNet-NG: Included in FLARE-VM
  • Wireshark: Included in FLARE-VM
  • PEStudio: Download from winitor.com
  • CAPA: Included in FLARE-VM

Step 7: Take Clean Snapshot

  1. Shut down the VM cleanly
  2. VirtualBox → Snapshots → Take Snapshot
  3. Name: Analysis-Ready-Clean
  4. Always revert to this snapshot before analyzing a new sample

Network Verification

ipconfig
# Should show Host-only adapter with 192.168.56.x address
ping 8.8.8.8
# Should FAIL (no internet access)

Safety Checklist

  • Host-only networking configured
  • Shared folders disabled
  • Clipboard sharing disabled
  • Windows Defender disabled
  • Clean snapshot taken
  • FakeNet-NG tested and working
Windows Analysis VM with VirtualBox | Malware Analysis Academy