[Part 1] Creating a safe (and functional) RE environment on Apple Silicon - VMWare Fusion

Introduction

#

The purpose of this article is to provide reverse engineers with a framework to build and deploy a safe malware analysis environment on Apple Silicon machines. We will talk through how to successfully deploy a Windows 10/11 endpoint via VM, an ARM Linux machine and the most useful tools to install on either machine to make your life easier when it comes to analysis.

At present, it can be quite confronting for malware analysts to make the jump from x86 to ARM processors for their research. Understandably so, since there is some weight to the argument that x86 tech cannot run effectively on ARM-based processors (particularly when you’re speaking about historical operating systems like Windows 7, Windows XP and Windows servers). But to that, I say, pah! There are definitely resources available to you right now that enable you to effectively and efficiently virtualise these legacy systems on Apple Silicon.

I’d like to remind folks reading that this blog post is subject to change as and when more companies start leveraging ARM-based technology to power virtualisation. I’ll endeavour to update this as and when I learn and discover more about the progress made to support ARM virtualisation and malware analysis.

The Analysis Environment

#

Your setup will entirely depend on what types of malware you intend on primarily analysing. In the case of this article, we will be covering the two of the three key operating systems: Windows and Linux. MacOS is unfortunately not supported by VMWare Fusion at present, so we will cover UTM and MacOS virtualisation in a separate article. My own personal environment is reflected by Figure 1 below:

Though certainly not necessary, it’s nice to have one of each operating system type to enable you to easily and quickly spin up a machine when the time comes for analysis.

Note that we will not be covering the installation process of the MacOS machine in this blog. That will be completed in a separate entry to this series.

Virtualisation Platforms

#

As Apple continues to invest and release ARM processors, there has been a slow uptake in companies building virtualisation platforms that enable you to appropriately virtualise the key operating systems for broader malware analysis. Coupled with this, Apple has developed a virtualisation framework to enable those interested to effectively build their own virtualisation platform on Apple Silicon endpoints.

If you’re interested, you can check out the documentation and its respective tutorial here.

Here, we will cover set up using VMWare Fusion .

Note that not all available virtualisation platforms will be covered in these articles. The major focus are on the cheap price to entry models, namely UTM and VMWare Fusion.

VMWare Fusion - Windows

#

The following section requires VMWare Fusion to be installed on your MacBook. Please follow the above link to download and install the program successfully on your computer.

Microsoft has released an ARM version of their latest operating systems (Windows 10 and Windows 11) that you can deploy to your M series MacBook (woohoo!). In order to download, you must sign up to Microsoft’s insider program. Now strap in, the installation and configuration process for this one is well honestly, a bit of nonsense.

Installation Steps:

#

1. Download the ARM installer from Microsoft. It can be a bit of a pain to find the iso after signing up, so just re-click the link provided her, and it should take you immediately to the download page on the site.
2. Once downloaded, you’ll need to convert the VHDX file to a VMDK to make it compatible for VMWare Fusion. Open your terminal and enter the following commands:

# install qemu
brew install qemu

# check information about the VHDX virtual disk: 
sudo qemu-img info Windows11_InsiderPreview_Client_ARM64_en-us_22598.VHDX

# convert VHD to VMDK, include -p to show progress of conversion
sudo qemu-img convert Windows11_InsiderPreview_Client_ARM64_en-us_22598.VHDX -O vmdk Windows11_ARM.vmdk -p

3. Open VMWare Fusion and select File > New Virtual Machine. A pop-up will launch titled “Select the Installation Method”

   

4. From here, drag and drop your new Windows 11 vmdk file over the ‘Install from disc or image’ in the screenshot above. The prompt will immediately change, allowing you to configure the virtual machine. When you reach "Choose a virtual disk", ensure that you select "use an existing virtual disk" and select the newly created vmdk file again here. This will ensure that you don’t encounter problems once completing the install process.

If you intend on installing FlareVM, make sure that you allocate a bit more hard drive capacity (at least 100GB I would say) to ensure that the installation process does not fail. If you forget to complete this, you can change it on creation of the VM which is handy, by navigating to settings and increasing the drive volume.

5. Once you select Finish and finalise the process, a new window will pop open. This is your virtual machine. The operating system should start booting and look something like the following:

6. When the first installation page loads, do not continue with the installation. Instead, install VMWare tools to enable networking. Press Shift + F10 to open a terminal to write the following commands:

   

# change into the oobe (out of the box experience) folder
> cd oobe

# type the following command
> bypassnro.cmd

# windows will restart and when prompted for internet access
# you'll be able to select 'i dont have internet' and 
# 'continue with limited setup'

# continue with set up and turn off microsoft telemetry

7. Complete the Windows 11 installation process. You shouldn’t be prompted by Microsoft to enter in any email information during this process due to the lack of internet connection.

Once finished, we will need to disable Windows Defender and reinstall VMWare tools to enable proper networking.

Reinstall VMWare Tools:

#

1. Select Virtual Machine from the top bar and hit Reinstall VMWare Tools. This will map the tools to D: drive.
2. Navigate to D: drive using explorer. Double-click on setup.exe and proceed through the installation process
3. Restart the VM
4. Confirm you are connected to the internet by navigating to a website via Edge and double-checking the adapter icon in the bottom right-hand side of the taskbar.

Disable Windows Defender

#

An optional process that will likely save you some time and frustration when completing Windows-based malware analysis on this machine in future.

All credit for this section goes to OA Labs (video linked in the reference section) in walking through how to disable Windows Defender on Windows 11.

1. Open msconfig by typing msconfig into the search bar on your VM
2. Navigate to the boot tab and select safe boot > minimal
3. Restart the machine
4. Open explorer and type %ProgramData% and double-click on Microsoft. FInd Windows Defender folder from this list and right-click, select properties.
5. Navigate to the security tab and click advanced
6. Click the change link next to Owner: SYSTEM and click advanced
7. Select administrator by clicking the find now button on the right-hand side of the pop-up, This will grant you access to change permissions of the folder. Select okay until you have returned to the Advanced Security Settings for Windows Defender popup.
8. Check the Replace all child object permissions with inheritable permission entries from this object box and then select the TrustedInstaller user from the list and remove their permissions. Repeat for the other users in the list until it is empty.
9. Apply the changes and select okay or yes for each prompt
10. Open up msconfig again, navigate to the boot tab and disable safe mode.
11. Restart your computer and defender should no longer be present, as no one can access the folder

You can test that this works by searching for windows security from the taskbar. When you click this option, you should have a prompt that informs you that no one has access to the folder to open this.

Before proceeding to the next step, snapshot your Windows 11 VM. I like to call this one Clean with a description of the work i have completed thus far i.e disabled defender, internet connected.

Install Flare VM

#

Download the FlareVM repo from github whichever way you prefer (via web browser or terminal or otherwise).

Note that Flare requires at least 60GB of disk space to install all the tools, so hopefully you followed the installation advice of upping the total storage amount when prompted.

These days, Flare is relatively easy to install, with the mandiant team doing some amazing work to make it simpler to use. Follow the guidance provided by the team in their readme for optimal results. The basic gist being:

1. Disable Windows Updates (follow this advice)
2. Disable Windows Defender (which we have already done)
3. Take a VM snapshot so you can revert to a state before the Flare install
4. Complete the installation steps provided on the readme
5. Probably make a cup of tea or coffee too… Flare can take a while to install successfully

Once this has finished, do a bit of a victory dance, because you have finally and successfully set up all the configuration elements to your Windows malware analysis machine at this point. Phew, what a process.

VMWare Fusion - Debian Linux

#

The following section requires VMWare Fusion to be installed on your MacBook.

You can download the ARM version of Debian here then complete the following steps:

1. Just like with your Windows install, drag and drop the downloaded ARM Debian ISO onto the Create a New Virtual Machine popup
2. Select your Debian iso. If it isn’t present in the list, then click the Use another disc or disc image option.
3. Customise settings if you are unhappy with the defaults and select finish when done
4. Select an appropriate name for your VM such as Linux Malware Analysis

Compared to Windows, that was a bit simpler. But we aren’t quite done yet.

Installing and configuring the VM

#

1. Select “Graphical Install” and proceed through the steps as is tradition.
2. Select “Debian Desktop Environment” and “GNOME” (or your preferred option) on the software selection page to ensure the GUI is installed.

Note that during the installation process, if you set a root password, your user will not be in the sudoers file.

Now we are ready for the final configuration step, setting up inetsim and creating a VLAN in VMWare Fusion

VMWare Fusion - MacOS

#

The following section requires VMWare Fusion to be installed on your MacBook.

Unfortunately, MacOS is not supported by VMWare Fusion for virtualisation as of writing this post. Makes for some frustrating times, but, it is not the end of the world. I’ll be covering another program called UTM in the next instalment of this blog that natively supports MacOS virtualisation for the purposes of malware reverse engineering.

Networking Machines

#

Now that we have all the images sorted, it’s time to actually configure our internal malware network to enable each machine to talk to each other.

Why is this important?

#

A great question! Often, when we perform dynamic analysis on samples, malware will attempt to perform various functions over the internet. Because we are operating in an internet-free zone, it might cause the malware to crash or close itself, so you can no longer perform analysis on the sample. Thus, we set up inetsim on our Linux machine so that it can serve the function of our DNS server and trick the malware that additional payloads are being downloaded, for example, meaning it won’t close down.

The Setup

#

The analysis diagram of my malware environment shows you roughly what we are intending to complete. We will begin with configuring an internal malware network on all three VMs and then setting our Debian box as the DNS server for both the Mac and Windows machines.

Our objective here is to make both the Windows and Debian systems talk effectively to each other, running inetsim. Installation and setup of this program allows a deeper knowledge and understanding of network indicators present in some (most) strands of malware.

Creating the VLAN in VMWare Fusion

#

1. From the top bar, select VMWare Fusion > Settings > Network
2. Click the lock at the bottom of the network panel and enable changes
3. Click the plus button at the bottom of the network panel and type into the subnet IP 10.10.10.0 or whatever your number preference is. Additionally, make sure that the allow virtual machines on this network to connect to external networks (using NAT) is unticked. You can optionally configure this to work via IPv6 if you’d like, I just normally opt for IPv4.
4. Click apply
5. Double-click the newly created network and rename it to something that stands out to you - like Malware Analysis
6. When you’re happy with the changes, click the lock again to prevent further changes to your configs

And you’re done! This new network should now be available to select for all of your virtual machines. You can add the hosts to it and confirm that the internet cannot be accessed by any of the machines.

Installing and configuring inetsim on Debian

#

This is a very handy program that serves the default inetsim file with the name of any requested file. It serves as a nice way to trick malware into thinking that it has successfully downloaded second stage payloads. There are a few little steps to configure it correctly, that we will complete below:

1. Open a terminal and download inetsim sudo apt-get update && apt-get install inetsim
2. Create a snapshot at this point of your box
3. Switch your linux box to your malware dev network and query the ip address it has allocated.
4. Use your editor again to inspect the inetsim.conf file located at /etc/inetsim/inetsim.conf. Inspect the available services - by default all of these will be on. Feel free to disable any you don’t want or need.
5. Next, locate the #service_bind_address 10.10.10.1 line in the config file. Uncomment the line and replace the IP address with 0.0.0.0
6. Locate # dns_default_ip 10.10.10.1 and once again uncomment and change this to the assigned IP address on your malware analysis network
7. Once this has all been completed, save your changes and exit out of your editor. Then proceed to reboot inetsim using the following command: /etc/init.d/inetsim restart
8. Issue a netstat -plant or ss -plant (depending on whether you have netstat installed) to check that inetsim is now bound on the malware analysis network address.

Note that you can also, optionally, statically assign the IP address of your Debian host on the malware network. I don’t tend to do this often, as sometimes I like to revert the image to a snapshot that I can dynamically allow access back to the internet (to facilitate the download of additional, useful tools if the need arises).

Client - Windows Network Config

#

Now that inetsim has been sorted, we need to set up our Windows machine to test and confirm that the changes we have made are effective. Switch over to your Windows machine, slap on that Malware Analysis network to your adapter and complete the following steps:

1. Click on your network adapter in your Windows 11 VM and select Network & Internet Settings > Change adapter options > right click Ethernet and select Properties
2. Double-click IPv4 and set your IP address to match your newly configured malware network i.e. 10.10.10.2 with a subnet mask of 255.255.255.0
3. Set the DNS server address to the address of your Linux machine and then select okay.
4. Select okay until you return to your adapters and then open a web browser. Try to navigate to a random address such as www.hotmail.com. If your configuration to inetsim worked, you should see the following page displayed to you:

   

5. Once you have confirmed that this works, return to your linux VM and take a snapshot of it.

Tool List

#

Every Apple Silicon analyst will have a different option on the correct or best tools you should leverage to make a functional and safe environment for your analysis of malicious programs. The following table is subjective and reflects my own experience running or interacting with these systems. I don’t think here is a perfect solution to this, but hopefully through trial and error yourself, you’ll find one of the following most suited to the setup you require to perform your own types of analysis successfully.

References & Resources

#

Parting Thoughts

#

This blog focuses on setting up a safe environment leveraging VMWare Fusion 13 for MacOS. Unfortunately, it comes with a few caveats where we cannot entirely create an environment suited to analysing malware across MacOS, Windows and Linux environments. I intend on publishing a second blog in the coming days that captures how to achieve this using another program called UTM. This virtualisation platform has the added benefit of allowing us to also virtualise x86 platforms (which is very exciting). Just like VMWare Fusion, this program comes with some limitations and frustrations that we will discuss next time.

For now, I hope that this article has helped shed some light on how to effectively and safely configure a malware analysis environment on Apple Silicon computers.