Notes for Pre-setting Victim Environment for Malware Analysis

Here are notes contain recommended settings for the machine hosting client for malware analysis. These settings allow specimen to behave as they are intended and reduces the possibility of detecting false positives during an analysis.

It is vital to not have any antivirus and anti-malware applications on the test machine so that we may properly detect threats.

Configuration:

• [Comment] Enable Automatic Logon
  
  1. Configuring AutoAdminLogon
     

     Reference: http://technet.microsoft.com/en-us/magazine/ee872306.aspx
     Reference: http://support.microsoft.com/kb/310584

• [Comment] Disable System Functionalities
  
  1. Disabling Windows Update
     

     Reference: http://windows.microsoft.com/en-us/windows/change-windows-update-installation-notification

  2. Disabling Firewall
     

     Reference: http://technet.microsoft.com/en-us/library/cc766337(v=ws.10).aspx

  3. Disabling Action Center
     

     Reference: http://www.dummies.com/how-to/content/how-to-disable-the-windows-7-action-center.html

  4. Disabling User Account Control (UAC)
     

     Reference: http://windows.microsoft.com/en-us/windows/turn-user-account-control-on-off

  5. Disabling Windows Defender
     

     Reference: http://windows.microsoft.com/en-us/windows/turn-windows-defender-on-off

  6. Disabling Disk Defragmenter
     

     Reference: http://www.sevenforums.com/tutorials/3292-disk-defragmenter-schedule-turn-off.html

  7. Disabling Network Connection Status Indicator (NCSI)
     

     Reference: http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx
     Reference: http://www.trishtech.com/2010/09/turn-off-network-connectivity-test-in-windows-7/

  8. Disabling Data Execution Prevention (DEP)
     

     Reference: http://social.technet.microsoft.com/Forums/windows/en-US/0310435c-e04a-4204-8bd4-fcc9c2498556/how-to-turn-off-data-execution-prevention-in-windows-7?forum=w7itprosecurity

  9. Disabling Windows Search Indexing
     

     Reference: http://www.addictivetips.com/windows-tips/disable-search-indexing-in-windows-7/
     Reference: http://computerstepbystep.com/windows_search_service.html

  10. Disabling the Screen Saver
      

      Reference: http://windows.microsoft.com/en-us/windows/turn-screen-saver-on-off#1TC=windows-7

  11. Disabling Flash Updates
      

      Reference: http://kb2.adobe.com/cps/713/a7138026.html

  12. Disabling Java Updates
      

      Reference: http://www.java.com/en/download/help/java_update.xml

• [Comment] Other Installations and Settings
1. Installing Windows Symbol Packages Offline
   

   Reference: http://msdn.microsoft.com/en-us/windows/hardware/gg463028

2. Setting the Default Browser
   

   Reference: http://browsers.about.com/od/faq/tp/Setting-The-Default-Browser.htm
   Reference: http://windows.microsoft.com/en-us/internet-explorer/make-ie-default-browser#ie=ie-11
   Reference: http://windows.microsoft.com/en-us/windows/change-default-programs#1TC=windows-7

3. Configuring Power Options
   

   Reference: https://support.norton.com/sp/en/us/home/current/solutions/v85131538_EndUserProfile_en_us
   Reference: http://www.howtogeek.com/howto/9090/learning-windows-7-manage-power-settings/