Ask IFIN: Rolling Your Own Malware Sandbox

Good morning from Europe, and happy Friday!

I’ve been doing a lot of work lately around creating one-off environments for staging/deconstructing/detonating/generating bills of materials for various flavours of malware, phishing links etc.

I’ve been using a mix of COTS and FOSS software, but it’s been rather rudimentary and not at all using purpose-made components. Lots of scripting, blowing away VMs etc. etc. etc.

Most of the issues some of us run into, however, are that SaaS/Vendor supplied solutions don’t meet the security and compliance of public sector and more security-aware organisations. Just in terms of good practices, should all be tending more towards ownership and digital sovereignty anyway.

Just looking for insight, selfishly for myself, but also for the wider community:

What are you all using and building for this purpose?

If you don’t mind a bit of logrolling, I have done some writing on the topic.

Not all of that is going to apply directly to your needs, but it may be useful to others going down the same road.

Largely, I have found that the highly automated sandboxes such as Cuckoo are either deprecated or…not that automated. So instead, it’s been worth my time to build dedicated virtualization infrastructure for my needs.

Let’s break it down.

Virtualization: Proxmox

I use Proxmox Virtualization Environment (PVE) instead of VMWare or anything else. It’s built on Debian, powerful, and stable. But for updates, my Proxmox cluster has never had a failure in 4 years of operation. I’m able to create virtual switches, hypervisor-level firewalls, and even set up virtual taps for packet capture.

Networking: OPNSense

In the Proxmox environment, I use OPNSense to handle DHCP, DNS, NAT, and Firewall rules. I define separate Infrastructure/Lab interfaces, with allowed ingress from infra to the isolation lab, but not the reverse. Could I do a lot of this at the hypervisor level? Yes, but I find using the dedicated router with a “WAN” (my actual LAN) bridge uplink is a lot easier for ongoing maintenance.

Templates: Packer

I build custom VM templates with Packer and some init scripts—cloud-init for Ubuntu, and Autounattend answer files for Windows—to get my baseline images. I rebuild the Windows templates every few months to stay ahead of eval image expirations. It’s annoying but not the worst. If you have money to may for licenses, I recommend just activating your templates and calling it a day.

VM Creation: Terraform/OpenTofu

Sometimes I’ll just manually spin up a VM to test a sample. But if I need a more interesting buildout—say, a Windows domain—I’ll use Terraform to manage the deployment. With Proxmox provider integrations, this is simple enough.

For a proper malware research lab, this includes at least 3 machines:

  1. Ad-hoc SIEM to collect data (either Splunk or Elastic)
  2. “Victim” machine that will have samples detonated
  3. “Analysis” machine for simultaneous static analysis

The machines need at least 2, maybe 4 cores for baseline sandbox evasion.

Provisioning/Config: Ansible

Once the VMs are up, I use Ansible to install what I need. For a malware lab, that’ll be:

  • Sysmon with the heavy Modular config.
  • Forwarder to Splunk/Elastic, depending on my mood
  • Analysis tools (defined later) installed via Chocolatey

Why not use Scoop or Winget to install packages? So far, Choco is the only Windows package manager with every package I need. But I’m revisiting this, since it is a little slow.

On my todo list here is configuration for additional anti-sandbox or evasion techniques, including installing additional language packs and potentially futzing with keyboard drivers.

Analysis Tools

Static Analysis

  • Cutter
  • Ghidra
  • WinDbg
  • x64Dbg
  • API Monitor
  • PE Studio
  • PEBear
  • Wireshark
  • IMHex
  • CFF Explorer

It’s a heavy buildout, but I still beat FLARE for standup time.

All of this, by the way, is available here: mttaggart/seclab: Automated security lab provisioning - Codeberg.org

A particular point of pride: my build uses no on-disk unencrypted secrets of any kind—a claim neither Ludus nor other lab builds can make.

Edited to add: This is not fast the way VT or Tria.ge are. There are ways to automate this further, and we can probably noodle on that together. My objective for this build is deep analysis, so all evidence can be collected from a sample. That’s a different objective than the quick-run sandboxes.

This line in particular..

PSA: Yes you can privatize sandboxes, but they are prohibitively expensive Enterprise licenses out of reach for smaller orgs.

In fact it’s such a concern, I will block Virus Total file upload URL, Joe’s, Any.Run, and Hybrid-Analysis auth pages, because I’m worried about defender-adjacenct roles submitting documents to them; all with good intentions, but many people are unaware of the data exposure.

It’s why VT dorking is a thing.

Yep! And in fact an ancillary conversation worth having is sample management inside an org. How do you get the sample from wherever it was discovered into the lab cleanly and safely?

You may consider whether CCCS AssemblyLine is suitable for your purposes:

Echoing this as well: A malware research lab machine, where an analyst is getting hands on with debugging and dynamic analysis, is a very different thing than an automated malware analysis sandbox, which is meant to automatically detonate samples and provide behaviour reports, verdicts, and configuration extraction from the sample.

Which one do you need help with setting up?