> For the complete documentation index, see [llms.txt](https://nuclei-av.gitbook.io/malware-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nuclei-av.gitbook.io/malware-handbook/setting-up-labs.md).

# Setting Up Labs

## VM Settings prerequisites

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FldH2EOveijMrlVMLkJGt%2FUntitled%2019.png?alt=media" alt=""><figcaption></figcaption></figure>

## gpedit

1. First do ‘Win + R’ and type `gpedit.msc`

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FeGLPe5STX3GGv9iIkMQ9%2FUntitled%2020.png?alt=media" alt=""><figcaption></figcaption></figure>

But we get this error,

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FA5XPdOxJKzIyYjagBbBJ%2FUntitled%2021.png?alt=media&amp;token=b6112d83-c4bd-4ab2-97a9-c0ff6cdbafe0" alt=""><figcaption></figcaption></figure>

2. Run Powershell as administrator.
3. So, do these two cmd one-by-one,

```
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")
```

4. Type `gpedit` in powershell.
5. Now go `Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus`

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FDtnYqXMBs7Q9ALNBiDgE%2FUntitled%2022.png?alt=media&amp;token=b5a58283-5581-4e0e-a9e7-61566b6e0777" alt=""><figcaption></figcaption></figure>

6. Turn off Microsoft Defender.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FQJp5gYjyXOEE7tditYzv%2FUntitled%2023.png?alt=media&amp;token=8c598003-becb-46cd-ab8f-5bd000f9440d" alt=""><figcaption></figcaption></figure>

Set that to ‘Enabled’. Then Apply > OK.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FUQa1UxJ6fVsSWR0EF7nR%2FUntitled%2024.png?alt=media&amp;token=5737797d-1376-4ea0-bb88-6dbf8ac8e988" alt=""><figcaption></figcaption></figure>

7. Now in `Microsoft Defender Antivirus > Real-time protection` . Turn it off.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FoPoLGIrsy5r7egTTf8Rl%2FUntitled%2025.png?alt=media&amp;token=2c4fa54b-c2e7-40e1-a6aa-2e319fdf0fea" alt=""><figcaption></figcaption></figure>

Set that to ‘Enabled’. Then Apply > OK.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FxoWvM5HRmsaqRGONaqT1%2FUntitled%2026.png?alt=media&amp;token=c090c2ce-8b1e-4963-b0b4-a40042c13556" alt=""><figcaption></figcaption></figure>

8. Lastly Restart the VM.

## Flare VM

1. Go to [FlareVM ](https://github.com/mandiant/flare-vm).
2. Open a `PowerShell` prompt as administrator.
3. Do `cd C:\Users\miche\Desktop`

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FJimt8h9ArsPoH70xdAFO%2FUntitled%2027.png?alt=media&amp;token=92ecb4f0-41b4-4879-8266-9a33563b6554" alt=""><figcaption></figcaption></figure>

4. Download the installation script `[installer.ps1](https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1)` to your Desktop: `(New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")`
5. Unblock the installation script: `Unblock-File .\install.ps1`
6. Enable script execution:`Set-ExecutionPolicy Unrestricted -Force`
7. Finally, execute the installer script as follow: `.\install.ps1`. But it shows a following error that Defender is not disabled, something we did earlier in gpedit.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FaRwCV15VyXtUBFHkCFlh%2FUntitled%2028.png?alt=media&amp;token=448aedb8-a6ad-4e83-90ce-3b581fb31126" alt=""><figcaption></figcaption></figure>

To resolve this, move to next section.

## disable-defender.ps1

1. Visit this [link ](https://github.com/jeremybeaume/tools/blob/master/disable-defender.ps1)and download ‘disable-defender.ps1’ in your VM.
2. Open a `PowerShell` prompt as administrator.
3. Do `cd C:\Users\miche\Desktop`
4. Run `.\disable-defender.ps1`

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FmUp5zuVcpp20bbwYc6so%2FUntitled%2029.png?alt=media&amp;token=0f458404-b198-4372-b4b2-999496165657" alt=""><figcaption></figcaption></figure>

5. Now simply restart the VM
6. Run `.\install.ps1` (the one from flare vm). It takes a lot of time.
7. Type in ‘y’ in option in order to continue.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FBASZOPIEYhZxLpTj0MGj%2FUntitled%2030.png?alt=media&amp;token=4478e15b-7158-46a1-a2d8-864ac4724dc8" alt=""><figcaption></figcaption></figure>

8. Then a GUI pop-up shows and we might as well install all the s/w and tools. So to do that press the last button - “ `>>`”, in order to install all.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FVsJteiAFMTPVTX1fZKrS%2FUntitled%2031.png?alt=media&amp;token=30838b52-b914-4d9a-8a4a-263a417d6d39" alt=""><figcaption></figcaption></figure>

9. FINALLY after so long, this is the end of the installation.

<figure><img src="https://134720738-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FR4PkR4JTpBXquyhftf9B%2Fuploads%2FM824U9N7a5qbsfjGmMOW%2FUntitled%2032.png?alt=media&amp;token=7d87a557-4b6f-4dd8-a122-cf92064100e4" alt=""><figcaption></figcaption></figure>

10. Change Network Adapter option to ‘Host Only’.