> For the complete documentation index, see [llms.txt](https://nuclei-av.gitbook.io/malware-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nuclei-av.gitbook.io/malware-handbook/setting-up-labs.md).

# Setting Up Labs

## VM Settings prerequisites

<figure><img src="/files/0gezul2lfarv2y6QG1JN" alt=""><figcaption></figcaption></figure>

## gpedit

1. First do ‘Win + R’ and type `gpedit.msc`

<figure><img src="/files/wA36f0JOQueLdGc9Ez40" alt=""><figcaption></figcaption></figure>

But we get this error,

<figure><img src="/files/5zdhkNN3S5QbiF4xPJco" alt=""><figcaption></figcaption></figure>

2. Run Powershell as administrator.
3. So, do these two cmd one-by-one,

```
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")

FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")
```

4. Type `gpedit` in powershell.
5. Now go `Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus`

<figure><img src="/files/q8iq4PpkZT9UoTGwp56n" alt=""><figcaption></figcaption></figure>

6. Turn off Microsoft Defender.

<figure><img src="/files/YWHacQZ3LmxcpYDtGJsH" alt=""><figcaption></figcaption></figure>

Set that to ‘Enabled’. Then Apply > OK.

<figure><img src="/files/CFCrBgiQLp3Jhgf5KNyL" alt=""><figcaption></figcaption></figure>

7. Now in `Microsoft Defender Antivirus > Real-time protection` . Turn it off.

<figure><img src="/files/kGZ0iiXqdRa9uff9Q3N6" alt=""><figcaption></figcaption></figure>

Set that to ‘Enabled’. Then Apply > OK.

<figure><img src="/files/X4qzDWGrhByZKfMlhq0T" alt=""><figcaption></figcaption></figure>

8. Lastly Restart the VM.

## Flare VM

1. Go to [FlareVM ](https://github.com/mandiant/flare-vm).
2. Open a `PowerShell` prompt as administrator.
3. Do `cd C:\Users\miche\Desktop`

<figure><img src="/files/EGRnMImnS6H9xqPpbpD2" alt=""><figcaption></figcaption></figure>

4. Download the installation script `[installer.ps1](https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1)` to your Desktop: `(New-Object net.webclient).DownloadFile('https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',"$([Environment]::GetFolderPath("Desktop"))\install.ps1")`
5. Unblock the installation script: `Unblock-File .\install.ps1`
6. Enable script execution:`Set-ExecutionPolicy Unrestricted -Force`
7. Finally, execute the installer script as follow: `.\install.ps1`. But it shows a following error that Defender is not disabled, something we did earlier in gpedit.

<figure><img src="/files/mgrk9X6IPkyn5p12szMg" alt=""><figcaption></figcaption></figure>

To resolve this, move to next section.

## disable-defender.ps1

1. Visit this [link ](https://github.com/jeremybeaume/tools/blob/master/disable-defender.ps1)and download ‘disable-defender.ps1’ in your VM.
2. Open a `PowerShell` prompt as administrator.
3. Do `cd C:\Users\miche\Desktop`
4. Run `.\disable-defender.ps1`

<figure><img src="/files/kwyD3QNqBOUzqNgKEMYb" alt=""><figcaption></figcaption></figure>

5. Now simply restart the VM
6. Run `.\install.ps1` (the one from flare vm). It takes a lot of time.
7. Type in ‘y’ in option in order to continue.

<figure><img src="/files/TT21XswHrmkO29hz8Onp" alt=""><figcaption></figcaption></figure>

8. Then a GUI pop-up shows and we might as well install all the s/w and tools. So to do that press the last button - “ `>>`”, in order to install all.

<figure><img src="/files/vvFH7OOQvfjbvkcyLl5o" alt=""><figcaption></figcaption></figure>

9. FINALLY after so long, this is the end of the installation.

<figure><img src="/files/rC3QBcPzaRyWBMBLPN2o" alt=""><figcaption></figcaption></figure>

10. Change Network Adapter option to ‘Host Only’.