VMRay Notes.md 2.1 KB
VMRay Notes
QUick Reference
Prod: https://vmray.pvt.xdr.accenturefederalcyber.com Test: https://vmray.pvt.xdrtest.accenturefederalcyber.com
iso's are stored in /opt/vmray/iso/. I downloaded 3:
Win10_21H1_English_x32.isoWin10_21H1_English_x64.isoWin11_English_x64.iso
VPN Required. SAML signon enabled.
Summary
VMRay Analyzer is a tool to detonate malware in a controlled environment.
Generalized Architecture
VMRay Analyzer consists of a VMRay Server, which coordinates the use of other systems, and one or more bare metal worker machines on which malware detonates. The systems run Ubuntu 20.04 LTS.
The system is deployed in its own account in GovCloud (one for prod, one for test)
Test does not have a license, so will remain shutdown/disabled/unconfigured most of the time, and with 0 workers.
Source
documentation and downloads are at: https://portal.vmray.com/customer/login?
Install Log
Use the 'vmray' salt state to install and configure.
Installing a VM
** Recommendation: Run this in a screen or tmux session so that you can reconnect if the vpn disconnects you **
- log into the worker
cd /opt/vmray/bin/sudo -u vmray ./vm_setup.py- Option 2 - VM Operations
- Option 1 - Create a new VM NOTE: No spaces in the name ... follow instructions. Most defaults are fine. See page 48 of the OnPrem installation guide for an example
- Option 3 - Guest OS Operations
- Option 1 - Install OS
- Wait for the message
VM started. You can now connect via VNC (port :0). You can monitor the installation by using a VNC viewer to connect. VNC Ports start at 5900, so :0 is port 5900, :1 would be 5901, and so forth. - After it returns to the main menu, select option 4, prepare VM for analysis, then option 2.
- Defaults are probalby fine. You do not need to use a proxy to download.
- After initialization completes, select option 4, prepare vm for analysis, and then option 3, create VM Snapshot. (NOTE: The documents specify that the snapshot is not what we'd think of as a snapshot (i.e. a point in time image), but is something else... and you probably only need one named 'def' for each VM.)