Home Explore Help
Register Sign In
AFS
/
infrastructure-notes
2
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: 843c2cefb6
Branches Tags
infrastructure-...
/
VMRay Notes.md

VMRay Notes.md 2.1 KB
History Raw

VMRay Notes

QUick Reference

Prod: https://vmray.pvt.xdr.accenturefederalcyber.com Test: https://vmray.pvt.xdrtest.accenturefederalcyber.com

iso's are stored in /opt/vmray/iso/. I downloaded 3:

  • Win10_21H1_English_x32.iso
  • Win10_21H1_English_x64.iso
  • Win11_English_x64.iso

VPN Required. SAML signon enabled.

Summary

VMRay Analyzer is a tool to detonate malware in a controlled environment.

Generalized Architecture

VMRay Analyzer consists of a VMRay Server, which coordinates the use of other systems, and one or more bare metal worker machines on which malware detonates. The systems run Ubuntu 20.04 LTS.

The system is deployed in its own account in GovCloud (one for prod, one for test)

Test does not have a license, so will remain shutdown/disabled/unconfigured most of the time, and with 0 workers.

Source

documentation and downloads are at: https://portal.vmray.com/customer/login?

Install Log

Use the 'vmray' salt state to install and configure.

Installing a VM

** Recommendation: Run this in a screen or tmux session so that you can reconnect if the vpn disconnects you **

  1. log into the worker
  2. cd /opt/vmray/bin/
  3. sudo -u vmray ./vm_setup.py
  4. Option 2 - VM Operations
  5. Option 1 - Create a new VM NOTE: No spaces in the name ... follow instructions. Most defaults are fine. See page 48 of the OnPrem installation guide for an example
  6. Option 3 - Guest OS Operations
  7. Option 1 - Install OS
  8. Wait for the message VM started. You can now connect via VNC (port :0). You can monitor the installation by using a VNC viewer to connect. VNC Ports start at 5900, so :0 is port 5900, :1 would be 5901, and so forth.
  9. After it returns to the main menu, select option 4, prepare VM for analysis, then option 2.
  10. Defaults are probalby fine. You do not need to use a proxy to download.
  11. After initialization completes, select option 4, prepare vm for analysis, and then option 3, create VM Snapshot. (NOTE: The documents specify that the snapshot is not what we'd think of as a snapshot (i.e. a point in time image), but is something else... and you probably only need one named 'def' for each VM.)