# Sandbox Environment Setup Guide

## Overview

A malware analysis sandbox provides an isolated environment to safely execute and observe malicious samples. This guide covers setup for VirtualBox, VMware, and Docker-based analysis environments with proper network isolation.

## VirtualBox Setup

### 1. Create Analysis VM

```bash
# Create VM with recommended specs
VBoxManage createvm --name "MalwareAnalysis" --ostype "Windows10_64" --register
VBoxManage modifyvm "MalwareAnalysis" --memory 4096 --cpus 2 --vram 128
VBoxManage modifyvm "MalwareAnalysis" --clipboard-mode disabled
VBoxManage modifyvm "MalwareAnalysis" --draganddrop disabled
```

### 2. Network Isolation

```bash
# Option A: Host-only network (isolated, host can communicate)
VBoxManage hostonlyif create
VBoxManage modifyvm "MalwareAnalysis" --nic1 hostonly --hostonlyadapter1 "vboxnet0"

# Option B: Internal network (fully isolated between VMs)
VBoxManage modifyvm "MalwareAnalysis" --nic1 intnet --intnet1 "malnet"

# Option C: NAT with INetSim (simulated internet)
VBoxManage modifyvm "MalwareAnalysis" --nic1 natnetwork --nat-network1 "AnalysisNet"
```

### 3. Anti-Detection Measures

```bash
# Modify VM identifiers to avoid sandbox detection
VBoxManage setextradata "MalwareAnalysis" "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor" "American Megatrends Inc."
VBoxManage setextradata "MalwareAnalysis" "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "System Product Name"
VBoxManage setextradata "MalwareAnalysis" "VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor" "ASUS"
VBoxManage modifyvm "MalwareAnalysis" --paravirtprovider none
```

### 4. Snapshots

```bash
# Create clean baseline snapshot after OS install and tool setup
VBoxManage snapshot "MalwareAnalysis" take "clean_baseline" --description "Clean OS with analysis tools"

# Restore to clean state before each analysis
VBoxManage snapshot "MalwareAnalysis" restore "clean_baseline"
```

## VMware Setup

### 1. VM Configuration

Recommended `.vmx` settings for analysis VMs:

```
memsize = "4096"
numvcpus = "2"
isolation.tools.copy.disable = "TRUE"
isolation.tools.paste.disable = "TRUE"
isolation.tools.dnd.disable = "TRUE"
tools.syncTime = "FALSE"
```

### 2. Network Isolation

```
# Host-only networking
ethernet0.connectionType = "hostonly"

# Or custom isolated network
ethernet0.connectionType = "custom"
ethernet0.vnet = "vmnet2"
```

### 3. Anti-Detection

```
# Reduce VMware artifacts
monitor_control.restrict_backdoor = "TRUE"
SMBIOS.reflectHost = "TRUE"
board-id.reflectHost = "TRUE"
hw.model.reflectHost = "TRUE"
serialNumber.reflectHost = "TRUE"
```

## Docker-Based Analysis

### Isolated Analysis Container

```dockerfile
# Dockerfile.analysis
FROM ubuntu:22.04

RUN apt-get update && apt-get install -y \
    python3 python3-pip \
    tcpdump \
    strace \
    ltrace \
    net-tools \
    iproute2 \
    && rm -rf /var/lib/apt/lists/*

RUN pip3 install psutil watchdog

WORKDIR /analysis
COPY scripts/ /analysis/scripts/

# Run as non-root analysis user
RUN useradd -m analyst
USER analyst
```

### Docker Compose for Isolated Network

```yaml
version: '3.8'
services:
  analysis:
    build:
      context: .
      dockerfile: Dockerfile.analysis
    networks:
      - analysis_net
    cap_add:
      - NET_RAW        # For packet capture
      - SYS_PTRACE     # For process tracing
    security_opt:
      - no-new-privileges
    volumes:
      - ./samples:/analysis/samples:ro
      - ./results:/analysis/results

  inetsim:
    image: remnux/inetsim
    networks:
      - analysis_net

  dns:
    image: remnux/fakedns
    networks:
      analysis_net:
        ipv4_address: 10.10.0.53

networks:
  analysis_net:
    driver: bridge
    internal: true       # No external connectivity
    ipam:
      config:
        - subnet: 10.10.0.0/24
```

```bash
docker compose up -d
docker compose exec analysis bash
```

## Network Simulation with INetSim

INetSim simulates common internet services so malware can "communicate" without reaching real infrastructure.

### Installation (Debian/Ubuntu)

```bash
echo "deb http://www.inetsim.org/debian/ binary/" | sudo tee /etc/apt/sources.list.d/inetsim.list
wget -O - https://www.inetsim.org/inetsim-archive-signing-key.asc | sudo apt-key add -
sudo apt-get update && sudo apt-get install -y inetsim
```

### Configuration (`/etc/inetsim/inetsim.conf`)

```
# Bind to analysis network
service_bind_address 10.10.0.1

# Enable common services
start_service dns
start_service http
start_service https
start_service smtp
start_service ftp

# DNS: resolve everything to INetSim host
dns_default_ip 10.10.0.1

# Log all requests
faketime_auto_delay 0
```

### Start INetSim

```bash
sudo inetsim --conf /etc/inetsim/inetsim.conf --data-dir /var/lib/inetsim --log-dir /var/log/inetsim
```

## Guest VM Tool Installation

### Windows Analysis VM

Install these tools on the Windows guest before taking a clean snapshot:

| Tool | Purpose |
|------|---------|
| Process Monitor (Procmon) | Process, filesystem, registry monitoring |
| Process Explorer | Detailed process information |
| API Monitor | API call interception |
| Wireshark | Network traffic analysis |
| PE-bear / PE-sieve | PE file inspection |
| x64dbg / x32dbg | Debugging |
| Python 3 | Script execution |
| 7-Zip | Archive handling |

### Linux Analysis VM

```bash
sudo apt-get install -y \
    strace ltrace gdb \
    tcpdump wireshark-cli \
    python3 python3-pip \
    binutils file \
    radare2
pip3 install psutil watchdog
```

## CAPE Sandbox Setup

[CAPE](https://github.com/kevoreilly/CAPEv2) (successor to Cuckoo) provides automated malware analysis.

### Quick Setup

```bash
# Clone CAPE
git clone https://github.com/kevoreilly/CAPEv2.git
cd CAPEv2

# Run installer
sudo ./installer/cape2.sh all

# Configure in conf/cuckoo.conf, conf/virtualbox.conf
# Set up analysis VMs and network routing
```

### Key Configuration Files

- `conf/cuckoo.conf` - Main configuration
- `conf/virtualbox.conf` - VM backend settings
- `conf/routing.conf` - Network routing (INetSim, VPN, Tor)
- `conf/processing.conf` - Analysis module settings
- `conf/reporting.conf` - Report generation settings

## Security Best Practices

1. **Never analyze on your host OS** - Always use isolated VMs or containers
2. **Disable shared folders** between host and guest
3. **Use snapshots** - Revert to clean state after every analysis
4. **Isolate the network** - No route to production networks or the internet
5. **Monitor the host** - Watch for VM escape attempts
6. **Use dedicated hardware** if possible for high-risk samples
7. **Keep VMs updated** but do not auto-update during analysis
8. **Document your environment** for reproducibility