If you are using Windows 10, use these steps to create the virtual disk file.
From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.
Click Install Now, then click Next.
Installation process is completed in various stages. The setup is first initialized.
On the Activate Windows page, enter your Windows product key, or select I don't have a product key to activate it later, then click Next.
Accept the license terms, then click Next.
On the Windows Setup page, select Custom: Install Windows only (advanced), use the default disk space settings, then click Next.
The step is completed in five stages. Wait for all stages to complete.
Choose United States in region, and in primary keyboard, select English (United States).
In the Settings window, select Use Express settings.
For the type of owner, select I do, then click Next.
In the Make it yours window, select Skip this step.
In the Meet Cortana windows, select Not now.
In the Choose how you'll connect' window, select Join a local Active Directory domain.
In the Create an account for this PC window, use these credentials, then click Next.
User name —
adminPassword —
cr@cker42
In the Choose Privacy settings window, keep the default settings, then click Next.
Wait until the installation is complete, then install the required software.
Run the VM Provisioner tool as an administrator or prepare the image for analysis. On Windows 10, Administrator account is disabled by default. To enable, do the following:
Run VM Provisioner Tool as a non-administrator user.
Restart the virtual machine.
The Administrator account is enabled once the virtual machine is started.
Log on to Windows as the Administrator user.
Note
adminand Administrator user accounts are not the same.Run VM Provisioner Tool again.
Check that these redistributable packages are installed.
Microsoft Visual C++ 2005 Redistributable Package (32-bit and 64-bit)
Microsoft Visual C++ 2008 Redistributable Package (32-bit and 64-bit)
Microsoft Visual C++ 2010 Redistributable Package (32-bit and 64-bit)
Microsoft Visual C++ 2012 Redistributable Package (32-bit and 64-bit)
Microsoft Visual C++ 2013 Redistributable Package (32-bit and 64-bit)
Microsoft Visual C++ 2019 Redistributable Package (32-bit and 64-bit)
Microsoft .NET Framework 3.5 and above which must be enabled manually or via an offline executable.
Note
The VM administrator password
cr@cker42is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.If you are using any later build/version of win 10 1909.18363.418, its required to switch off tamper protection manually inside win 10VMs for better detection.
Following are the steps to turn off Tamper Settings:
Click on the Start button.
Click on Settings.
Go to Updates and Security
Select Windows Security
Switch to Virus and Threat Protection
Select Manage Settings
Scroll a bit to find Tamper Protection
Toggle Off.