Trellix Intelligent Sandbox 5.0.x
Installation Guide

Last Updated: September 17, 2023

Contents

   Installation overview            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅        7

   
•        

  Which type of installation do you need?                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        7        

     
   
•        

  Plan your deployment                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        7        

     

   System requirements            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅        9

   
•        

  Virtual system requirements                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        9        

     
   
•        

  Physical server requirements                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        10        

     
   
•        

  Web interface client requirements                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        11        

     
   
•        

  Cluster requirements                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        12        

     
   
•        

  Intelligent Sandbox cluster network connections                            ⋅⋅⋅⋅⋅⋅                        13        

     
   
•        

  Analyzer VM requirements                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        14        

     
   
•        

  Plan your deployment                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        21        

     
   
•        

  Hardware specifications                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        21        

     
   
•        

  System environmental limits                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        24        

     
   
•        

  Default ports used in Intelligent Sandbox communication                            ⋅                        30        

     
   
•        

  Warnings and cautions                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        32        

     
   
•        

  Deployment checklist                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        33        

     

   Pre-installation tasks            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅        35

   
•        

  Installing the OS, software, and Email Connector                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅                        35        

     
   
•        

  Download the product files                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        36        

     
   
•        

  Installer package details                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅                        36        

     

   Upgrade the software            ⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅⋅        38

   
•        

  Upgrade your Intelligent Sandbox software                            ⋅⋅⋅⋅⋅⋅⋅⋅⋅                        38        

     
   
•        

  Upgrade the software incrementally                            ⋅⋅⋅⋅⋅⋅⋅⋅                        39        

     
   
•        

  Automatically download the latest application software package                            ⋅⋅                        40        

     

Manually upload the latest application software package ............................................................ 40

Upgrade the Android analyzer VM ........................................................................ 41

View the Upgrade log ...................................................................................... 41

Install the software ................................................................. 43

Fresh installation of Trellix Intelligent Sandbox ............................................. 43

Install the Operating system and ATD software to your appliance .......................... 43

Setting up Intelligent Sandbox IP ........................................................... 45

Install the operating system to your appliance remotely using RMM ...................... 45

Installing Virtual Intelligent Sandbox ......................................................... 46

Install a Virtual Intelligent Sandbox instance .............................................. 46

Install Virtual Intelligent Sandbox on Hyper-V using the automated script ............ 48

Install Virtual Intelligent Sandbox on Hyper-V manually ................................ 50

Prepare your sandbox virtual machine ...................................................... 51

Activate the product ............................................................................... 52

Activate the product using the temporary key ............................................. 53

Activate the product using the permanent key ............................................ 53

Install Email Connector ........................................................................... 54

Post-installation tasks .......................................................... 56

Creating analyzer VMs ........................................................................... 56

Create a VM using the VM Builder ......................................................... 56

Create a virtual machine on VMware Workstation ......................................... 58

Create a virtual machine on VMWare ESXi ................................................. 61

Create a virtual machine on Hyper-V Manager ............................................ 63

Create a virtual disk file ....................................................................... 64

Create a virtual disk file for Windows XP .................................................. 64

Create a virtual disk file for Windows Server 2003 ...................................... 65

Create a virtual disk file for Windows 7 .................................................. 66

Create a virtual disk file for Windows 8 .................................................. 67

Create a virtual disk file for Windows Server 2008 ...................................... 68

Create a virtual disk file for Windows 8.1 ................................................. 69

Create a virtual disk file for Windows 10 .......................................................... 69

Create a virtual disk file for Windows 11 .......................................................... 71

Create a virtual disk file for Windows 2012 ....................................................... 73

Create a virtual disk file for Windows 2012 R2 .................................................... 73

Create a virtual disk file for Windows Server 2016/2019 Standard .............................. 74

Install Microsoft Office on the virtual machine ................................................. 74

Enable PDF file analysis ............................................................................... 75

Enable JAR file analysis ............................................................................... 75

Analyze OneNote file .................................................................................. 75

Enable Flash file analysis ............................................................................ 76

Complete the VMDK and VHDX file creation process ............................................ 76

Prepare the virtual disk image for analysis .................................................... 76

Run the VM Provisioner Tool ....................................................................... 77

Prepare your VMDK or VHDX image for analysis manually .................................... 77

Prepare a Windows XP image for analysis ...................................................... 78

Prepare a Windows Server 2003 image for analysis ......................................... 80

Prepare a Windows 7 image for analysis ....................................................... 83

Prepare a Windows Server 2008 image .......................................................... 85

Prepare a Windows 8 image for analysis ...................................................... 87

Prepare a Windows 8.1 image for analysis .................................................... 90

Prepare a Windows 10 image for analysis ..................................................... 93

Prepare Windows 11 image for analysis ....................................................... 97

Prepare a Windows 2012 R2 image for analysis ............................................. 100

Prepare a Windows Server 2016/2019 Standard image for analysis .......................... 103

Import the virtual disk file ...................................................................... 106

Convert the VMDK and VHDX file to an image file ............................................ 106

Accessing the Intelligent Sandbox web interface ........................................... 108

Trellix Intelligent Sandbox web UI requirements and preparation .......................... 108

Log on to the Intelligent Sandbox web interface ........................................... 110

Copy existing image files from one Intelligent Sandbox Appliance to others on the same network ........ 110

Managing VM profiles ............................................................................... 111

Create VM profiles .......................................................... 112

Configuring Intelligent Sandbox for malware analysis .................................. 114

High-level steps to configure malware analysis ..................................... 114

Configure the Trellix Virtual Intelligent Sandbox network information .................. 115

Configure the security and performance options .................................... 116

Configure proxy servers for Internet connectivity .................................. 117

Configure Intelligent Sandbox to communicate with McAfee GTI ........................ 117

Enable the malware site proxy .................................................... 118

Configure DNS setting .......................................................... 118

Configure the syslog settings .................................................. 119

Configuring the TAXII settings .................................................. 121

Enable and configure TAXII settings ............................................. 121

Configuring date and time settings .............................................. 122

Configure a Network Time Protocol server ....................................... 123

Configure the date and time manually ............................................ 124

Add the Intelligent Sandbox logon banner ....................................... 125

Configure telemetry ........................................................... 125

Enable telemetry .............................................................. 127

Configure Common Settings .................................................... 128

Configure maximum threshold wait time ........................................ 128

Enable Common Criteria (CC) mode .............................................. 128

Use SSL encryption while communicating with Network Security Platform ............... 129

Enable account lock out ....................................................... 130

Configuring Email Connector .................................................. 130

Enable and configure Email Connector ......................................... 131

Configuring your Secure Email Gateway for Email Connector ........................ 134

Configure Email Connector filtering rules ...................................... 134

Recommended concurrent SMTP sessions for Email Connector ........................ 135

Understanding Email Headers with analysis status ................................ 135

Uploading certificates ........................................................ 137

Upload trusted CA certificates ................................................ 138

Upload web certificates ........................................................................ 139

Manage users and performance ............................................................ 140

Manage users .................................................................................. 140

Add users ..................................................................................... 140

Types of users ............................................................................. 140

Command-line Interface user .............................................................. 140

Super Administrator ...................................................................... 141

Network Security Platform user ........................................................ 141

Upload Administrator .................................................................. 141

Web Gateway user ...................................................................... 141

Email Gateway user .................................................................... 142

TIE user .................................................................................... 142

Virtual Network Security Platform user ............................................... 142

Email connector user .................................................................. 142

Bro Network Sensor user ............................................................... 142

Administrator permissions .............................................................. 143

Admin User ................................................................................ 143

Web Access ................................................................................ 143

Restful Access ............................................................................ 144

FTP Access permission ................................................................. 144

Managing user roles in Intelligent Sandbox .......................................... 144

Create a role in Intelligent Sandbox ................................................ 144

Review user analysis reports and status in Intelligent Sandbox ........................ 145

Assign roles to users in Intelligent Sandbox .......................................... 145

1 | Installation overview

Which type of installation do you need?

Trellix Intelligent Sandbox is available in two form factors—On-premises physical appliance and Virtual.

Both on-premises and virtual Trellix Intelligent Sandbox come pre-installed. While on-premise come pre-installed on your new physical appliance, for virtual form factor, you are provided with an OVA file which you can deploy in your environment.

For more details about Installer package, see Installer package details.

Plan your deployment

You can deploy Trellix Intelligent Sandbox as standalone or integrated with other products.

   
• Standalone deployment — This is a simple way of deploying Trellix Intelligent Sandbox. In this case, it is not integrated with other externally installed McAfee products. When deployed as a standalone Appliance, you can manually submit the suspicious files using the Trellix Intelligent Sandbox web application. Or, you can submit the samples using an FTP client. This deployment option is used, for example, during the testing and evaluation phase, to fine-tune configuration, and to analyze suspicious files in an isolated network segment. Also, research engineers might use the standalone deployment option for detailed analysis of malware.
   
• Integration with Network Security Platform — This deployment involves integrating Trellix Intelligent Sandbox with Network Security Platform Sensor and Manager.

Based on how you have configured the corresponding Advanced Malware policy, an inline Sensor detects a file download and sends a copy of the file to Trellix Intelligent Sandbox for analysis. If Trellix Intelligent Sandbox detects a malware within a few seconds, the Sensor can block the download. The Manager displays the results of the analysis from Trellix Intelligent Sandbox.

Trellix Intelligent Sandbox 5.0.x Installation Guide7

1 | Installation overview

If Trellix Intelligent Sandbox requires more time for analysis, the Sensor allows the file to be downloaded. If Trellix Intelligent Sandbox detects a malware after the file has been downloaded, it informs Network Security Platform, and you can use the Sensor to quarantine the host until it is cleaned and remediated. You can configure the Manager to update all Sensors about this malicious file. So, if that file is downloaded again anywhere in your network, your Sensors might block it.

For information about how to integrate Network Security Platform and Trellix Intelligent Sandbox, see the latest Network Security Platform Integration Guide.

   
•        

  Integration with McAfee® Web Gateway — You can configure Trellix Intelligent Sandbox as another engine for antimalware protection. When your network user downloads a file, the native McAfee Gateway antimalware Engine on McAfee® Web Gateway scans the file and determines a malware score. Based on this score and the file type, McAfee® Web Gateway sends a copy of the file to Trellix Intelligent Sandbox for deeper inspection and dynamic analysis. A progress page informs your users that the requested file is being analyzed for malware. Based on the malware severity level reported by Trellix Intelligent Sandbox, McAfee® Web Gateway determines if the file is allowed or blocked. If it is blocked, the reasons are displayed for your users. You can view the details of the malware that was detected in the log file.

         

  This design makes sure that only those files that require an in-depth analysis are sent to Trellix Intelligent Sandbox. This balances your users' experience in terms of download speed and security. McAfee® Web Gateway hosted over IPv6 device can integrate with Trellix Intelligent Sandbox IPv6 address. For information about how to integrate Trellix Intelligent Sandbox and McAfee® Web Gateway, see the McAfee® Web Gateway Product Guide, version 7.4.

     
   
•        

  Integration with McAfee® ePolicy Orchestrator (McAfee ePO) — This integration enables Trellix Intelligent Sandbox to retrieve information regarding the target host. Knowing the operating system on the target host, enables it to select a similar virtual environment for dynamic analysis.

         
             
  •                

    Dynamic analysis requires the suspicious file to be executed for a specific time period. During this time, the malware is likely to have reached the intended target. You can then take the needed remedial steps to clean the affected host.

               
             
  •                

    This integration also enables you to identify the other hosts detected by the same malware and take the appropriate remedial steps.

               
         
     

How the deployment options address the four major aspects of antimalware process cycle:

   
•        

  Detection of file download: When a user accesses a file, the inline Network Security Platform Sensor or McAfee® Web Gateway detects this and sends a copy of the file to Trellix Intelligent Sandbox for analysis.

     
   
•        

  Analysis of the file for malware: Even before the user fully downloads the file, Trellix Intelligent Sandbox can detect a known malware using sources that are local to it or on the cloud.

     
   
•        

  Block future downloads of the same file: Every time Trellix Intelligent Sandbox detects a medium, high, or high severity malware, it updates its local black list.

     
   
•        

  Identify and remediate affected hosts: Integration with Network Security Platform enables you to quarantine the host until it is cleaned up and remediated.

     

2 | Installation overview

Virtual system requirements

To ensure that your deployment is successful, your virtual systems must meet the minimum requirements.

Total number of virtual CPU and memory requirement depends on the number of deployments on the ESXi or Hyper-V servers.

   

       

Note

   

   

These are minimum resource requirements. Make sure that there is enough resource available when multiple virtual machines are running at the same time.

Trellix Intelligent Sandbox 5.0.x Installation Guide

2 | Installation overview

   

Note

   

To change the RAM allocated for existing vATD deployments from 32 GB to 48 GB, see KB94639. For new 4.12.0 OVA deployments, the memory allocated is 32 GB. To allocate additional memory, see KB94639.

Physical server requirements

To deploy Trellix Virtual Intelligent Sandbox (vATD) on explicit servers, make sure that your server meets these requirements.

   

Important

   

When CPU Hyper-threading is available, for each physical processor core, the operating system addresses two virtual (logical) cores and shares the workload between them. For example, the minimum core requirement for vATD is 16, with Hyper-threading, the 8 physical cores of the CPU is treated as 16 by the operating system.

On ESXi Servers

This is the minimum requirement for one vATD on VMware ESXi.

Examples:

2 | Installation overview

On Hyper-V

This is the minimum requirement for one vATD on Microsoft Hyper-V.

Examples:

Web interface client requirements

To log on to the Intelligent Sandbox web interface, make sure that your client meets the requirements.

2 | Installation overview

Supported operating systems

Supported browsers

Cluster requirements

To create clusters of one or more Intelligent Sandbox Appliances, make sure your environment meets the requirements.

   
• Use the Intelligent Sandbox Appliance eth-0 interfaces, or management ports.
   
• For optimal performance, node eth-0 interfaces must be in the same layer-2 network of the OSI reference model.

2 | Installation overview

   

       

Note

   

   

When you set up a Virtual Intelligent Sandbox cluster, the Primary and Backup nodes must reside on same VMware EXSi server. The Secondary nodes can be on same or a different VMware EXSi server.

   
•        

  All nodes must have the same:

         
             
  •                

    Intelligent Sandbox software version

               
             
  •                

    Analyzer VMs

               
             
  •                

    Trellix Anti-Malware Engine DAT and engine versions

               
             
  •                

    Trellix Gateway Anti-Malware Engine DAT and engine versions

               
         
     

Intelligent Sandbox cluster network connections

Eth-0 interface of the primary acts as the management interface of the cluster whereas the eth-0 of the secondary and backup node are used to exchange information with the primary.

The Backup node acts as a secondary node till the time the Primary node goes down for some reason and the Backup node takes the role of the primary node. The primary node load balances the files received on the eth-0 interface among the secondary nodes based on the number of files submitted to a node. A highly burdened node receives lesser number of samples for processing as opposed to a less burdened node. The primary node transfers files to be analyzed by the secondary node through the eth-0 interface and uses the same to retrieve results. When cluster configuration changes are made using the primary node, they are synchronized across the secondary nodes and the backup node through the eth-0 interface.

An example Intelligent Sandbox cluster deployment

In this example, eth-1 is used to provide network access to malware running on the analyzer VMs. This isolates the network traffic generated by malware from the production network to which eth-0 interfaces are connected.

A local database is maintained at the Primary node which lists the MD5 hash value along with corresponding node-id of the

2 | Installation overview

samples blacklisted by Intelligent Sandbox cluster node. Node-id is the primary identifier of a node that processes a particular sample. Whenever a sample is submitted to Intelligent Sandbox, the Primary node looks for an existing entry of this sample in its newly created database. If the MD5 hash value of a sample matches with an existing one in the database, this previously blacklisted sample is sent to the node based on the corresponding node-id of the sample. This approach ensures that every previously submitted, blacklisted sample reaches the node that analyzed it earlier, hence avoiding re-analysis of the blacklisted samples by any other node in the cluster.

Intelligent Sandbox determines the wait time for a submitted sample before it gets picked for analysis. The wait time is calculated based on the current sample analysis rate of the nodes. For samples submitted through MEG, a default threshold wait time of 780 seconds is allotted. Intelligent Sandbox rejects all the incoming samples from MEG until the wait time drops below this threshold value.

Analyzer VM requirements

Trellix Intelligent Sandbox uses secure virtual machines, or analyzer VMs, for dynamic analysis. During dynamic analysis, Trellix Intelligent Sandbox executes suspicious files in the analyzer VM, then monitors the file behavior for malicious activities.

To create the analyzer VM and VM profile, review the recommended requirements.

   

       

       

Note

   

   

       
• If you already have a VMDK or VHDX file, it must be a single file that contains all files required to create the VM.
       
• The platforms and other specifications listed here are based on Trellix test results.
   

Recommended RAM size

2 | Installation overview

Supported operating systems

To create an ISO image, Intelligent Sandbox supports the following operating systems.

2 | Installation overview

2 | Installation overview

If you are using a Microsoft Windows operating system, you must have the license key, and it must come in one of these languages:

   
• English
   
• Chinese Simplified
   
• Japanese
   
• German
   
• Italian
   
• Spanish
   
• French

Supported applications

Required applications

Trellix Intelligent Sandbox 5.0.x Installation Guide

2 | Installation overview

Disk space

The minimum available disk space must be 200 MB. The maximum used total disk space must not exceed 30 GB.

The disk space affects the maximum number of VMs you create.

Maximum VMs

The following table specifies the maximum number of VMs that you can create for each Microsoft Windows operating system. The number of VMs listed in the table is based on the assumption that the disk space occupied by Windows is not more than 22 GB.

Trellix Intelligent Sandbox 5.0.x Installation Guide

19

2 | Installation overview

2 | Installation overview

   

       

Note

   

   

For better detection during bulk submission, we recommend not exceeding the number of VM licenses beyond 20 (for ATD-3000) and 15 (for ATD-3100) for Windows 10 20h2 (19042.xxx) and Windows 10 21h1 OS, and not exceeding the number of VM licenses beyond 10 (for ATD-3000) and 5 (for ATD-3100) for Windows 10 21h2 OS.

Supported VM Provisioner Tool operating systems

To use the VM Provisioner Tool, you must use a supported operating system.

   
• Microsoft Windows 7 32-bit and 64-bit (Service Pack 1)
   
• Microsoft Windows 8 Professional 32-bit and 64-bit
   
• Microsoft Windows 8.1 64-bit Enterprise (Update 1 version 6.3 build 9600)
   
• Microsoft Windows 8.1 64-bit Professional (Update 1 version 6.3 build 9600)
   
• Microsoft Windows 10 Enterprise 64-bit version 1511, 1607, 1703 and 1909.18363.418 to 1909.18363.778, 20h2(19042.508 - 19042.746), 21h1(19043.1052 - 19043.1165), and 21h2(19044.1526 - 19044.1586).
   
• Microsoft Windows 10 Professional 64-bit version 1607, 1803, 1809, 1903 and 1909.18363.418 to 1909.18363.778, 20h2(19042.508 - 19042.746), 21h1(19043.928 - 19043.1165), and 21h2(19044.1526 - 19044.1586)
   
• Microsoft Windows 11 Professional & Enterprise 64 bit (22000.318 to 22000.739)
   
• Microsoft Windows Server 2008 R2 (Service Pack 1) Datacenter
   
• Microsoft Windows Server 2012 Datacenter
   
• Microsoft Windows Server 2012 R2 Datacenter
   
• Microsoft Windows Server 2012 R2 Standard
   
• Microsoft Windows Server 2016 Standard
   
• Microsoft Windows Server 2019 Standard

Plan your deployment

Before you set up the Intelligent Sandbox Appliance, verify that you have everything you need, and that your environment meets the minimum system requirements.

Hardware specifications

Before you set up the Intelligent Sandbox Appliance, review the hardware specifications.

2 | Installation overview

2 | Installation overview

Trellix Intelligent Sandbox 5.0.x Installation Guide

23

2 | Installation overview

System environmental limits

These are the system environmental limits for the Intelligent Sandbox Appliance.

2 | Installation overview

2 | Installation overview

2 | Installation overview

Trellix Intelligent Sandbox 5.0.x Installation Guide    27

2 | Installation overview

2 | Installation overview

2 | Installation overview

Default ports used in Intelligent Sandbox communication

Intelligent Sandbox Appliance uses many ports for network communications.

2 | Installation overview

2 | Installation overview

Warnings and cautions

Read and follow these safety warnings when you install the Intelligent Sandbox Appliance.

2 | Installation overview

   

Failure to observe these safety warnings could result in serious physical injury.

Power Supply

   
• The push-button on/off power switch on the front panel of the Intelligent Sandbox Appliance does not turn off the AC power. To remove AC power from the Intelligent Sandbox Appliance, you must unplug the AC power cord from either the power supply or wall outlet for both the power supplies.
   
• If you press the push-button on/off power switch on the front panel of the Intelligent Sandbox Appliance while the appliance is running, it shuts down. If you want to power off the appliance, use CLI command — shutdown, then after the system halts—press the power button until the appliance turns off.
   
• The power supplies in your system might produce high voltages and energy hazards, which can cause bodily harm. Only trained service technicians are authorized to remove the covers and access any of the components inside the system.
   
• Hazardous electrical conditions might be present on power, telephone, and communication cables. Turn off the Intelligent Sandbox Appliance and disconnect telecommunications systems, networks, modems, and both the power cords attached to the Intelligent Sandbox Appliance before opening it. Otherwise, personal injury or equipment damage can result.
   
• This equipment is intended to be grounded. Ensure that the host is connected to earth ground during normal use.
   
• To avoid electric shock, do not connect safety extra-low voltage (SELV) circuits to telephone-network voltage (TNV) circuits. LAN ports contain SELV circuits, and WAN ports contain TNV circuits. Some LAN and WAN ports both use RJ-45 connectors. Use caution when connecting cables.

Avoid Injuries

Lifting the Intelligent Sandbox Appliance and attaching it to the rack is a two-person job.

Appliance outer shell

   
• Do not remove the outer shell of the Intelligent Sandbox Appliance. Doing so invalidates your warranty.
   
• Do not operate the system unless all cards, faceplates, front covers, and rear covers are in place. The faceplates and cover panels prevent exposure to hazardous voltages and currents inside the chassis. The components might produce high electromagnetic interference (EMI) that might disrupt other nearby equipment.
   
• Ensure that the appliance is placed in such a manner that flow of cooling air through the chassis is not blocked.

Deployment checklist

To make sure that your network is ready to set up Intelligent Sandbox, review the deployment checklist.

2 | Installation overview

3 | Installation overview

Installing the OS, software, and Email Connector

Your Intelligent Sandbox Appliance comes pre-installed with an operating system and Intelligent Sandbox software. Email Connector is not pre-installed and you need to install it separately.

Operating system and Intelligent Sandbox software for your appliance

You can install Intelligent Sandbox or Virtual Intelligent Sandbox 5.0 through:

   
• A clean install — Installs Operating system and Intelligent Sandbox 5.0 software. You'd use ATD_installer.5.0.xxxxx.x86_64.iso.

These are the possible upgrade paths from your current version of the Trellix Intelligent Sandbox software to the latest version.

Email Connector

Email Connector protects you from email borne threats by analyzing email attachments through Intelligent Sandbox.

3 | Installation overview

   

       

Important

   

   

Email Connector is not installed by-default when you install Intelligent Sandbox.

To install Email connector:

   
• Download the Email connector installer from the download site.
   
• SFTP the installer to your appliance.
   
• Install Email connector.

Download the product files

Download the Intelligent Sandbox product files from Trellix Downloads page.

Task

   
1. Go to Trellix Product Downloads.
   
2. Enter the grant number and email address associated with the product, then click Submit. The My Products page displays information about your licensed products.
   
3. Click Network Security Reseller Support > Intelligent Sandbox Software.
   
4. Click and download the installation files to your client computer.

Installer package details

Review and identify the packages you would use while installing the Operating system, Intelligent Sandbox software, and Email Connector.

36    Trellix Intelligent Sandbox 5.0.x Installation Guide

3 | Installation overview

4 | Installation overview

Upgrade the software

Upgrade the Intelligent Sandbox software and Android analyzer VM to the latest versions.

When you upgrade the Intelligent Sandbox software:

   
• You are unable to use the system.msu files to downgrade the Intelligent Sandbox software.
   
• OpenSSL automatically upgrades.

Upgrade your Intelligent Sandbox software

With every new release, Intelligent Sandbox is optimized for improved performance. Upgrade your Intelligent Sandbox software to the latest version.

   

       

Note

   

   

Intelligent Sandbox 5.0 is not available for Microsoft Azure.

For more information, refer the migration guide.

Upgrade your Intelligent Sandbox using Web-Interface or Command Line Interface.

Web-Interface

Task

   
1.        

   Use an SFTP client, such as Filezilla, to log on to the Intelligent Sandbox Appliance.

          

   Log on as the atdadmin user.

      
   
2.        

   Upload system-5.0.x.x.xxxxxx.msu to the Intelligent Sandbox root directory:

          

   Make sure that the transfer mode is binary.

      
   
3.        

   Use the following to upgrade the Intelligent Sandbox software, then repeat these steps to upgrade the Android analyzer VM.

          
              
   1. Log on to the Intelligent Sandbox web interface as the administrator.
              
   2. Click Manage → Image & Software → Software.
              
   3. From the System Software drop-down list, select the file.
              
   4. Make sure that Reset Database is deselected, then click Install.
              
   5. On the installation Status message, click OK.
          
          

   If you are unable to view the installation Status message, delete the browser cache.
   The installation takes a minimum of 20 minutes. It can take more than 20 minutes depending upon the number of sample analysis records present in Intelligent Sandbox and it should not be interrupted.

      

When the installation completes, the Intelligent Sandbox Appliance restarts.

4 | Installation overview

f. On the reboot Status message, click OK.

If you are unable to view the reboot Status message, delete the browser cache.

   
4.        

   When the Intelligent Sandbox Appliance starts, log on to the CLI and verify the software version.

      
   
5.        

   Log on to the Intelligent Sandbox web interface and verify the following.

          
              
   •                

     Software version

                
              
   •                

     All data and configuration settings are transferred from the previous Intelligent Sandbox installation

                
          
      
   
6.        

   Click Dashboard, then verify that the VM Creation status is Successful on the VM Status monitor.

          

   Intelligent Sandbox automatically re-creates all analyzer VMs. The amount of time it takes to re-create the analyzer VMs depends on the number of analyzer VMs configured in Intelligent Sandbox.

      

Command Line Interface

You can upgrade Intelligent Sandbox from CLI using the below command as well:

install msu <system-5.0.x.x.msu> <dbreset>

DBreset=1 : Database will be reset.

DBreset=0 : Database will be preserved.

   

       

Note

   

   

You may use this command to observe the progress of installation until it is completed and device goes for reboot.

Upgrade the software incrementally

Upgrade the Intelligent Sandbox software to an available patch version.

This application software upgrade option provides an incremental upgrade of the software to an available patch version. For a complete upgrade of the software, you need to download the software from the Trellix Product Downloads page. See the respective sections for detailed instructions on the tasks.

   

       

Note

   

   

Upgrading the application software also upgrades the detection packages. You would not see any previously installed detection packages after this upgrade. Also, the system services and system might restart during the application software upgrade process.

When updates are available for the application software and detection software package, notification messages appear in the toolbar of the Intelligent Sandbox interface.

4 | Installation overview

Automatically download the latest application software package

Automatically download and install the latest content updates in Intelligent Sandbox Appliance.

Task

   
1.        

   Log on to the Intelligent Sandbox web interface, then do one of these to access the Content Updates page.

          
              
   •                

     Click Click to Update Software from the header.

                
              
   •                

                        

                            

     Note

                        

                        

     When multiple notifications are available, select Click to Update Software from the list of notifications.

                    

                
              
   •                

     Click Manage → Image & Software → Content Update.

                
          
      
   
2.        

   Under Automatic Update, select Application Software, then click Apply.

      
   
3.        

   Select the Application Software tab, then click Install against the available software version.

          

   A confirmation message appears before the installation starts. All Intelligent Sandbox services are restarted. Once the process is complete, a status message appears that provides information about a successful upgrade and a suggestion to log on again to the Intelligent Sandbox interface.

      
   
4.        

   Log on to the Intelligent Sandbox interface again, then validate whether the upgrade was successful.

          
              
   •                

     From the header on Intelligent Sandbox interface, .

                
              
   •                

     Verify that the version is listed as Current: Click Manage → Image & Software → Content updates, then click the Application Software tab.

                
          
      

In case of any issues with the upgrade, click Revert to reverse the software to the previous backed-up version. You won't see the Revert option if Intelligent Sandbox software has been upgraded using system.msu.

Manually upload the latest application software package

Manually upload and install the latest content updates in Intelligent Sandbox.

Intelligent Sandbox allows you to import a maximum of two versions of the application software. The latest uploaded version is the Current upload by default, and renders the previous upload as Backup.

Task

   
1.        

   Log on to the Intelligent Sandbox web interface.

      
   
2.        

   Click Manage → Image & Software → Content Update.

      
   
3.        

   To download the application software package, contact Support.

      
   
4.        

   On the Content Updates page, click Browse, then select the application software package.

      
   
5.        

   Click Upload.

      

4 | Installation overview

To reinstate the Backup file as the Current file, click Revert.

Upgrade the Android analyzer VM

Using the Intelligent Sandbox web application, you can upgrade the Android analyzer VM.

Task

   
1.        

   Log on to the Intelligent Sandbox Appliance using an SFTP client such as FileZilla.

          

   Log on as the atdadmin user.

      
   
2.        

   Using SFTP, upload the Android MSU file to the root directory of Intelligent Sandbox.

      

   

               

Tip

   

   

Make sure that the transfer mode is binary.

   
3.        

   After the file is uploaded, log on to the Intelligent Sandbox web application as the admin user and select Manage → Software Management.

      
   
4.        

   Under System Software, select the Android MSU file, then click Install.

      

   

               

Note

   

   

Ensure that Reset Database is not selected.

   
5.        

   Click OK on the confirmation message.

          

   The Intelligent Sandbox web application closes, logs out automatically and the status of the installation is displayed in the browser.

          
              
   • It takes a minimum of 20 minutes for the system software installation to complete.
              
   • If you are not able to view these messages, clear the browser cache.
              
   • When you upgrade Android, the default Android analyzer VM is automatically re-created. This process might take a few minutes to complete.
          
      
   
6.        

   Log on to the web application, and select Manage → System Log.

      
   
7.        

   In the System Log page, verify that the vmcreator task is successfully completed for the Android analyzer VM.

      

View the Upgrade log

To upgrade the Trellix Intelligent Sandbox software version, view the upgrade path and version history logs.

4 | Installation overview

Sample upgrade log

The upgrade log displays details such as the current software version, the previous software version, and system details.

Application package [5.0.0.7] installed on [2022-05-25T12:49:56+0530]
Detection package [5.0.0.220525] installed on [2022-05-25T12:50:43+0530]
------------------------------------------------------
Wed May 25 12:51:33 IST 2022 Following version of software are installed
amas build version: 5.0.0.7.c0dfb7
systemex build version: 4.12.4.10.c7e722 [Valid]
email connector version: 7.6-4.12.2.6
buildscript version: 5.0.0.7.c0dfb7-5.0.0
avlabS-xp-v3-5.0.0.7.c0dfb7.msi
avlabS-64-v3-5.0.0.7.c0dfb7.msi
------------------------------------------------------

To view the Upgrade logs, log on to the Trellix Intelligent Sandbox and go to Manage → Logs → Upgrade.

5 | Installation overview

Install the Operating system and ATD software to your appliance

You can do a clean install of Intelligent Sandbox on your appliance. The clean install begins with installing the operating system.

Before you begin

Ensure that all previous ISOs and MSUs are removed from the SFTP directory of your Intelligent Sandbox. Use an FTP client to log on to your Intelligent Sandbox to remove these legacy files.

Task

   
1.        

   Download the operating system installer and transfer it to a USB storage device. To download the installer, follow these steps:

          
              
   1.                

      Go to Trellix Product Downloads.

                 
              
   2.                

      Enter your grant number and the captcha, then click Submit.

                 
              
   3.                

      Download the Installer which will do both Operating system and Intelligent Sandbox software installation.

                     

      ATD Installer: ATD_installer.5.0.x.xxxxx.x86_64.iso

                 
          
      
   
2.        

   Make the USB storage device bootable and connect it the Intelligent Sandbox Appliance. To make your USB storage device bootable, follow these steps:

          
              
   1.                

      Connect your USB storage device to your Linux system.

                 
              
   2.                

      Identify your USB storage device. Use the dmesg command to identify your USB storage device.

                     

      dmesg | grep sd

                     

      The command returns a list of all connected devices on your system.

                 
              
   3.                

      Format your USB storage device. Use the dd command to format your USB storage device.

                     

      dd if=/dev/zero of=/dev/sdX count=1234

                 
              
   4.                

      Copy the operating system ISO image to your Linux system.

                 
          
      

   

   

Tip

   

       
• Minimum required capacity of the USB Storage Device is 4 GB.
       
• Recommended Linux distributions are CentOS Linux 6.5 or Red Hat Enterprise Linux 7.
   

   

   

Note

   

Replace /dev/sdX with the device name as reported by the dmesg command earlier.

Trellix Intelligent Sandbox 5.0.x Installation Guide — page 43

5 | Installation overview

e. Write the operating system ISO image to your USB storage device. Use the dd command to write the image to your USB storage device.

dd if=<OS Installer Location> of=/dev/sdX bs=4M && sync

Replace <OS Installer Location> with the full path to the ISO image file you downloaded, sdX with the device name as reported by the dmesg command earlier.

   
3.        

   Connect the USB Storage Device to your Intelligent Sandbox appliance. Connect your RMM terminal or Intelligent Sandbox Monitor Console and keyboard to your Intelligent Sandbox appliance, then reboot your appliance using the reboot command.

      
   
4.        

   At the time of reboot, press F6 on the keyboard to enter the boot menu.

      
   
5.        

   From the boot device selection prompt, use the up or down arrow keys on the keyboard to select your USB storage device, then press Enter.

          

   The operating system installation begins from the USB storage device.

      

   

       

Important

   

   

Installer prompts you to take backup of your data or to proceed with a clean install. Since this is a clean install, any inputs to back up your data will fail. If you want to back up your data, we recommend you follow the migration procedure. For more information, see Trellix Intelligent Sandbox Migration Guide.

   
6.        

   Click Cancel to cancel the backup prompt, then click Yes to confirm to proceed with a clean install.

      

   

       

Note

   

   

The backup prompt screen times out in 120 seconds. If you do not provide any inputs with in the given time, the backup is initiated by default.

Results

The operating system installation now begins. Your appliance will reboot during the course of installation.

Once the operating system installation is complete, system.msu installation will begin automatically. Once the installation is complete, user will see Log on screen in the appliance.

   

       

Note

   

   

You should refrain from interacting with Console until you see the logon prompt. This is applicable for both USB and RMM methods.

5 | Installation overview

Setting up Intelligent Sandbox IP

Once the operating system and system.msu installations are complete, you can assign the IP to your appliance.

Task

   
1.        

   Log on to the Intelligent Sandbox Command-line Interface using the default username: cliadmin and password: atdadmin.

      
   
2.        

   If you have not configured your IP address and Gateway, set them for you appliance with these commands:

          
              
   •                

     To set the IP Address

                    

     set appliance ip <xxx.xxx.xxx.xxx> <xxx.xxx.xxx.xxx.>

                
              
   •                

     To set the gateway

                    

     set appliance gateway <xxx.xxx.xxx.xxx>

                
          
          

   For more information on these commands, see Trellix Intelligent Sandbox Product Guide.

      
   
3.        

   Post IP assignment, log on to your Intelligent Sandbox web interface to verify the software version.

      

Install the operating system to your appliance remotely using RMM

You can choose to install the operating system remotely to your appliance using RMM.

Before you begin

Ensure that all previous ISOs and MSUs are removed from the SFTP directory of your Intelligent Sandbox. Use an FTP client to log on to your Intelligent Sandbox to remove these legacy files.

Task

   
1.        

   Download the operating system installer. To download the installer, follow these steps:

          
              
   1.                

      Go to Trellix Product Downloads.

                 
              
   2.                

      Enter your grant number and the captcha, then click Submit.

                 
              
   3.                

      Download the installer which will do both Operating system and Intelligent Sandbox software installation.

                     

      ATD Installer: ATD_installer. 5.0.x.xxxxx.x86_64.iso

                 
          
      
   
2.        

   On your web browser, log on to the Intelligent Sandbox RMM IP address (http://<ATD RMM IP> or https://<ATD RMM IP>) and open the Intelligent Sandbox RMM console. If security setting of browser is blocking the page, do the following:

          
              
   •                

     Disable pop-up blocker for this webpage.

                
          
      

Trellix Intelligent Sandbox 5.0.x Installation Guide   45

5 | Installation overview

   
•        

  Add the ATD RMM URL to Local Windows Machine. Goto Control panel → Java → Security, then add your ATD RMM URL (for example: http://<ATD RMM IP> or https://<ATD RMM IP>) to the Exception Site List.

     

   
3.        

   From the Remote Control tab, then click Launch Console.

          

   Accept the JViewer Launcher security warning and the RMM console for your Intelligent Sandbox appliance is open.

      
   
4.        

   On the RMM Console screen click the Device tab, then select Redirect ISO.

      
   
5.        

   Browse and select to the operating system installer file on your local windows system.

      
   
6.        

   Log on to your Intelligent Sandbox console as cliadmin.

      
   
7.        

   Reboot the appliance using the reboot command.

      
   
8.        

   During start, press F6 to enter the boot menu.

      
   
9.        

   From the boot device selection prompt, use the up or down arrow keys on the keyboard to select Virtual CDROM 1.00, then press Enter.

      
   
10.        

    The operating system installation begins from the ISO image file.

       

   

       

Important

   

   

During the installation, the installer prompts you to take backup of your data or to continue with a clean install. Since this is a clean install, any input to back up your data fails. If you want to back up your data, we recommend you follow the migration procedure. For more information, see Trellix Intelligent Sandbox Migration Guide.

   
11.        

    Click Cancel on backup notification, then click Yes to continue for clean install.

       

Results

The operating system installation now begins. Your appliance reboots during installation. Once the operating system installation is complete, system.msu installation will begin automatically.Once the system.msu installation is complete, you will see the Log-on screen to your appliance. You can configure IP to your appliance now.

Installing Virtual Intelligent Sandbox

Trellix Virtual Intelligent Sandbox appliance can be installed and deployed on VMWare ESXi and Microsoft Hyper-V virtual machine environment.

   

       

Important

   

   

After a successful installation, take a snapshot of the Trellix Virtual Intelligent Sandbox instance in power off state. You might need that later to recover an erroneous installation. There is no USB recovery stick or Remote Management Module available with Trellix Virtual Intelligent Sandbox.

Install a Virtual Intelligent Sandbox instance

Place an order, download the software, then deploy it on the ESXi server.

5 | Installation overview

Before you begin

   
• Enable the nested virtualization on the VMware ESXi server. In an SSH session of ESXi server, add this property to the configuration file at /etc/vmware/config.

vhv.enable = "TRUE"

   

       

Note

   

   

Updating vhv.enable = "TRUE" in /etc/vmware/config is a global change on ESXi host. This change can be done at VM level from vSphere 5.5 and above version. For vATD, edit VM settings and enable the CPU flag for Hardware Virtualization as Expose hardware assisted virtualization to the guest OS. From ESXi host, it then adds vhv.enable = "TRUE" in VM's vmx file.

   
• Disable EVC mode before creating VMs on VMware ESXi.
   
• Deploy vATD always on Sandy Bridge or on updated processor architecture.

   

       

Note

   

   

vATD is not supported on Haswell, Nehalem, and older version processors. For example, VM creation fails if vATD is deployed on a processor architecture which is of an older version than Nehalem.

   
• From the ESX Web GUI or VCenter VM settings, enable Expose hardware assisted virtualization to the guest OS.

   

       

Note

   

   

Power off your VM before you change the VM settings.

   

       

Attention

   

   

Virtual Intelligent Sandbox does not support Dynamic MAC address. Make sure that you set a static MAC address for your Virtual Intelligent Sandbox.

To upgrade from an existing version of Trellix Virtual Intelligent Sandbox, see the Upgrade the software and Android analyzer VM topic in the Trellix Intelligent Sandbox product guide. If you upgrade from a trial version of the software, obtain the license key and grant number from the Trellix order fulfillment team at licensing@trellix.com again and activate it.

Task

   
1. Place a Purchase Order (PO) for Trellix Virtual Intelligent Sandbox, and receive an email with your grant number and license key.
   
2. Go to Trellix Product Downloads with grant number and download the software.

5 | Installation overview

Package name format: vATD-MIO-5_x_x_xx-xxxxx-xxxxx.ova

   
3.        

   Deploy the software on an ESXi server.

          
              
   1.                

      From a vSphere client, select File → Deploy OVF Template.

                 
              
   2.                

      Click Browse, locate and select the Trellix Virtual Intelligent Sandbox software, click Open, then click Next.

                 
              
   3.                

      Type a name the OVF template, then click Next.

                 
              
   4.                

      On Disk Format, select Thin Provision, then click Next.

                 
              
   5.                

      On Network Mapping, select a network, then click Next.

                 
              
   6.                

      Review the deployment settings, select Power on after deployment, then click Finish.

                 
          
      

What to do next

For multiple Trellix Virtual Intelligent Sandbox instances, deploy the OVA again.

Install Virtual Intelligent Sandbox on Hyper-V using the automated script

Place an order, download the software, then use the downloaded script to easily deploy Virtual Intelligent Sandbox on the Hyper-V server.

Before you begin

   
•        

  Enable Hyper-V (including Hyper-V Management Tools and Hyper-V Platform) from Control Panel → Programs and Features → Turn Windows features on or off → Hyper-V.

     
   
•        

  Disable Hyper-V compatibility mode on your Hyper-V server.

     

Virtual Intelligent Sandbox for Hyper-V is supported on the following platforms:

   
•        

  Windows Server 2016 Standard (Server with GUI)

     
   
•        

  Windows Server 2016 Datacenter (Server with GUI)

     

Requirements:

   

• Disk size: 400 GB

   

• RAM size: 48 GB

   

• Virtual CPU Cores: 16

   

       

Note

   

   

       

• The Hyper-V host and guest must both be on the supported platforms.

       

• For nested virtualization, ensure that you have Hyper-V 2016.

   

5 | Installation overview

Your downloaded package consists of two scripts. This gives you three methods to install Virtual Intelligent Sandbox on Hyper-V.

   
• Using setup.exe – Run this file as an administrator to create an instance of Virtual Intelligent Sandbox on Hyper-V.

   

       

Note

   

   

This VM creation method requires Visual C++ runtime package.

   
• Using deploy_hvatd.ps1 – Run this PowerShell script to create an instance of Virtual Intelligent Sandbox on Hyper-V.
   
• Using your own changed deploy_hvatd.ps1 – You can change this PowerShell script according to your needs, then run it to create an instance of Virtual Intelligent Sandbox on Hyper-V.

   

       

Note

   

   

deploy_hvatd.ps1 is signed by McAfee. If you change the script, it loses the McAfee signature.

Task

   
1. Place a Purchase Order (PO) for Trellix Virtual Intelligent Sandbox, and receive an email with your grant number and license key.
   
2. Log on to Trellix Product Downloads with the grant number and download the software package. Package name format: hvATD_MIH_5_x_x_xx_xxxxx_xxxxx.zip
   
3. Unzip the .zip file to any location on your system.
   
4. Do one of the following:        
              
   • Run setup.exe as an Administrator.
          
      

The setup automatically creates one instance of Virtual Intelligent Sandbox. The first instance is named hvatd1. You can run setup.exe multiple times depending on the number of Virtual Intelligent Sandbox instances that you require.

   
• Run deploy_hvatd.ps1 to create an instance of Virtual Intelligent Sandbox on Hyper-V.

   

       

Note

   

   

You might have to set the execution policy using Set-ExecutionPolicy RemoteSigned.

5 | Installation overview

Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true

   
1.        

   Add a network interface for the VMs.

          
              

   1. Open Hyper-V Manager, then select a Virtual Intelligent Sandbox instance.

              

   2. Right-click on the VM, then click Settings.

              

   3. In the navigation pane, click Add Hardware, then choose a network adapter.

              

   4. Click Add, then under Network, select the virtual network you want to connect to.

              

   5. Click OK.

          
      

Install Virtual Intelligent Sandbox on Hyper-V manually

Place an order, download the software, then deploy it on Hyper-V server.

Before you begin

   
• Ensure that you have enabled Hyper-V (including Hyper-V Management Tools and Hyper-V Platform) from Control Panel → Programs and Features → Turn Windows features on or off → Hyper-V.
   
• Unzip the Virtual Intelligent Sandbox package that you purchased from McAfee. The package includes hvATD.vhdx. This is the disk image of Virtual Intelligent Sandbox.
   
• Disable Hyper-V compatibility mode on your Hyper-V server.

Task

   

1. Open Hyper-V Manager, then from the Actions pane, select New → Virtual Machine....

   
2.        

   Type a name for your virtual machine, then click Next.

          

   You can also choose to store your virtual machine at an alternate location.

      
   

3. In the Specify Generation section, choose Generation 1.

   

4. In the Assign Memory section, set 48 GB.

   

5. In the Configure Networking section, choose a virtual switch.

50

Trellix Intelligent Sandbox 5.0.x Installation Guide

5 | Installation overview

   
6.        

   In the Connect Virtual Hard Disk section, select Use an existing virtual hard disk.

      
   
7.        

   Click Browse, then select hvATD.vhdx, and then click Finish.

      

   

   

       

Note

   

   

If you plan to deploy multiple instances of Virtual Intelligent Sandbox, make a copy of hvATD.vhdx.

   
8.        

   Right click on the VM, then select Settings → Memory → Processor, then set the processor core to 16.

      
   
9.        

   Open PowerShell. Enable nested virtualization using the following command:

          

   Set-VMProcessor -VMName <Target VM’s name > -ExposeVirtualizationExtensions $true

          

   In <Target VM's name>, enter the name of the VM that you created.

      
   
10.        

    Set Static IP address and Gateway to the VM using Intelligent Sandbox console.

       

Prepare your sandbox virtual machine

Prepare your Windows environment to capture malware behaviors in the sandbox.

Task

   
1. Connect to your VM using Remote Desktop Connection and log on to your VM.
   
2. Open Local Users and Groups from the Control Panel.
   
3. In the left page, click Users.
   
4. In the right page, select a user and rename it to Administrator.
   
5. Set the Administrator password to cr@cker42.
   
6. Restart your VM.
   
7. Log on to your VM, then open Control Panel → System → Advanced system settings.
   
8. In the Advanced Tab of the System Properties window, under Performance, select Settings....
   
9. In the Performance Options windows, select Advanced → Change....
   
10. In the Virtual Memory windows, select Automatically manage paging file size for all drives, then click OK.
   
11. Install and configure Adobe Reader.        
               
    1. To analyze PDF files, download Adobe Reader to the native host and install it to the VM.
               
    2. In Adobe reader, if Adobe Reader Protected Mode message appears, click Open with Protected Mode disabled, then click OK.
               
    3. If Accessibility Setup Assistance message appears, click Cancel.
               
    4. Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.
           
       
   
12. Install and configure Java.        
               
    1. Open Registry Editor.
               
    2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy\EnableJavaUpdate.
               
    3. Set its value to 0.
           
       

Trellix Intelligent Sandbox 5.0.x Installation Guide

51

5 | Installation overview

   
13.        

    Install and configure Adobe Flash Player.

           
               
    1.                

       Run the command prompt as an Administrator.

                  
               
    2.                

       Execute the following command:

                      

       dism.exe /online /add-package /packagepath:"<Adobe-Flash-For-Windows-Package>.mum"

                  
           
       
   
14.        

    Run the VM Provisioner Tool.

       
   
15.        

    Shrink the volume to about between 20 GB and 30 GB and leave the rest unallocated.

       
   
16.        

    Download Disk2vhd and extract it on your VM.

           

    You can download Disk2vhd from:

           

    https://docs.microsoft.com/en-%20us/sysinternals/downloads/disk2vhd

       
   
17.        

    Run the extracted disk2vhd.exe file.

       
   
18.        

    Select your primary drive, then click Create.

       
   
19.        

    After, the VHDX file is created reduce its virtual size.

           
               
    1.                

       Open PowerShell.

                  
               
    2.                

       Run the following command:

                      

       Resize-VHD -Path <path to your vhdx file> -ToMinimumSize

                  
           
       
   
20.        

    Convert your VHDX file to an image file.

           

    For details about how to convert your VHDX file to an image file, see Trellix Intelligent Sandbox Product Guide.

       

Activate the product

Activate your Trellix Virtual Intelligent Sandbox software using a temporary or permanent license key.

Before you begin

Obtain the license key and grant number from the Trellix order fulfillment team at licensing@trellix.com.

Trellix Virtual Intelligent Sandbox supports these license key types:

   
• 30-days trial key — A temporary license valid for 30 days is obtained on the initial purchase of the product. This license is

52      Trellix Intelligent Sandbox 5.0.x Installation Guide

5 | Installation overview

based on the version of the Trellix Virtual Intelligent Sandbox software that you install.

   
• Permanent license key — A permanent license is purchased for a certain period. At the time of purchase, you can provide the end date of the permanent license. This license is based on the system ID of the Trellix Virtual Intelligent Sandbox instance.

You also need the grant number to activate your product.

Activate the product using the temporary key

Activate your Trellix Virtual Intelligent Sandbox software using the temporary license key.

Task

   
1. Save temporary license key file to desktop and make a note of grant number from the grant email.
   
2. Log on to the Trellix Virtual Intelligent Sandbox interface.        

   When you log on for the first time, you would see a message box requesting to activate Intelligent Sandbox instance with a license. Click OK to close the box or click Help for further assistance.

      
   
3. Select Manage → ATD Configuration → Licensing.
   
4. Click Browse, locate and select the temporary license file, then click Open.
   
5. Type the grant number, then click Activate.        

   Once the process is complete, the license details appear in the License Information section.

      
   
6. Check whether:        
              
   1. The license status is Activated.
              
   2. The validity date is correct.
          
      

   

       

Note

   

   

ATD-3200/ ATD-6200 does not require license after upgrade to Intelligent Sandbox version 4.12.

Activate the product using the permanent key

Obtain a permanent license key and activate your Trellix Virtual Intelligent Sandbox software.

Task

   
1. Obtain the system ID from the command line interface or web-interface of the Trellix Virtual Intelligent Sandbox software instance.

Command line interface

   
1. Log on to the command line interface with a valid user name.

Trellix Intelligent Sandbox 5.0.x Installation Guide

53

5 | Installation overview

The default user name is cliadmin and password is atdadmin.

   
2.        

   Run show system id.

      
   
3.        

   From the result, make a note of the System ID from the result.

      

Web-interface

   
1.        

   Log on to the Trellix Virtual Intelligent Sandbox interface.

      
   
2.        

   Select Manage → TIS Configuration → Licensing → Licensing

      
   
3.        

   From the License Information section, make a note of the Device System ID.

      

   
2.        

   Send an email with the System ID to the Trellix order fulfillment team at licensing@trellix.com.

          

   You can send System IDs of all Trellix Virtual Intelligent Sandbox instances.

      
   
3.        

   After you receive an email with the grant number and license key, register your product on the Manage → TIS Configuration → Licensing page.

      
   
4.        

   Click Browse, locate and select the permanent license file, then click Open.

      
   
5.        

   Type the grant number, then click Activate.

          

   Once the process is complete, the license details appear in the License Information section.

      
   
6.        

   Check whether:

          
              

   1. The license status is Activated.

              

   2. The validity date is correct.

              

   3. The system ID is correct.

          
      

Install Email Connector

Email connector is not installed with the Intelligent Sandbox software. You need to install this feature separately, then configure your email gateway to send emails to Intelligent Sandbox for analysis.

Before you begin

   

• Ensure that your appliance does not have an existing atdec user account. This user account is dedicated for Email Connector to communicate with Intelligent Sandbox.

   

• Configure eth0 as the management interface. Email traffic on any other interface will not be redirected to the Email Connector.

Task

   

1. Download systemex-5.x.x.xx.xxxxx.msu from Trellix Product Downloads.

   

2. Upload the package to the appliance using SFTP with the atdadmin account.

   

3. Log on to the Intelligent Sandbox web interface.

   

4. On the right pane, select Image & Software → Software.

   

5. In the Manage tab, under System Software section, from the drop-down select systemex-5.x.x.xx.xxxxx.msu.

   

6. Click Install, then follow the on-screen instructions to complete the installation.

5 | Installation overview

Results

   

               

Note

   

   

       
• If you have configured a cluster, ensure that you install Email connector in your primary as well as the back up nodes.
       
• The Intelligent Sandbox dashboard shows the systemex version number under the System information monitor. To configure email connector, see Intelligent Sandbox Product Guide.
   

Creating analyzer VMs

Intelligent Sandbox uses secure virtual machines, or analyzer VMs, for dynamic analysis. During dynamic analysis, Intelligent Sandbox executes suspicious files in the analyzer VM, then monitors the file behavior for malicious activities.

   

       

Note

   

   

       

The number of analyzer VMs you can create is limited by the following conditions:

       

           
• The available Intelligent Sandbox Appliance disk space.
           
• The disk space occupied by the operating system.
       

   

Intelligent Sandbox limits the maximum number of analyzer VMs you can use for analysis.

   
• ATD-3000 — 29 analyzer VMs
   
• ATD-6000 — 59 analyzer VMs
   
• ATD-3100 — 29 analyzer VMs
   
• ATD-6100 — 59 analyzer VMs
   
• ATD 3200 — 29 analyzer VMs
   
• ATD-6200 — 59 analyzer VMs

The number of concurrent licenses that you specify affects the number of concurrent active analyzer VMs.

Any security software or low-level utility tool on an analyzer VM can interfere with the dynamic analysis of the sample file. The sample-file execution can be closed during dynamic analysis. As a result, the reports might not capture the full behavior of the sample file. If you need to find out the complete behavior of the sample file, do not update the operating system of the analyzer VM or install any security software on it.

   

       

Important

   

   

       

           
• Make sure that you upload the VMDK to your Intelligent Sandbox before activating your Microsoft Windows and Office. Use the Activation feature available in the Intelligent Sandbox Web interface. For more information, see Create VM profiles.
           
• If you activate your Microsoft Windows and Microsoft Office on VMware Workstation, VMware ESXi Server, or Microsoft Hyper-V, your licenses are lost due to change in hardware.
       

   

Create a VM using the VM Builder

The VM Builder tool makes it easier for you to create VMs for VMware ESXi. The tool allows you to include all needed installers and OS ISO, then seamlessly create VMs for you. The tool supports operating systems configured only for the English language.

6 | Installation overview

Before you begin

   
• Enable SSH on ESXi 6.0 Server.
   
• Add the following USB Pass-through and reboot ESXi:        
             
  • C600/X79 series chipset USB2 Enhanced Host Controller #1
             
  • C600/X79 series chipset USB2 Enhanced Host Controller #2
         
     
   
• Copy the following installers to a USB drive. Ensure that the USB driver is formatted with NTFS file system.        
             
  • Adobe Reader
             
  • Adobe Flash Player
             
  • Java
             
  • Microsoft Office
             
  • Microsoft Visual C++ Redistributable
             
  • Web browser - Internet Explorer, Chrome, Firefox, and Microsoft Edge (we support Microsoft Edge only on Windows 10 OS)
         
     
   
• Upload the Windows ISO to the ESXi Datastore.
   
• Download and install Visual C++ 2012 Redistributable (x86) on your local system.

Task

   
1.        Download the VM Builder tool:        
              
   1. Log on to Intelligent Sandbox.
              
   2. Click Manage → Image & Software → Image, then click Download VM Builder Tool.
          
      
   
2. Run the VM Builder Tool as an Administrator.
   
3. Type the IP address, user name, password, and port of your ESXi, then select the checkbox.
   
4.        Click Test SSH Connection, and then click Next.        

   If you are prompted to store the RSA2 key fingerprints, type 'y' and press enter.

      
   
5.        From the drop-down, select the Datastore from the list, then click Fetch ISO.        

   The tool fetches all datastore from $/vmfs/volumes/ on ESXi.

      
   
6. From the list of Windows ISO, select an ISO for your Windows VM.
   
7. From the drop-down, select the OS corresponding to the ISO that you have selected, then click Select OS.
   
8. Change the VM name if needed, then click Check Availability, click Next.
   
9. Use the browse icon to select the USB drive where you have copied the installer files.
   
10. Choose the installer for the corresponding software.

   

Note

   

       
• Visual C++ 2012 Redistributable (x86) must be installed.
       
• All installers must be offline installers.
       
• All installers must be compatible with the respective operating systems.
   

6 | Installation overview

If you do not want to install any of the other software except VC++, you can leave the respective field blank.

   

11. Click Next to continue.

   

12. Type the License key for Microsoft Windows and Office, then click Next.

   

13. Review the Summary, click Create VM.

   

14. Open vSphere Client, and select the VM that you create using VM Builder.

   

15. From the toolbar, click the USB icon, and select your USB drive.

   

16. Once the USB is connected, your Windows OS automatically begins installation.

If you could not connect the USB drive to the VM in 10 Sec, the VM Builder prompts you to reset the VM. Click Yes and the VM gets reset. Now connect the USB in 10 secs.

Results

   
• Once the virtual machine is created, the VM Provisioner tool executes automatically. After the VM Provisioner tool completes the checks, review the VM Provisioner log on the C drive of the virtual machine. If you see any issues, correct them and run VM Provisioner tool again.
   
• If the network is disconnected while the USB is connected to VM, the USB might crash.        

  Solution: Restart your local system. You might lose some settings on your VM.

     
   
• vSphere Client takes a long time to connect the USB drive.        

  Solution: Log on again to vSphere Client, then connect the USB, and reset the VM.

     

Create a virtual machine on VMware Workstation

To create the virtual machine, you must complete the New Virtual Machine Wizard.

Task

   

1. Make sure you have your operating system ISO image and license key.

6 | Installation overview

   
2. Download and install VMware Workstation 9.0 or later.
   
3. Start the VMware Workstation.
   
4. On the VMware Workstation page, select File → New Virtual Machine.
   
5. To complete the New Virtual Machine Wizard, configure the following options, then click Next on each page.

   

       

Note

   

   

These steps are documented based on VMware Workstation 12 Pro.

6

Installation overview

   

Note

   

The sandbox VMs will be updated to multi processors during VM profile creation process on ATD.

Create a virtual machine on VMWare ESXi

To create the virtual machine, you must complete the New Virtual Machine Wizard.

Task

   
1. Make sure you have your operating system ISO image and license key.
   
2. Download and install VMware ESXi.
   
3. Start the VMware ESXi.
   
4. On the VMware ESXi page, select File → New → New Virtual Machine.

Trellix Intelligent Sandbox 5.0.x Installation Guide

61

6 | Installation overview

5. Configure the following options, then click Next on each page.

6 | Installation overview

   
6.        

   Select your new virtual machine, then click Edit virtual machine settings.

      
   
7.        

   In the Virtual Machine Properties page, do the following:

          
              
   •                

     Select CD/DVD Drive1.

                
              
   •                

     In Device Status, enable Connect at power on.

                
              
   •                

     In Datastore ISO File, use Browse to provide the location of the operating system you plan to install in your virtual machine.

                
              
   •                

     In Virtual Machine Node, select IDE (1:0).

                
          
      
   
8.        

   Click Finish.

      

   

       

Note

   

   

The sandbox VMs will be updated to multi processors during VM profile creation process on ATD.

Create a virtual machine on Hyper-V Manager

This topic explains how to create a virtual machine in Microsoft Hyper-V Manager.

Before you begin

Ensure that you have enabled Hyper-V (including Hyper-V Management Tools and Hyper-V Platform) from Control Panel → Programs and Features → Turn Windows features on or off → Hyper-V.

   

       

Note

   

   

Intelligent Sandbox does not support the following operating systems on Hyper-V:

   

• Microsoft Windows XP

   

• Microsoft Windows Server 2003

   

• Microsoft Windows 8 32-bit

Task

   
1.        

   Open Hyper-V Manager, then from the Actions pane, select New → Virtual Machine....

      

Trellix Intelligent Sandbox 5.0.x Installation Guide

63

6 | Installation overview

   
2.        

   Type a name for your virtual machine, then click Next.

          

   You can also choose to store your virtual machine at an alternate location.

      
   
3.        

   In the Specify Generation section, choose Generation 1.

      
   
4.        

   In the Assign Memory section, type the appropriate RAM size.

      
   
5.        

   In the Configure Networking section, choose a virtual switch.

      
   
6.        

   In the Connect Virtual Hard Disk section, select Create a virtual hard disk.

          
              
   1.                

      Type a name for the hard disk.

                 
              
   2.                

      Specify the location where you want to save the VHDX file.

                 
              
   3.                

      Type an appropriate size for the hard disk, then click Next.

                 
          
      
   
7.        

   In the Installation Options section, select Install an operating system from a bootable CD/DVD-ROM.

      
   
8.        

   Select Image file (.iso), then browse and select the image file, then click Next.

      
   
9.        

   In the Summary page, review the settings, then click Finish.

      

   

       

Note

   

   

The sandbox VMs will be updated to multi processors during VM profile creation process on ATD.

Create a virtual disk file

Create a virtual disk file of the ISO image on VMWare or Hyper-V.

Create a virtual disk file for Windows XP

If you are using Windows XP, use the following steps to create the virtual disk file.

Task

   
1.        

   Complete the Windows XP setup.

          
              
   1.                

      On the Setup cannot continue until you enter your name. Administrator and Guest are not allowable names to use message, click OK.

                 
              
   2.                

      In the Windows XP Professional Setup window, enter the following, then click Next.

                     
                         
      •                        

        Name — root

                           
                         
      •                        

        Organization — Leave blank.

                           
                     
                 
              
   3.                

      If prompted, log on to virtual machine image with the following credentials.

                     
                         
      •                        

        User — administrator

                           
                         
      •                        

        Password — cr@cker42

                           
                     
                 
          
      
   
2.        

   In the Virtual Machine Settings window, select CD/DVD (IDE).

      
   
3.        

   Next to the Use ISO image file field, click Browse, locate the ISO file, then click OK.

      
   
4.        

   Download and install the following Redistributable Packages and .NET Framework.

          
              
   •                

     Microsoft Visual C++ 2005 Redistributable Package (x86)

                
          
      

6 | Installation overview

   
• Microsoft Visual C++ 2008 Redistributable Package (x86)
   
• Microsoft Visual C++ 2010 Redistributable Package (x86)
   
• Microsoft .NET Framework 3.5 Service Pack 1 (x86)

5. Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Create a virtual disk file for Windows Server 2003

If you are using Windows Server 2003, use the following steps to create the virtual disk file.

Task

   
1.        

   In the VMware ESXi, turn on the virtual machine, then install Windows Server 2003.

          
              
   • This step can take up to 30 minutes.
              
   • To format the partition during installation, you can use the NTFS file system.
          
      
   
2.        

   For each Windows setup window, configure the options, then click Next.

      

6 | Installation overview

   
3.        

   To log on to the virtual machine, use these credentials:

          
              
   •                

     User — administrator

                
              
   •                

     Password — cr@cker42

                
          
      
   
4.        

   In the Windows Server Post-Setup Security Updates window, click Finish.

      
   
5.        

   If you are using Windows Server 2003 SP1, complete the following.

          
              
   1.                

      Install the hotfix for Microsoft Windows Server 2003.

                 
              
   2.                

      Restart your computer.

                 
              
   3.                

      On the command prompt, enter tlntsvr /service, then press Enter.

                 
          
      
   
6.        

   Download and install the following Redistributable Packages and .NET Framework.

          
              

   • Microsoft Visual C++ 2005 Redistributable Package (x86)

              

   • Microsoft Visual C++ 2008 Redistributable Package (x86)

              

   • Microsoft Visual C++ 2010 Redistributable Package (x86)

              

   • Microsoft .NET Framework 3.5 Service Pack 1 (x86)

          
      
   
7.        

   Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

      

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Create a virtual disk file for Windows 7

If you are using Windows 7, use the following steps to create the virtual disk file.

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, then click Next.

      
   
3.        

   Accept the license terms, then click Next.

      
   
4.        

   On the Windows Setup page, select Custom: Install Windows only (advanced), leave the default disk space settings,

      

6 | Installation overview

then click Next.

   
5. Use the following credentials to create an account:        
              
   • User name — administrator
              
   • Password — cr@cker42
          
      
   
6. In the Removable Devices window, select Do not show this hint again, then click OK.        

   The Windows installation can take up to 15 minutes.

      
   
7. In the Set Network Location window, select Public Network, then close the window.
   
8. Download and install Microsoft .NET Framework 4.6.1.
   
9. Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

   

       

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Create a virtual disk file for Windows 8

If you are using Windows 8, use these steps to create the virtual disk file.

Task

   
1. From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.
   
2. Click Install Now, then click Next.
   
3. Accept the license terms, then click Next.
   
4. On the Windows Setup page, select Custom: Install Windows only (advanced), leave the default disk space settings, then click Next.
   
5. In the Settings window, select Use Express settings.
   
6. In sign in to your PC, select Sign in without a Microsoft Account, then select Local Account.
   
7. Use the following credentials to create an account:        
              
   • User name — administrator
              
   • Password — cr@cker42
          
      
   
8. Configure Adobe Reader as the default application to open PDF files.        
              
   1. Open the Control Panel, then select Programs → Default Programs → Associate a file type or protocol with a program.
              
   2. Double-click .pdf, then select Adobe Reader.
              
   3. Click Close.
          
      
   
9. In the Removable Devices window, select Do not show this hint again, then click OK.        

   The Windows installation can take up to 15 minutes.

      
   
10. To log on to the virtual machine Image, use these credentials:

6 | Installation overview

   
• Administrator
   
• cr@cker42

   
11. To switch to desktop mode, click the desktop tile.
   
12. Download and install Microsoft .NET Framework 4.6.1 and above.
   
13. Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Create a virtual disk file for Windows Server 2008

If you are using Windows Server 2008, use the following steps to create the virtual disk file.

Task

   
1. From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.
   
2. Click Install Now, then click Next.
   
3. Accept the license terms, then click Next.
   
4. On the Windows Setup page, select Custom (advanced), leave the default disk space settings, then click Next.
   
5. Set password for administrator account.
   
6. In the Removable Devices window, select Do not show this hint again, then click OK.        

   The Windows installation can take up to 15 minutes.

      
   
7. In the Initial Configuration Tasks window, select Do not show this window at logon, then click Close.
   
8. Log on to the computer, then download the following packages:        
              
   • Microsoft Visual C++ 2005 Redistributable Package (x86)
              
   • Microsoft Visual C++ 2008 Redistributable Package (x86)
              
   • Microsoft Visual C++ 2010 Redistributable Package (x86)
              
   • Microsoft .NET Framework 4.6.1
          
      
   
9. Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

6 | Installation overview

Create a virtual disk file for Windows 8.1

If you are using Windows 8.1, use these steps to create the virtual disk file.

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, then click Next.

          

   Installation process is completed in various stages. The setup is first initialized.

      
   
3.        

   On the Activate Windows page, enter your Windows product key, or select I don't have a product key to activate it later, then click Next.

      
   
4.        

   Accept the license terms, then click Next.

      
   
5.        

   On the Windows Setup page, select Custom: Install Windows only (advanced), use the default disk space settings, then click Next.

          

   The step is completed in five stages. Wait for all stages to complete.

      
   
6.        

   In the Settings window, select Use Express settings.

      
   
7.        

   For the type of owner, select I own it, then click Next.

      
   
8.        

   Asked to enter your Microsoft Account Details, select Skip this step.

      
   
9.        

   Asked to create an account, use these credentials, then click Next.

          
              

   • User name — administrator

              

   • Password — cr@cker42

          
      
   
10.        

    Asked about Cortana, select Not now.

       
   
11.        

    Wait until the installation is complete, then install the required software.

       
   
12.        

    Check that these redistributable packages are installed.

           
               

    • Microsoft Visual C++ 2005 Redistributable Package (x86)

               

    • Microsoft Visual C++ 2008 Redistributable Package (x86)

               

    • Microsoft Visual C++ 2010 Redistributable Package (x86)

               

    • Microsoft .NET Framework 4.6.1 and above

           
       
   
13.        

    Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

       

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Create a virtual disk file for Windows 10

If you are using Windows 10, use these steps to create the virtual disk file.

6 | Installation overview

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, then click Next.

          

   Installation process is completed in various stages. The setup is first initialized.

      
   
3.        

   On the Activate Windows page, enter your Windows product key, or select I don't have a product key to activate it later, then click Next.

      
   
4.        

   Accept the license terms, then click Next.

      
   
5.        

   On the Windows Setup page, select Custom: Install Windows only (advanced), use the default disk space settings, then click Next.

          

   The step is completed in five stages. Wait for all stages to complete.

      
   
6.        

   Choose United States in region, and in primary keyboard, select English (United States).

      
   
7.        

   In the Settings window, select Use Express settings.

      
   
8.        

   For the type of owner, select I do, then click Next.

      
   
9.        

   In the Make it yours window, select Skip this step.

      
   
10.        

    In the Meet Cortana windows, select Not now.

       
   
11.        

    In the Choose how you'll connect' window, select Join a local Active Directory domain.

       
   
12.        

    In the Create an account for this PC window, use these credentials, then click Next.

           
               

    • User name — admin

               

    • Password — cr@cker42

           
       
   
13.        

    In the Choose Privacy settings window, keep the default settings, then click Next.

       
   
14.        

    Wait until the installation is complete, then install the required software.

       
   
15.        

    Run the VM Provisioner tool as an administrator or prepare the image for analysis. On Windows 10, Administrator account is disabled by default. To enable, do the following:

           
               

    1. Run VM Provisioner Tool as a non-administrator user.

               

    2. Restart the virtual machine.

                      

       The Administrator account is enabled once the virtual machine is started.

                  
               

    3. Log on to Windows as the Administrator user.

               

    4. Run VM Provisioner Tool again.

           
       
   
16.        

    Check that these redistributable packages are installed.

           
               

    • Microsoft Visual C++ 2005 Redistributable Package (x86)

               

    • Microsoft Visual C++ 2008 Redistributable Package (x86)

               

    • Microsoft Visual C++ 2010 Redistributable Package (x86)

               

    • Microsoft Visual C++ 2012 Redistributable Package (x86)

               

    • Microsoft .NET Framework 4.7 and above

           
       

   

               

Note

   

   

admin and Administrator user accounts are not the same.

6 | Installation overview

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

   

       

Note

   

   

If you are using any later build/version of win 10 1909.18363.418, it's required to switch off tamper protection manually inside win 10 VMs for better detection.

Following are the steps to turn off Tamper Settings:

   
1. Click on the Start button.
   
2. Click on Settings.
   
3. Go to Updates and Security
   
4. Select Windows Security
   
5. Switch to Virus and Threat Protection
   
6. Select Manage Settings
   
7. Scroll a bit to find Tamper Protection
   
8. Toggle Off

.

Create a virtual disk file for Windows 11

If you are using Windows 11, use these steps to create the virtual disk file. We recommend that you disable the Internet when creating Windows 11 virtual disks in order to prevent Microsoft from updating Windows Defender.

Task

   
1. From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next. Install Now page is displayed.
   
2. Open command prompt and run the following commands:        
              
   • reg add HKLM\System\Setup\LabConfig /v BypassTPMCheck /t reg_dword /d 0x00000001 /f > NUL
              
   • reg add HKLM\System\Setup\LabConfig /v BypassSecureBootCheck /t reg_dword /d 0x00000001 /f > NUL
              
   • reg add HKLM\System\Setup\LabConfig /v BypassRAMCheck /t reg_dword /d 0x00000001 /f > NUL
              
   • reg add HKLM\System\Setup\LabConfig /v BypassStorageCheck /t reg_dword /d 0x00000001 /f > NUL
              
   • reg add HKLM\System\Setup\LabConfig /v BypassCPUCheck /t reg_dword /d 0x00000001 /f > NUL
          
      
   
3. Close the command prompt and click Install Now, then click Next. Installation process is completed in various stages. The setup is first initialized.
   
4. On the Activate Windows page, enter your Windows product key, or select I don't have a product key to activate it later, then click Next.
   
5. Accept the license terms, then click Next.
   
6. On the Windows Setup page, select Custom: Install Windows only (advanced), use the default disk space settings, then ...

Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

click Next.

The step is completed in five stages. Wait for all stages to complete.

   
7. Choose United States in region, and in primary keyboard, select English (United States).
   
8. In the Settings window, select Use Express settings.
   
9. For the type of owner, select I do, then click Next.
   
10. In the Make it yours window, select Skip this step.
   
11. In the Meet Cortana windows, select Not now.
   
12. In the Choose how you'll connect' window, select Join a local Active Directory domain.
   
13. In the Create an account for this PC window, use these credentials, then click Next.        
               
    • User name — admin
               
    • Password — cr@cker42
           
       
   
14. In the Choose Privacy settings window, keep the default settings, then click Next.
   
15. Wait until the installation is complete, then install the required software.
   
16. Run the VM Provisioner tool as an administrator or prepare the image for analysis. On Windows 11, Administrator account is disabled by default. To enable, do the following:        
               
    1. Run VM Provisioner Tool as a non-administrator user.
               
    2. Restart the virtual machine.                

       The Administrator account is enabled once the virtual machine is started.

                  
               
    3. Log on to Windows as the Administrator user.
               
    4. Run VM Provisioner Tool again.
           
       

   

       

Note

   

   

admin and Administrator user accounts are not the same.

   
17. Check that these redistributable packages are installed.        
               
    • Microsoft Visual C++ 2005 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2008 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2010 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2012 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2015 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2017 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft Visual C++ 2019 Redistributable Package (32-bit and 64-bit)
               
    • Microsoft .NET Framework 3.5 and above which must be enabled manually or via an offline executable.
           
       

   

       

Note

   

   

       
• The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.
       
• If you are using any later build/version of Windows 11, its required to switch off tamper protection manually inside Windows 11 VMs for better detection.
   

6 | Installation overview

Following are the steps to turn off Tamper Settings:

   
1.        

   Click on the Start button.

      
   
2.        

   Search for Windows Security and select the top result to open the application.

      
   
3.        

   Click Virus and Threat Protection

      
   
4.        

   Under the Virus and Threat Protection section, select the Manage Settings option.

      
   
5.        

   Disable Tamper Protection.

      

.

Create a virtual disk file for Windows 2012

If you are using Windows 2012, use these steps to create the virtual disk file.

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, accept the license terms, then click Next.

      
   
3.        

   Select Custom Install Windows, Windows Server 2012 Datacenter, use the default disk space settings, then click Next.            
   Installation process is completed in various stages.

      
   
4.        

   Set password for administrator account.

      
   
5.        

   Log on to the computer, then download and install the following redistributable packages and .NET framework.

          
              
   • Microsoft Visual C++ 2005 Redistributable Package (x86)
              
   • Microsoft Visual C++ 2008 Redistributable Package (x86)
              
   • Microsoft Visual C++ 2010 Redistributable Package (x86)
              
   • Microsoft .NET Framework 4.6.1
          
      
   
6.        

   Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

      

Create a virtual disk file for Windows 2012 R2

If you are using Windows 2012 R2, use these steps to create the virtual disk file.

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, accept the license terms, then click Next.

      
   
3.        

   Select Custom Install Windows, Windows Server R2 2012 Datacenter, use the default disk space settings, then click Next.            
   Installation process is completed in various stages.

      
   
4.        

   Set password for administrator account.

      

Trellix Intelligent Sandbox 5.0.x Installation Guide

73

6 | Installation overview

   
5.        

   Log on to the computer, then download and install the following redistributable packages and .NET framework.

          
              

   • Microsoft Visual C++ 2005 Redistributable Package (x86)

              

   • Microsoft Visual C++ 2008 Redistributable Package (x86)

              

   • Microsoft Visual C++ 2010 Redistributable Package (x86)

              

   • Microsoft .NET Framework 4.6.1

          
      
   
6.        

   Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

      

Create a virtual disk file for Windows Server 2016/2019 Standard

If you are using Windows Server 2016/2019 Standard, use these steps to create the virtual disk file.

Task

   
1.        

   From the installation wizard, select the language, time and currency format, keyboard or input method, then click Next.

      
   
2.        

   Click Install Now, accept the license terms, then click Next.

      
   
3.        

   Select Custom Install Windows, Windows Server 2016 Standard (or Windows Server 2019 Standard), use the default disk space settings, then click Next.

          

   Installation process is completed in various stages.

      
   
4.        

   Set password for administrator account.

      
   
5.        

   Log on to the computer, then download and install the following redistributable packages and .NET framework.

          
              

   • Microsoft Visual C++ 2005 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft Visual C++ 2008 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft Visual C++ 2010 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft Visual C++ 2012 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft Visual C++ 2013 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft Visual C++ 2019 Redistributable Package (32-bit and 64-bit)

              

   • Microsoft .NET Framework 4.6.2

          
      
   
6.        

   Run the VM Provisioner tool as an administrator or prepare the image for analysis manually.

      

Install Microsoft Office on the virtual machine

To install Microsoft Office on the virtual machine, you must download the compatibility pack from Microsoft.

Task

   
1.        

   In the Microsoft Office Setup window, select the following options, then click Next.

          
              

   • Microsoft Word

              

   • Microsoft Excel

              

   • Microsoft PowerPoint

          
      

74

Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

   
2.        

   To open Microsoft Office files created in a newer version of Microsoft Office, install the compatibility pack.

          
              

   1. Download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint file formats.

              

   2. Install the compatibility pack on the virtual machine.

          
      
   
3.        

   In the Compatibility Pack for the 2007 Office system window, select Click here to accept the Microsoft Software License Terms, then click OK.

      

Enable PDF file analysis

To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.

Task

   

1. Install Adobe Reader on the virtual machine.

   

2. Open Adobe Reader, then click Accept on the License Agreement window.

Enable JAR file analysis

To analyze JAR files, download and install Java Runtime Environment (JRE).

By default, Intelligent Sandbox supports JRE version 7.

Task

   

1. Download and install the Java SE Development Kit for your computer.

   

2. On your computer, click Start → Java → Configure Java.

   

3. On the Java Control Panel, click the Security tab.

   

4. Change the Security Level to Medium, then click OK.

   

       

Note

   

   

       

If you are using Java 8 or above, change the security level to High.

   

Analyze OneNote file

OneNote (formerly OneNote 2016) with the extension .one is part of the Microsoft Office suite.

Before you begin

Supported versions: Office 2010, 2013, 2016, 2019.

   Trellix Intelligent Sandbox 5.0.x Installation Guide    75

6 | Installation overview

To analyze OneNote file:

Task

   
1.        

   Install Microsoft Office on the virtual machine.

          

   If you have installed Microsoft Office but OneNote is not included, you can download OneNote from the website (www.onenote.com) or use the Add or Remove feature in the Control Panel to install it.

      
   
2.        

   Open OneNote and sign-in (if required).

      
   
3.        

   Click Accept on the License Agreement window.

      

Enable Flash file analysis

To dynamically analyze Flash files, install Adobe Flash Player or the Flash plug-in.

Task

   
1.        

   Make sure that Internet Explorer is your default browser.

      
   
2.        

   Install Adobe Flash Player or the Flash plug-in on your computer.

          
              

   • Download and install Adobe Flash Player, then verify that it is the default flash extension.

              

   • Download and install Adobe Flash plug-in, then verify that Shockwave Flash Object is enabled.

          
      

Complete the VMDK and VHDX file creation process

Task

   

1. Restart the virtual machine.

   

2. To shut down virtualMachineImage, select Start → Shut down.

   
3.        

   Make sure there are not any stale lock files (.lck) associated with the virtual machine.

          

   The .lck files are located in the same folder as the .vmdk or .vhdx file.

      
   

4. Locate the virtualMachineImage-flat.vmdk or virtualMachineImage.vhdx file.

Prepare the virtual disk image for analysis

Prepare your VMDK or VHDX images to capture malware behaviors in the sandbox environment.

We recommend that you run the VM Provisioner Tool that's available in the Intelligent Sandbox interface. However, if the tool

76Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

doesn't work in your environment, you could also prepare your sandbox environment manually.

Run the VM Provisioner Tool

Download the VM Provisioner Tool from the Intelligent Sandbox interface, then run the tool to prepare your virtual disk images to capture malware behaviors in the sandbox environment.

Run the VM Provisioner Tool after installing all required software on all Windows VM images that you create. The VM Provisioner Tool supports operating systems configured for the supported languages: English, Spanish, Japanese, Chinese (Simplified), German, French, Italian.

Task

   
1.        

   Log on to the Intelligent Sandbox interface.

      
   
2.        

   Click Manage → Image & Software → Image.

      
   
3.        

   Click Download VM Provisioner Tool.

      
   
4.        

   Save the VM Provisioner Tool .exe file on your virtual machine.

      
   
5.        

   Make sure that the Visual Studio 2012 C++ Redistributable is installed on the VM.

          

   Download the x86 version of the Visual Studio 2012 C++ Redistributable for your corresponding operating system language from https://www.microsoft.com/EN-US/DOWNLOAD/DETAILS.ASPX?ID=30679.

      
   
6.        

   Open and run the VM Provisioner Tool .exe file as Administrator.

          
              
   1.                

      Run VM Provisioner Tool as a non-administrator user.

                 
              
   2.                

      Restart the virtual machine.

                     

      The Administrator account is enabled once the virtual machine is started.

                 
              
   3.                

      Log on to Windows as the Administrator user.

                 
              
   4.                

      Run VM Provisioner Tool again.

                 
          
      

   

       

Note

   

   

admin and Administrator user accounts are not the same.

Results

   
•        

  To view the log file that contains all executed commands and changed registries, go to C:\VM_Provi.log.

     
   
•        

  Before you shut down the virtual machine, copy the log file to another system (outside of the VM) for later reference, then remove the log file.

     

Prepare your VMDK or VHDX image for analysis manually

Prepare your environment manually to capture malware behaviors in the sandbox environment.

Trellix Intelligent Sandbox 5.0.x Installation Guide77

6 | Installation overview

Prepare a Windows XP image for analysis

Configure your Windows XP virtual system for analysis.

Task

   
1.        

   Configure the virtual machine in VMware ESXi or Microsoft Hyper-V:

          
              

   1. Right-click on the Windows XP image, then select Settings.

              

   2. In the Virtual Machine Settings window, select CD/DVD (IDE).

              

   3. In Use ISO image file, browse to the ISO file that you used and click OK.

              

   4. In the Welcome to Microsoft Windows XP page, click Exit.

          
      
   

2. Log on to the virtual machine as administrator.

   

3. Turn off the firewall in the virtual image: Select Start → Control Panel → Security Center → Windows Firewall → OFF.

   
4.        

   Start the telnet service in the virtual image:

          
              

   1. Click Start and right-click My Computer.

              

   2. Select Manage → Services and Applications → Services, then double-click Telnet.

              

   3. In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

          
      
   
5.        

   Enable FTP in the virtual image:

          
              

   1. Select Start → Control Panel → Add or remove Programs → Add or remove Windows components.

              

   2. In the Windows Components wizard, double-click Internet Information Services(IIS).

              

   3. In the Internet Information Services(IIS) pop-up window, select these entries:

                     
                         

      • File Transfer Protocol (FTP) Service

                         

      • Common Files

                         

      • Internet Information Services Snap-In

                     
                 
              

   4. Click OK, then click Next.

              

   5. In the Windows Components wizard, click Finish to finish installing FTP.

              

   6. In the Insert Disk message, click Cancel.

              

   7. In the Windows XP Setup message, select OK.

          
      
   
6.        

   Configure FTP settings in the virtual image:

          
              

   1. Select Start → Control Panel → Switch to Classic View → Administrative Tools, then double-click Internet Information Services.

              

   2. In the Internet Information Services page, expand the entry under Internet Information Services, then expand FTP Sites.

              

   3. Right-click on Default FTP Site, select Properties → Home Directory.

              

   4. Browse to the C:\ drive, select Read, Write, and Log visits.

              

   5. Click Apply, then OK.

          
      
   
7.        

   Set automatic logon:

          
              

   1. Select Start → Run, type rundll32 netplwiz.dll,UsersRunDLL, then press Enter.

              

   2. In the User Accounts window, deselect Users must enter a user name and password to use this computer and click Apply.

          
      

6 | Installation overview

c. In the Automatically log on page, provide these credentials.

   
• User name — Administrator
   
• Password — cr@cker42
   
• Confirm Password — cr@cker42

   
8. Run the MergeIDE batch file on the virtual machine:        
              
   1. Download MergeIDE.zip from the following URL on the native computer and then copy it to the virtual machine.
                     https://www.virtualbox.org/raw-attachment/wiki/Migrate_Windows/MergeIDE.zip            
              
   2. Extract MergeIDE.zip and run the MergeIDE batch file in the VM.
          
      

   
9. Disable Windows updates:        
              
   1. Select Start → Settings → Control Panel.
              
   2. Open System.
              
   3. In the Automatic Updates tab, deselect Keep my computer up to date.
              
   4. Click Apply and then OK.
          
      

   
10. Configure Microsoft Office:        
               
    1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.
               
    2. Lower the security to run macros for the Office applications. In Microsoft Word 2003 and select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.
               
    3. Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.
                      You need the compatibility pack to open Microsoft Office files that were created in a newer version of Microsoft Office. For example, to open a .docx file using Office 2003, you need the corresponding compatibility pack installed.            
               
    4. In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.
           
       

   
11. Configure Adobe Reader:        
               
    1. To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.
               
    2. Open Adobe Reader and click Accept.
               
    3. In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.
               
    4. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.
           
       

   
12. Configure Java:        
               
    1. Open Java in the Control Panel.
               
    2. In the Update tab, deselect Check for Updates Automatically.
               
    3. In the Java Update Warning message, select Do Not Check and then click OK.
           
       

   
13. Configure system startup:        
               
    1. Run the msconfig command.
               
    2. From the Startup tab, deselect reader_sl and jusched, then click OK.
           
       

   

       

" /> Note

   

   

reader_sl is available only when Adobe Reader is installed.

Trellix Intelligent Sandbox 5.0.x Installation Guide

79

14. Configure the default browser:

   
1. In Internet Explorer, select Tools → Internet Options.
   
2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.
   
3. From the Privacy tab, uncheck Turn on Pop-up Blocker.
   
4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

Prepare a Windows Server 2003 image for analysis

Configure your Windows Server 2003 virtual system for analysis.

Task

   
1. Log on to the virtual machine as administrator.
   
2. If the Windows Server Post-Setup Security Updates page appears, select Finish.
   
3. If the Manage Your Server window page appears, select Don't Display the page at logon and close the page.
   
4. Disable the shutdown event tracker:        
              
   1. Select Start → Run, type gpedit.msc, then click OK.
              
   2. In the Group policy object editor page, select Computer Configuration → Administrative Templates → System, then double-click Display Shutdown Event Tracker.
              
   3. Select Disabled, then click OK.
              
   4. Close the Group policy object editor page.
          
      
   
5. Install the hotfix for Windows Server 2003 Service Pack 1 (if applicable).

   
1. Go to http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=899260&kbln=en-us and install the hotfix corresponding to your version of Windows Server 2003.
   
2. Restart the virtual machine.
   
3. In the Windows command prompt, run the tlntsvr /service command.

   
6. Turn off the firewall in the virtual image: Select Start → Control Panel → Windows Firewall → OFF.
   
7. Start the telnet service in the virtual image:

6 | Installation overview

   
1. Click Start and right-click My Computer.
   
2. Select Manage → Services and Applications → Services, then double-click Telnet.
   
3. In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

   
8.        

   Run the MergeIDE batch file on the virtual machine:

          
              
   1. Download MergeIDE.zip from the following URL on the native computer and then copy it to the virtual machine.
                     https://www.virtualbox.org/raw-attachment/wiki/Migrate_Windows/MergeIDE.zip            
              
   2. Extract MergeIDE.zip and run the MergeIDE batch file in the VM.
          
      
   
9.        

   Enable FTP in the virtual image:

          
              
   1. Select Start → Control Panel → Add or remove Programs → Add or remove Windows components.
              
   2. In the Windows Components wizard, double-click Application Server, then double-click Internet Information Services(IIS).
              
   3. In the Internet Information Services(IIS) pop-up window, select these entries:                
                         
      • File Transfer Protocol (FTP) Service
                         
      • Common Files
                         
      • Internet Information Services Manager
                     
                 
              
   4. Click OK, then click Next.
              
   5. In the Windows Components wizard, click Finish when the FTP installation is complete.
              
   6. In the Insert Disk message, click Cancel.
              
   7. In the Windows XP Setup message, select OK.
          
      
   
10.        

    Configure FTP settings in the virtual image:

           
               
    1. Select Start → Control Panel → Switch to Classic View → Administrative Tools, then double-click Internet Information Services.
               
    2. In the Internet Information Services page, expand the entry under Internet Information Services, then expand FTP Sites.
               
    3. Right-click on Default FTP Site, select Properties → Home Directory.
               
    4. Browse to the C:\ drive, select Read, Write, and Log visits.
               
    5. Click Apply, then click OK.
           
       
   
11.        

    Set automatic logon:

           
               
    1. Select Start → Run, type rundll32 netplwiz.dll,UsersRunDll, then press Enter.
               
    2. In the User Accounts window, deselect Users must enter a user name and password to use this computer and click Apply.
               
    3. In the Automatically log on page, provide these credentials:                
                          
       • User name — Administrator
                          
       • Password — cr@cker42
                          
       • Confirm Password — cr@cker42
                      
                  
           
       
   
12.        

    Disable Windows updates:

           
               
    1. Select Start → Control Panel → System → Automatic Updates.
               
    2. Select Turn off Automatic Updates.
               
    3. Click Apply and then click OK.
           
       
   
13.        

    Configure Microsoft Office:

       

Trellix Intelligent Sandbox 5.0.x Installation Guide

81

6 | Installation overview

   
1.        

   To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.

      
   
2.        

   Lower the security to run macros for the Office applications. In Microsoft Word 2003 and select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.

      
   
3.        

   Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.

          

   You need the compatibility pack to open Microsoft Office files that were created in a newer version of Microsoft Office. For example, to open a .docx file using Office 2003, you need the corresponding compatibility pack installed.

      
   
4.        

   In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.

      

   
14.        

    Configure Adobe Reader:

           
               

    1. To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.

               

    2. Open Adobe Reader and click Accept.

               

    3. In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.

               

    4. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.

           
       
   
15.        

    Configure Java:

           
               

    1. Open Java in the Control Panel.

               

    2. In the Update tab, deselect Check for Updates Automatically.

               

    3. In the Java Update Warning message, select Do Not Check and then click OK.

           
       
   
16.        

    Configure system startup:

           
               

    1. Run the msconfig command.

               

    2. From the Startup tab, deselect reader_sl and jusched, then click OK.

           
           

               

                   

    Note

               

               

    reader_sl is available only when Adobe Reader is installed.

           

           
               

    3. In the System Configuration message, select Restart.

               

    4. In the System Configuration Utility message, select Don't show this message or launch the System Configuration Utility when Windows start, then click OK.

           
       
   
17.        

    Configure the default browser:

           
               

    1. In Internet Explorer, select Tools → Internet Options.

               

    2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

               

    3. From the Privacy tab, uncheck Turn on Pop‑up Blocker.

               

    4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

           
       

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

6 | Installation overview

Prepare a Windows 7 image for analysis

Configure your Windows 7 virtual system for analysis.

Task

   
1.        

   Log on to the virtual machine as administrator.

      
   
2.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Select Start → Control Panel → System and Security → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

                 
          
      
   
3.        

   Enable required Windows features.

          
              
   1.                

      Select Start → Control Panel → Programs → Programs and Features → Turn Windows feature on or off.

                 
              
   2.                

      Select Internet Information Services → FTP server → FTP Extensibility.

                 
              
   3.                

      Select Internet Information Services → Web Management Tools → IIS Management Service.

                 
              
   4.                

      Select Telnet Server, then click OK.

                     

      This operation might take around 5 minutes to complete.

                 
          
      
   
4.        

   Start the telnet service in the virtual image:

          
              
   1.                

      Click Start and right-click My Computer.

                 
              
   2.                

      Select Manage → Services and Applications → Services, then double-click Telnet.

                 
              
   3.                

      In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

                 
          
      
   
5.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Select Start → Control Panel → System and Security → Administrative Tools, then double-click Internet Information Services.

                 
              
   2.                

      In the Internet Information Services page, expand the entry under Internet Information Services (IIS) Manager, then expand the tree under host name.

                 
              
   3.                

      Select Sites, right-click on Default FTP Site, select Remove, then click Yes to confirm.

                 
              
   4.                

      Right-click Sites, select Add FTP Site, then do the following.

                     
                         

      • Provide the FTP site name as root and Physical path as C:\, then click Next.

                         

      • For Bindings and SSL Settings, select No SSL, then click Next.

                         

      • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.

                         

      • Click Finish.

                     
                 
              
   5.                

      Close the Internet Information Services (IIS) Manager page.

                 
          
      
   
6.        

   Set automatic logon:

          
              
   1.                

      Select Start → Run, type netplwiz, then press Enter.

                 
              
   2.                

      In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

                 
              
   3.                

      In the Automatically log on page, provide these credentials.

                     
                         

      • User name — Administrator

                     
                 
          
      

Trellix Intelligent Sandbox 5.0.x Installation Guide     83

6 | Installation overview

   
• Password — cr@cker42
   
• Confirm Password — cr@cker42

   
7.        

   Disable Windows updates:

          
              
   1. Select Start → Control Panel → Windows Update → Change settings.
              
   2. Under Important updates, select Never check for updates (not recommended).
              
   3. Deselect all options under Recommended updates, Who can install updates, Microsoft update, Software notifications.
              
   4. Click OK.
          
      
   
8.        

   Configure Microsoft Office:

          
              
   1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.
              
   2. Lower the security to run macros for the Office applications. In Microsoft Word 2003 and select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.
              
   3. Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.                

      You need the compatibility pack to open Microsoft Office files that were created in a newer version of Microsoft Office. For example, to open a .docx file using Office 2003, you need the corresponding compatibility pack installed.

                 
              
   4. In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.
          
      
   
9.        

   Configure JustSystems Ichitaro word processing software:

          
              
   1. To analyze JTD and JTDC files, install Ichitaro word processing software.                

      Recommended versions Govt8 or Pro3.

                 
              
   2. Disable automatic updates.
              
   3. If you want analyze Microsoft Office files using Ichitaro, manually change the file association.
          
      
   
10.        

    Configure Adobe Reader:

           
               
    1. To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.
               
    2. Open Adobe Reader and click Accept.
               
    3. In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.
               
    4. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.
           
       
   
11.        

    Configure Java:

           
               
    1. Open Java in the Control Panel.
               
    2. In the Update tab, deselect Check for Updates Automatically.
               
    3. In the Java Update Warning message, select Do Not Check and then click OK.
           
       
   
12.        

    Configure system startup:

           
               
    1. Run the msconfig command.
               
    2. From the Startup tab, deselect reader_sl and jusched, then click OK.
           
       

   

       

Note

   

   

reader_sl is available only when Adobe Reader is installed.

6 | Installation overview

   
1.        

   In the System Configuration message, select Restart.

      
   
2.        

   In the System Configuration Utility message, select Don't show this message or launch the System Configuration Utility when Windows start, then click OK.

      

   
13.        

    Configure the default browser:

           
               
    1.                

       In Internet Explorer, select Tools → Internet Options.

                  
               
    2.                

       In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

                  
               
    3.                

       From the Privacy tab, uncheck Turn on Pop-up Blocker.

                  
               
    4.                

       Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

                  
           
       
   
14.        

    Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

           
               

    • Net stop WinHttpAutoProxySvc

               

    • Sc config WinHttpAutoProxySvc start= disabled

           
       

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Prepare a Windows Server 2008 image

Configure your Windows Server 2008 virtual system for analysis.

Task

   

1. Log on to the virtual machine as administrator.

   

2. If the Manage Your Server window page appears, select Don't Display the page at logon and close the page.

   
3.        

   Disable the shutdown event tracker:

          
              

   1. Select Start → Run, type gpedit.msc, then click OK.

              

   2. In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System, then double-click Display Shutdown Event Tracker.

              

   3. Select Disabled, then click OK.

              

   4. Close the Local Group Policy Editor page.

          
      
   
4.        

   Turn off the firewall in the virtual image:

          
              

   1. Select Start → Control Panel → Windows Firewall → Turn on Windows Firewall On or Off.

              

   2. Select Off, then click OK.

          
      
   
5.        

   Install telnet in the virtual image:

          
              

   1. Select Start → Administrative Tools → Server Manager.

              

   2. In the Server Manager window, right-click Features and select Add Features.

              

   3. In the Add Features Wizard, select Telnet Server.

              

   4. Click Next, then Install.

              

   5. Click Close after the installation succeeds.

          
      

6 | Installation overview

   
6.        

   Start the telnet service in the virtual image:

          
              
   1.                

      Select Start → Administrative Tools → Services, then double-click Telnet.

                 
              
   2.                

      In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

                 
          
      
   
7.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Select Start → Administrative Tools → Internet Information Services(IIS) Manager.

                 
              
   2.                

      In the Internet Information Services Manager page, select Sites, select Add FTP Site

                 
              
   3.                

      In the Add FTP Site wizard, do the following.

                     
                         
      •                        

        Provide the FTP site name as root and Physical path as C:\, then click Next.

                           
                         
      •                        

        For Bindings and SSL Settings, select No SSL, then click Next.

                           
                         
      •                        

        For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.

                           
                         
      •                        

        Click Finish.

                           
                     
                 
          
      
   
8.        

   Set automatic logon:

          
              
   1.                

      Select Start → Run, type netplwiz, then press Enter.

                 
              
   2.                

      In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

                 
              
   3.                

      In the Automatically log on page, provide these credentials.

                     
                         
      •                        

        User name — Administrator

                           
                         
      •                        

        Password — cr@cker42

                           
                         
      •                        

        Confirm Password — cr@cker42

                           
                     
                 
          
      
   
9.        

   Disable Windows updates:

          
              
   1.                

      Select Start → Control Panel → Windows Update → Change settings.

                 
              
   2.                

      Under Important updates, select Never check for updates (not recommended).

                 
              
   3.                

      Deselect Recommended updates when downloading, installing, or notifying me about updates.

                 
              
   4.                

      Click OK.

                 
          
      
   
10.        

    Configure Microsoft Office:

           
               
    1.                

       To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.

                  
               
    2.                

       Lower the security to run macros for the Office applications. In Microsoft Word 2003 and select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    3.                

       Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.

                      

       You need the compatibility pack to open Microsoft Office files that were created in a newer version of Microsoft Office. For example, to open a .docx file using Office 2003, you need the corresponding compatibility pack installed.

                  
               
    4.                

       In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.

                  
           
       
   
11.        

    Configure Adobe Reader:

           
               
    1.                

       To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.

                  
               
    2.                

       Open Adobe Reader and click Accept.

                  
               
    3.                

       In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.

                  
           
       

6 | Installation overview

d. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.

   
12.        

    Configure Java:

           
               

    1. Open Java in the Control Panel.

               

    2. In the Update tab, deselect Check for Updates Automatically.

               

    3. In the Java Update Warning message, select Do Not Check and then click OK.

           
       

   
13.        

    Configure system startup:

           
               

    1. Run the msconfig command.

               

    2. From the Startup tab, deselect reader_sl and jusched, then click OK.

           
           

               

                   

    Note

               

               

    reader_sl is available only when Adobe Reader is installed.

           

           
               

    3. In the System Configuration message, select Restart.

               

    4. In the System Configuration Utility message, select Don't show this message or launch the System Configuration Utility when Windows start, then click OK.

           
       

   
14.        

    Configure the default browser:

           
               

    1. In Internet Explorer, select Tools → Internet Options.

               

    2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

               

    3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

               

    4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

           
       

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Prepare a Windows 8 image for analysis

Configure your Windows 8 virtual system for analysis.

Task

   
1.        

   From the native system, set up Windows 8 to display in the Desktop mode instead of the default Metro UI mode when it starts.

          
              

   1. Press the Windows and R keys simultaneously, which is the shortcut to open the Run dialog box.

              

   2. In the Run dialog box, type regedit, then press Enter.

              

   3. In Registry Editor, select HKEY_LOCAL_MACHINE → SOFTWARE → Microsoft → Windows NT → CurrentVersion → Winlogon, then double-click on Shell.

              

   4. Change Value data to explorer.exe, explorer.exe (instead of the default value of explorer.exe), then click OK.

          
      
   

2. Log on to the virtual machine as administrator.

Trellix Intelligent Sandbox 5.0.x Installation Guide87

6 | Installation overview

   
3.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

                 
          
      
   
4.        

   Disable Windows Defender:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Windows Defender → Settings → Administrators, deselect Turn on Windows Defender, then click Save changes.

                 
              
   3.                

      Close the Windows Defender message box.

                 
          
      
   
5.        

   Disable first log on animation:

          
              
   1.                

      Press the Windows and X keys simultaneously.

                 
              
   2.                

      In the Run dialog box, type gpedit.msc, then press Enter.

                 
              
   3.                

      In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

                 
              
   4.                

      Double-click Show first sign-in animation, select Disabled, then click OK.

                 
          
      
   
6.        

   Enable required Windows features.

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Programs → Programs and Features → Turn Windows feature on or off.

                 
              
   3.                

      Select Internet Information Services → FTP server → FTP Extensibility.

                 
              
   4.                

      Select Internet Information Services → Web Management Tools → IIS Management Service.

                 
              
   5.                

      Select Telnet Server.

                 
              
   6.                

      Select .NET Framework 3.5 (includes .NET 2.0 and 3.0) and then select Windows Communication Foundation HTTP Activation and Windows Communication Foundation Non-HTTP Activation options, then press OK.

                 
              
   7.                

      If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

                 
          
          

   This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

      
   
7.        

   Edit the power options:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Power Options → Choose when to turn off the display, select Never for both Turn off the display and Put the computer to sleep options, then click Save changes.

                 
              
   3.                

      Select Power Options → Choose what the power buttons do, select Change Settings that are currently unavailable for both Turn off the display and Put the computer to sleep options, then click Save changes.

                 
              
   4.                

      For shutdown settings, deselect Turn on fast startup and Hibernate options, then click Save changes.

                 
          
      
   
8.        

   Start the telnet service in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Computer Management → Services and Applications → Services, then double-click Telnet.

                 
              
   2.                

      In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

                 
          
      
   
9.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Administrative Tools, then double-click Internet Information Services.

                 
          
      

88

Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

   
3.        

   In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.

      
   
4.        

   If you see the Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components? message, select Do not show this message, then click Cancel.

      
   
5.        

   Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.

      
   
6.        

   Right-click Sites, select Add FTP Site, then do the following.

          
              
   •                

     Provide the FTP site name as root and Physical path as C:\, then click Next.

                
              
   •                

     For Bindings and SSL Settings, select No SSL, then click Next.

                
              
   •                

     For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.

                
              
   •                

     Click Finish.

                
          
      
   
7.        

   Close the Internet Information Services (IIS) Manager page.

      

   
10.        

    Turn off automatic updating for Windows:

           
               
    1.                

       Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                  
               
    2.                

       Select Windows Update → Change.

                  
               
    3.                

       Select Never check for updates (not recommended), then click OK.

                  
           
       
   
11.        

    Configure Telnet clients

           
               
    1.                

       Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                  
               
    2.                

       Select Administrator Tools → Computer Management.

                  
               
    3.                

       Select Computer Management (Local) → System Tools → Local Users and Groups → Groups.

                  
               
    4.                

       Double-click TelnetClients.

                  
               
    5.                

       Click Add, type Administrator, click Check Names, then click OK.

                  
           
       
   
12.        

    Set automatic logon:

           
               
    1.                

       Press the Windows and R keys simultaneously, type netplwiz, then press Enter.

                  
               
    2.                

       In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

                  
               
    3.                

       In the Automatically log on page, provide these credentials.

                      
                          
       •                        

         User name — Administrator

                            
                          
       •                        

         Password — cr@cker42

                            
                          
       •                        

         Confirm Password — cr@cker42

                            
                      
                  
           
       
   
13.        

    Configure Microsoft Office:

           
               
    1.                

       To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.

                  
               
    2.                

       Lower the security to run macros for the Office applications. In Microsoft Word 2003 select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    3.                

       Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.

                  
               
    4.                

       In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.

                  
           
       

Trellix Intelligent Sandbox 5.0.x Installation Guide      89

6 | Installation overview

   
14.        

    Configure Adobe Reader:

           
               

    1. To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.

               

    2. Open Adobe Reader and click Accept.

               

    3. In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.

               

    4. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.

           
       
   
15.        

    Configure Java:

           
               

    1. Open Java in the Control Panel.

               

    2. In the Update tab, deselect Check for Updates Automatically.

               

    3. In the Java Update Warning message, select Do Not Check and then click OK.

           
       
   
16.        

    Configure system startup:

           
               

    1. Run the msconfig command.

               

    2. From the Startup tab, then click Open Task Manager.

               

    3. Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

               

    4. Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

               

    5. In the System Configuration message, select Restart.

               

    6. In the System Configuration Utility message, select Don't show this message or launch the System Configuration Utility when Windows start, then click OK.

           
       
   
17.        

    Configure the default browser:

           
               

    1. In Internet Explorer, select Tools → Internet Options.

               

    2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

               

    3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

               

    4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

           
       
   
18.        

    Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

           
               

    • Net stop WinHttpAutoProxySvc

               

    • Sc config WinHttpAutoProxySvc start= disabled

           
       

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Prepare a Windows 8.1 image for analysis

Configure your Windows 8.1 virtual system for analysis.

Task

   
1.        

   From the native system, set up Windows 8.1 to display in the Desktop mode instead of the default Metro UI mode when it starts.

          
              

   1. Press the Windows and R keys simultaneously, which is the shortcut to open the Run dialog box.

              

   2. In the Run dialog box, type regedit, then press Enter.

          
      

90Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

c. In Registry Editor, select HKEY_LOCAL_MACHINE → SOFTWARE → Microsoft → Windows NT → CurrentVersion → Winlogon, then double-click on Shell.

d. Change Value data to explorer.exe, explorer.exe (instead of the default value of explorer.exe), then click OK.

   
2.        

   Log on to the virtual machine as administrator.

      
   
3.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

                 
          
      
   
4.        

   Disable Windows Defender:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Windows Defender → Settings → Administrators, deselect Turn on this app, then click Save changes.

                 
              
   3.                

      If a Windows Defender message appears, close the message screen.

                 
          
      
   
5.        

   Disable first log on animation:

          
              
   1.                

      Press the Windows and R keys simultaneously, type gpedit.msc, then press Enter.

                 
              
   2.                

      In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

                 
              
   3.                

      Double-click Show first sign-in animation, select Disabled, then click OK.

                 
          
      
   
6.        

   Enable required Windows features.

          
              
   1.                

      Press the Windows and X keys simultaneously, then select Control Panel → Programs → Programs and Features → Turn Windows feature on or off.

                 
              
   2.                

      Select Internet Information Services → FTP server → FTP Extensibility.

                 
              
   3.                

      Select Internet Information Services → Web Management Tools → IIS Management Service.

                 
              
   4.                

      Select Telnet Server.

                 
              
   5.                

      Select .NET Framework 3.5(includes .NET 2.0 and 3.0) and then select Windows Communication Foundation HTTP Activation and Windows Communication Foundation Non-HTTP Activation options, then press OK.

                 
              
   6.                

      If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

                     

      This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

                 
          
      
   
7.        

   Download and install the .NET Framework 4.6 on the VM image.

          

   If a Blocking Issues message appears, install the suggested components, then select Continue.

      
   
8.        

   Edit the power options:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Power Options → Choose when to turn off the display, select Never for both Turn off the display, and Put the computer to sleep options, then click Save changes.

                 
              
   3.                

      For shutdown settings, deselect Turn on fast startup and Hibernate options, then click Save changes.

                 
          
      
   
9.        

   Start the telnet service in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Computer Management → Services and Applications → Services, then double-click Telnet.

                 
              
   2.                

      In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

                 
          
      
   
10.        

    Configure FTP settings in the virtual image:

       

Trellix Intelligent Sandbox 5.0.x Installation Guide    91

6 | Installation overview

   
1. Press the Windows and X keys simultaneously, select Control Panel → System and Security → Administrative Tools, then double-click Internet Information Services.
   
2. In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.
   
3. If you see the "Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components?" message, select Do not show this message, then click Cancel.
   
4. Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.
   
5. Right-click Sites, select Add FTP Site, then do the following.        
              
   • Provide the FTP site name as root and Physical path as C:\, then click Next.
              
   • For Bindings and SSL Settings, select No SSL, then click Next.
              
   • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.
              
   • Click Finish.
          
      
   
6. Close the Internet Information Services (IIS) Manager page.

   
11. Turn off automatic updating for Windows:        
               
    1. Press the Windows and X keys simultaneously, then select Control Panel → Windows Update → Change.
               
    2. Select Never check for updates (not recommended), then click OK.
           
       
   
12. Configure Telnet clients.        
               
    1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.
               
    2. Select Administrative tools → Computer Management.
               
    3. Select Computer Management (Local) → System Tools → Local Users and Groups → Groups.
               
    4. Double-click TelnetClients.
               
    5. Click Add, type Administrator, click Check Names, then click OK.
           
       
   
13. Set automatic logon:        
               
    1. Press the Windows and R keys simultaneously, type netplwiz, then press Enter.
               
    2. In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.
               
    3. In the Automatically log on page, provide these credentials.                
                          
       • User name — Administrator
                          
       • Password — cr@cker42
                          
       • Confirm Password — cr@cker42
                      
                  
           
       
   
14. Configure Microsoft Office:        
               
    1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2007 on the virtual machine.
               
    2. Lower the security to run macros for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.
               
    3. On the Welcome to Microsoft Office 2007 page, click Next button.
               
    4. On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.
           
       
   
15. Configure Adobe Reader:        
               
    1. To analyze PDF files, download Adobe Reader to the native host and install it to the VM.
               
    2. In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode ...
           
       

6 | Installation overview

   
16.        

    Configure Java:

           
               

    1. Open Java in the Control Panel.

               

    2. In the Update tab, deselect Check for Updates Automatically.

               

    3. In the Java Update Warning message, select Do Not Check and then click OK.

           
       
   
17.        

    Configure system startup:

           
               

    1. Run the msconfig command.

               

    2. From the Startup tab, then click Open Task Manager.

               

    3. Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

               

    4. Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

               

    5. In the System Configuration dialog, select Don't show this message again, then select Restart.

           
       
   
18.        

    Configure the default browser:

           
               

    1. In Internet Explorer, select Tools → Internet Options.

               

    2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

               

    3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

               

    4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

           
       
   
19.        

    Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

           
               

    • Net stop WinHttpAutoProxySvc

               

    • Sc config WinHttpAutoProxySvc start= disabled

           
       

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

Prepare a Windows 10 image for analysis

Configure your Windows 10 virtual system for analysis.

Task

   
1.        

   Log on to the virtual machine, then run the VM Provisioner Tool.

      

   

   

VM Provisioner Tool enables the Administrator account, which is disabled by default on Windows 10.

Trellix Intelligent Sandbox 5.0.x Installation Guide

93

6 | Installation overview

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

   
2.        

   Restart the virtual machine.

      
   
3.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

                 
          
      
   
4.        

   Disable Windows Defender:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Windows Defender, then turn off all features on the Windows Defender Settings page.

                 
              
   3.                

      If a Windows Defender message appears, close the message screen.

                 
          
      
   
5.        

   Disable first log on animation:

          
              
   1.                

      Press the Windows and R keys simultaneously.

                 
              
   2.                

      In the Run dialog box, type gpedit.msc, then press Enter.

                 
              
   3.                

      In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

                 
              
   4.                

      Double-click Show first sign-in animation, select Disabled, then click OK.

                 
          
      
   
6.        

   Enable required Windows features.

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Programs → Programs and Features → Turn Windows feature on or off.

                 
              
   3.                

      Select Internet Information Services → FTP server → FTP Extensibility.

                 
              
   4.                

      Select Internet Information Services → Web Management Tools → IIS Management Service.

                 
              
   5.                

      Select .NET Framework 4.6 Advanced Services, and ensure that ASP.NET 4.6 is enabled.

                 
              
   6.                

      Select WCF Service Library, ensure that TCP Port Sharing is enabled, then select OK.

                 
              
   7.                

      If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

                     

      This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

                 
          
      
   
7.        

   Edit the power options:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Power Options → Choose when to turn off the display, select Never for Turn off the display, then click Save changes.

                 
          
      
   
8.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Administrative Tools, then double-click Internet Information Services.

                 
              
   3.                

      In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.

                 
              
   4.                

      If you see the Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components? message, select Do not show this message, then click Cancel.

                 
              
   5.                

      Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.

                 
          
      

6 | Installation overview

   
1.        

   Right-click Sites, select Add FTP Site, then do the following.

          
              
   •                

     Provide the FTP site name as root and Physical path as C:\, then click Next.

                
              
   •                

     For Bindings and SSL Settings, select No SSL, then click Next.

                
              
   •                

     For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read, and Write under Permissions.

                
              
   •                

     Click Finish.

                
          
      
   
2.        

   Close the Internet Information Services (IIS) Manager page.

      

   
9.        

   Turn off automatic updating for Windows:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Administrative Tools → Services, then double-click Windows Update.

                 
              
   3.                

      Select Startup type as Disabled.

                 
              
   4.                

      Stop the service if the service is running.

                 
              
   5.                

      Press the Windows and R keys simultaneously, type gpedit.msc, then click OK.

                 
              
   6.                

      In Local Group Policy Editor, select Computer Configuration → Administrative Templates → Windows Components → Windows Update.

                 
              
   7.                

      On the right-pane, double-click Configure Automatic Updates.

                 
              
   8.                

      Select Disabled, then click OK.

                 
          
      
   
10.        

    Set automatic logon:

           
               
    1.                

       Press the Windows and R keys simultaneously, type netplwiz, then press Enter.

                  
               
    2.                

       In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

                  
               
    3.                

       In the Automatically log on page, provide these credentials.

                      
                          

       • User name — admin

                          

       • Password — cr@cker42

                          

       • Confirm Password — cr@cker42

                      
                  
           
       
   
11.        

    Configure Microsoft Office:

           
               
    1.                

       To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2007 on the virtual machine.

                  
               
    2.                

       From any Microsoft Office software, select File → Options → Advanced, then under the Display section, enable the following options:

                      
                          

       • Disable hardware graphics acceleration

                          

       • Disable Slide Show hardware graphics acceleration

                      
                  
               
    3.                

       Lower the security to run macros for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    4.                

       Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    5.                

       Select Word options → Trust Center → Trusted Locations, then use the Add new...

                  
           
       

6 | Installation overview

   
11.        

    location... button to add C:\ under User Locations. Once added, double-click on the entry for C:\, then in the pop-up, select Subfolders of this location are also trusted, then click OK.

           
               
    1.                

       On the Welcome to Microsoft Office 2007 page, click Next button.

                  
               
    2.                

       On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

                  
               
    3.                

       When you open any of the Microsoft Office 2007 software, you would see the Help Protect and Improve Microsoft Office pop-up. From the pop-up select Don't make changes, then click OK.

                  
           
       

   
12.        

    Configure Adobe Reader:

           
               
    1.                

       To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

                  
               
    2.                

       In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

                  
               
    3.                

       If Accessibility Setup Assistance message appears, select Cancel.

                  
               
    4.                

       Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

                  
           
       

   
13.        

    Configure Java:

           
               
    1.                

       Open Java in the Control Panel.

                  
               
    2.                

       In the Update tab, deselect Check for Updates Automatically.

                  
               
    3.                

       In the Java Update Warning message, select Do Not Check and then click OK.

                  
           
       

   
14.        

    Configure system startup:

           
               
    1.                

       Run the msconfig command.

                  
               
    2.                

       From the Startup tab, then click Open Task Manager.

                  
               
    3.                

       Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

                  
               
    4.                

       Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

                  
               
    5.                

       In the System Configuration dialog, select Don't show this message again, then select Restart.

                  
           
       

   
15.        

    Configure the default browser:

           
               
    1.                

       In Internet Explorer, select Tools → Internet Options.

                  
               
    2.                

       In Home page, select Use Blank or Use new tab based on the version of Internet Explorer.

                  
               
    3.                

       From the Privacy tab, deselect Turn on Pop-up Blocker.

                  
               
    4.                

       Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

                  
           
       

   
16.        

    Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

           
               
    • Net stop WinHttpAutoProxySvc
               
    • Sc config WinHttpAutoProxySvc start= disabled
           
       

   
17.        

    Enable .NET framework: Open command prompt with administrator privilege, then run one of these commands.

           
               
    •                

      Using DISM with Internet connectivity

                     

      DISM /Online /Enable-Feature /FeatureName:NetFx3 /All

                 
               
    •                

      Using DISM with no Internet connectivity

                     

      DISM /Image:<driveletter>:\test\offline /Enable-Feature /FeatureName:NetFx3 /All /Source:<driveletter>:\sources\sxs

                 
           
           

    Replace <driveletter>:\sources\sxs with the path of the installation media.

           

    Replace <driveletter>:\test\offline with the path where the image is mounted.

       

96

Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

18. Disable the Windows Defender Application Guard.

   

   

       

Note

   

   

This step is applicable only on Windows 10 Creators Update (Build v1703) and above.

   
1.        

   Go to Run, then type gpedit.msc, and then click OK. This opens the Local Group Policy Editor.

      
   
2.        

   Navigate to Computer Configuration → Administrative Templates → Windows Components → Windows Defender Application Guard.

      
   
3.        

   In the right-pane, edit Turn on Windows Defender Application Guard in Enterprise Mode.

      
   
4.        

   Select Disabled, then click OK.

      

Prepare Windows 11 image for analysis

Configure your Windows 11 virtual system for analysis.

Task

   
1.        

   Log on to the virtual machine, then run the VM Provisioner Tool.

          

              

   

              

                  

   Note

              

              

   VM Provisioner Tool enables the Administrator account, which is disabled by default on Windows 11.

          

          

              

   

              

                  

   Note

              

              

   The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

          

      
   
2.        

   Restart the virtual machine.

      
   
3.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

                 
          
      
   
4.        

   Disable Windows Defender:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Windows Defender, then turn off all features on the Windows Defender Settings page.

                 
              
   3.                

      If a Windows Defender message appears, close the message screen.

                 
          
      
   
5.        

   Disable first log on animation:

          
              
   1.                

      Press the Windows and R keys simultaneously.

                 
          
      

6 | Installation overview

   
2.        

   In the Run dialog box, type gpedit.msc, then press Enter.

      
   
3.        

   In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

      
   
4.        

   Double-click Show first sign-in animation, select Disabled, then click OK.

      

   
6.        

   Enable required Windows features.

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Programs → Programs and Features → Turn Windows feature on or off.

                 
              
   3.                

      Select Internet Information Services → FTP server → FTP Extensibility.

                 
              
   4.                

      Select Internet Information Services → Web Management Tools → IIS Management Service.

                 
              
   5.                

      Select .NET Framework 4.6 Advanced Services, and ensure that ASP.NET 4.6 is enabled.

                 
              
   6.                

      Select WCF Service Library, ensure that TCP Port Sharing is enabled, then select OK.

                 
              
   7.                

      If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

                     

      This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

                 
          
      
   
7.        

   Edit the power options:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Power Options → Choose when to turn off the display, select Never for Turn off the display, then click Save changes.

                 
          
      
   
8.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Administrative Tools, then double-click Internet Information Services.

                 
              
   3.                

      In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.

                 
              
   4.                

      If you see the Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components? message, select Do not show this message, then click Cancel.

                 
              
   5.                

      Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.

                 
              
   6.                

      Right-click Sites, select Add FTP Site, then do the following.

                     
                         
      •                        

        Provide the FTP site name as root and Physical path as C:\, then click Next.

                           
                         
      •                        

        For Bindings and SSL Settings, select No SSL, then click Next.

                           
                         
      •                        

        For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read, and Write under Permissions.

                           
                         
      •                        

        Click Finish.

                           
                     
                 
              
   7.                

      Close the Internet Information Services (IIS) Manager page.

                 
          
      
   
9.        

   Turn off automatic updating for Windows:

          
              
   1.                

      Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

                 
              
   2.                

      Select Administrative Tools → Services, then double-click Windows Update.

                 
              
   3.                

      Select Startup type as Disabled.

                 
              
   4.                

      Stop the service if the service is running.

                 
              
   5.                

      Press the Windows and R keys simultaneously, type gpedit.msc, then click OK.

                 
              
   6.                

      In Local Group Policy Editor, select Computer Configuration → Administrative Templates → Windows Components → Windows Update.

                 
          
      

6 | Installation overview

   
10.        

    Set automatic logon:

           
               
    1.                

       Press the Windows and R keys simultaneously, type netplwiz, then press Enter.

                  
               
    2.                

       In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

                  
               
    3.                

       In the Automatically log on page, provide these credentials.

                      
                          
       •                        

         User name — admin

                            
                          
       •                        

         Password — cr@cker42

                            
                          
       •                        

         Confirm Password — cr@cker42

                            
                      
                  
           
       
   
11.        

    Configure Microsoft Office:

           
               
    1.                

       To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2007 on the virtual machine.

                  
               
    2.                

       From any Microsoft Office software, select File → Options → Advanced, then under the Display section, enable the following options:

                      
                          

       • Disable hardware graphics acceleration

                          

       • Disable Slide Show hardware graphics acceleration

                      
                  
               
    3.                

       Lower the security to run macros for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    4.                

       Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    5.                

       Select Word options → Trust Center → Trusted Center Settings → Trusted Locations, then use the Add new location... button to add C:\ under User Locations. Once added, double-click on the entry for C:\, then in the pop-up, select Subfolders of this location are also trusted, then click OK.

                  
               

    6. On the Welcome to Microsoft Office 2007 page, click Next button.

               

    7. On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

               

    8. When you open any of the Microsoft Office 2007 software, you would see the Help Protect and Improve Microsoft Office pop-up. From the pop-up select Don't make changes, then click OK.

           
       
   
12.        

    Configure Adobe Reader:

           
               

    1. To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

               

    2. In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

               

    3. If Accessibility Setup Assistance message appears, select Cancel.

               

    4. Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

           
       
   
13.        

    Configure Java:

           
               

    1. Open Java in the Control Panel.

               

    2. In the Update tab, deselect Check for Updates Automatically.

           
       

6 | Installation overview

c. In the Java Update Warning message, select Do Not Check and then click OK.

   
14.        

    Configure system startup:

           
               
    1.                

       Run the msconfig command.

                  
               
    2.                

       From the Startup tab, then click Open Task Manager.

                  
               
    3.                

       Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

                  
               
    4.                

       Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

                  
               
    5.                

       In the System Configuration dialog, select Don't show this message again, then select Restart.

                  
           
       
   
15.        

    Configure the default browser:

           
               
    1.                

       In Internet Explorer, select Tools → Internet Options.

                  
               
    2.                

       In Home page, select Use Blank or Use new tab based on the version of Internet Explorer.

                  
               
    3.                

       From the Privacy tab, deselect Turn on Pop-up Blocker.

                  
               
    4.                

       Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

                  
           
       
   
16.        

    Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

           
               
    •                

      Net stop WinHttpAutoProxySvc

                 
               
    •                

      Sc config WinHttpAutoProxySvc start= disabled

                 
           
       
   
17.        

    Enable .NET framework: Open command prompt with administrator privilege, then run one of these commands.

           
               
    •                

      Using DISM with Internet connectivity

                     

      DISM /Online /Enable-Feature /FeatureName:NetFx3 /All

                 
               
    •                

      Using DISM with no Internet connectivity

                     

      DISM /Image:<driveletter>:\test\offline /Enable-Feature /FeatureName:NetFx3 /All /Source:<driveletter>:\sources\sxs

                 
           
           

    Replace <driveletter>:\sources\sxs with the path of the installation media.

           

    Replace <driveletter>:\test\offline with the path where the image is mounted.

       

Prepare a Windows 2012 R2 image for analysis

Configure your Windows Server 2012 R2 virtual system for analysis.

Task

   
1.        

   Log on to the virtual machine as administrator.

      

   

       

Note

   

   

The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

2. If the Manage Your Server window page appears, select Don't Display the page at logon and close the page.

6 | Installation overview

   
3.        

   If the Server Manager windows is displayed, select Manage → Server Manager Properties, select Do not start Server Manager automatically at logon, then select OK.

      
   
4.        

   Disable the shutdown event tracker:

          
              
   1.                

      Select Start → Run, type gpedit.msc, then click OK.

                 
              
   2.                

      In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System, then double-click Display Shutdown Event Tracker.

                 
              
   3.                

      Select Disabled, then click OK.

                 
              
   4.                

      Close the Local Group Policy Editor page.

                 
          
      
   
5.        

   Turn off the firewall in the virtual image:

          
              
   1.                

      Select Start → Control Panel → Windows Firewall → Turn on Windows Firewall On or Off.

                 
              
   2.                

      Select Off, then click OK.

                 
          
      
   
6.        

   Install telnet in the virtual image:

          
              
   1.                

      Select Start → Administrative Tools → Server Manager.

                 
              
   2.                

      In the Server Manager window, select Add Roles and Features.

                 
              
   3.                

      In Add Roles and Features Wizard, select Telnet Server.

                 
              
   4.                

      Click Next, then Install.

                 
              
   5.                

      Click Close after the installation succeeds.

                 
          
      
   
7.        

   Start the telnet service in the virtual image:

          
              
   1.                

      Select Start → Administrative Tools → Services, then double-click Telnet.

                 
              
   2.                

      In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

                 
          
      
   
8.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Install IIS Manager if not already present and make sure you check the FTP Server checkbox when installing IIS Manager.

                     
                         
      1. From Server Manager page, select Add Roles and Features, then click Next.
                         
      2. In the Installation type page, select Role-based or feature-based installation, then click Next.
                         
      3. In the Server selection page, select Select a server from the server pool, then click Next.
                         
      4. In the Server Roles page, expand the Web Server (IIS) node, expand the FTP Server node, select FTP Server, select FTP Service, then click Next.
                         
      5. In the Select features page, click Next, then click Install.
                     
                 
              
   2.                

      Select Start → Administrative Tools → Internet Information Services(IIS) Manager.

                 
              
   3.                

      In the Internet Information Services Manager page, select Sites, select Add FTP Site

                 
              
   4.                

      In the Add FTP Site wizard, do the following.

                     
                         
      • Provide the FTP site name as root and Physical path as C:\, then click Next.
                         
      • For Bindings and SSL Settings, select No SSL, then click Next.
                         
      • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.
                         
      • Click Finish.
                     
                 
          
      
   
9.        

   Download and install the .NET Framework 4.6 on the VM image.

          

   If a Blocking Issues message appears, install the suggested components, then select Continue.

      
   
10.        

    Set automatic logon:

           
               
    1.                

       Select Start → Run, type netplwiz, then press Enter.

                  
           
       

Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

   
11.        

    Disable Windows updates:

           
               
    1.                

       Select Start → Control Panel → Windows Update → Change settings.

                  
               
    2.                

       Under Important updates, select Never check for updates (not recommended).

                  
               
    3.                

       Deselect Recommended updates when downloading, installing, or notifying me about updates.

                  
               
    4.                

       Click OK.

                  
           
       
   
12.        

    Configure Microsoft Office:

           
               
    1.                

       To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2007 on the virtual machine.

                  
               
    2.                

       Lower the security to run macros for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    3.                

       Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

                  
               
    4.                

       On the Welcome to Microsoft Office 2007 page, click Next button.

                  
               
    5.                

       On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

                  
           
       
   
13.        

    Configure Adobe Reader:

           
               
    1.                

       To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

                  
               
    2.                

       In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

                  
               
    3.                

       If Accessibility Setup Assistance message appears, select Cancel.

                  
               
    4.                

       Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

                  
           
       
   
14.        

    Configure Java:

           
               
    1.                

       Open Java in the Control Panel.

                  
               
    2.                

       In the Update tab, deselect Check for Updates Automatically.

                  
               
    3.                

       In the Java Update Warning message, select Do Not Check and then click OK.

                  
           
       
   
15.        

    Configure system startup:

           
               
    1.                

       Run the msconfig command.

                  
               
    2.                

       From the Startup tab, deselect reader_sl and jusched, then click OK.

                  
           
       

   

       

Note

   

   

reader_sl is available only when Adobe Reader is installed.

c. In the System Configuration dialog, select Don't show this message again, then select Restart.

   
16.        

    Configure the default browser:

           
               

    1. In Internet Explorer, select Tools → Internet Options.

               

    2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

               

    3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

               

    4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

           
       

Prepare a Windows Server 2016/2019 Standard image for analysis

Configure your Windows Server 2016/2019 Standard virtual system for analysis.

Task

   
1.        

   Log on to the virtual machine as administrator.

          

              

   Note

              

   The VM administrator password cr@cker42 is required for VM profile creation. ATD system updates it to a random string as a part of VM creation. The running sandbox VM will have a random password.

          

      
   
2.        

   If the Manage Your Server window page appears, select Don't Display the page at logon and close the page.

      
   
3.        

   If the Server Manager windows is displayed, select Manage → Server Manager Properties, select Do not start Server Manager automatically at logon, then select OK.

      
   
4.        

   Disable the shutdown event tracker:

          
              

   1. Select Start → Run, type gpedit.msc, then click OK.

              

   2. In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System, then double-click Display Shutdown Event Tracker.

              

   3. Select Disabled, then click OK.

              

   4. Close the Local Group Policy Editor page.

          
      
   
5.        

   Turn off the firewall in the virtual image:

          
              

   1. Select Start → Control Panel → Windows Firewall → Turn on Windows Firewall On or Off.

              
   2.                

      Select Turn off Windows Firewall (not recommended), for the following, then click OK.

                     
                         

      • Home or work (private) networks

                         

      • Public networks

                     
                 
          
      
   
6.        

   Configure FTP settings in the virtual image:

          
              
   1.                

      Install IIS Manager if not already present and make sure you check the FTP Server checkbox when installing IIS Manager.

                     
                         

      1. From Server Manager page, select Add Roles and Features, then click Next.

                         

      2. In the Installation type page, select Role-based or feature-based installation, then click Next.

                         

      3. In the Server selection page, select Select a server from the server pool, then click Next.

                     
                 
          
      

Trellix Intelligent Sandbox 5.0.x Installation Guide

103

6 | Installation overview

   
4. In the Server Roles page, expand the Web Server (IIS) node, expand the FTP Server node, select FTP Server, select FTP Service, then click Next.
   
5. In the Select features page, select the Telnet Client checkbox, then click Install. You can skip this step if you do not require a Telnet client.
   
6. In the confirmation page, click Install.

b. Select Start → Administrative Tools → Internet Information Services(IIS) Manager.

c. In the Internet Information Services Manager page, select ADMINISTRATOR → Sites, then right-click on Sites and select Add FTP Site.

d. In the Add FTP Site wizard, do the following.

   
• Provide the FTP site name as root and Physical path as C:\, then click Next.
   
• For Bindings and SSL Settings, select No SSL, then click Next.
   
• For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.
   
• Click Finish.

   
7. Ensure that .NET Framework 4.6.2 is installed.
   
8. Set automatic logon:        
              
   1. Select Start → Run, type netplwiz, then press Enter.
              
   2. In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.
              
   3. In the Automatically log on page, provide these credentials.                
                         
      • User name — Administrator
                         
      • Password — cr@cker42
                         
      • Confirm Password — cr@cker42
                     
                 
          
      
   
9. Disable Windows updates and Windows Defender:        
              
   1. Select Start → Run, type gpedit.msc, then press Enter.
              
   2. Select Computer Configuration → Administrative Templates → Windows Components → Windows update.
              
   3. On the right pane, double click Configure Automatic Updates, then select Disable.
              
   4. Click OK.
              
   5. Select Computer Configuration → Administrative Templates → Windows Components → Windows Defender.
              
   6. On the right pane, double click Turn off Windows Defender, then select Enable.
              
   7. Click OK.
          
      
   
10. Configure Microsoft Office 2019:        
               
    1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2019 on the virtual machine.
               
    2. Lower the security to run macros for the Office applications. In Microsoft Word , select the Microsoft Office 2019 option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.
               
    3. Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.
           
       

104          Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

d. On the Welcome to Microsoft Office 2019 page, click Next button.

e. On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

   
11.        

    Configure Adobe Reader:

           
               
    1.                

       To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

                  
               
    2.                

       In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

                  
               
    3.                

       If Accessibility Setup Assistance message appears, select Cancel.

                  
               
    4.                

       Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

                  
           
       
   
12.        

    Configure Java:

           
               
    1.                

       Open Registry Editor

                  
               
    2.                

       Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy\EnableJavaUpdate.

                  
               
    3.                

       Set its value to 0.

                  
               
    4.                

       Close the Registry Editor.

                  
           
       
   
13.        

    Configure Adobe flash player:

           
               
    1.                

       Run the command prompt as an Administrator.

                  
               
    2.                

       Execute the following command:

                      

       dism.exe /online /add-package /packagepath:"<Adobe-Flash-For-Windows-Package>.mum"

                  
               
    3.                

       Restart the VM.

                  
           
       
   
14.        

    Configure system startup:

           
               
    1.                

       Select Start → Run, type msconfig, then click OK.

                  
               
    2.                

       From the Startup tab, deselect reader_sl and jusched, then click OK.

                  
           
       
   
15.        

    Configure the default browser:

           
               
    1.                

       In Internet Explorer, select Tools → Internet Options.

                  
               
    2.                

       In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

                  
               
    3.                

       From the Privacy tab, uncheck Turn on Pop-up Blocker.

                  
               
    4.                

       Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

                  
               
    5.                

       Open Registry Editor.

                  
               
    6.                

       Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed

                  
           
       

   

       

Note

   

   

Replace <Adobe-Flash-For-Windows-Package> with the name and path of the Adobe Flash for Windows MUM file.

   

       

Note

   

   

reader_sl is available only when Adobe Reader is installed.

Trellix Intelligent Sandbox 5.0.x Installation Guide

105

6 | Installation overview

Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}.

g. Set its value to 0.

h. Close the Registry Editor.

Import the virtual disk file

To create an analyzer VM, you must import the corresponding virtual disk file into Intelligent Sandbox.

Task

   
1.        

   Click Start → Shut down.

      
   
2.        

   Make sure there are no stale lock files (.lck) associated with the virtual machine.

          

   The .lck files are located in the same folder as the .vmdk or .vhdx file.

      
   
3.        

   Locate the virtual disk file.

          

   Make sure the virtual disk file name does not contain any spaces or unsupported characters. If it contains any spaces or unsupported characters, the image file conversion fails.

      
   
4.        

   To enable FTP, use the set ftp enable CLI command.

          

   FTP transfer is faster than SFTP, but less secure. If your Intelligent Sandbox Appliance is in an unsecured network, such as an external network, use SFTP.

      
   
5.        

   Open the FTP client.

          

   For example, you can use WinSCP or FileZilla.

      
   
6.        

   To connect to the FTP server on Intelligent Sandbox, use the following credentials.

          
              
   • Host — IP address of Intelligent Sandbox
              
   • Username — atdadmin
              
   • Password — atdadmin
              
   • Port — The corresponding port number based on the protocol you want to use.
          
      
   
7.        

   Upload the virtual disk file from the local machine to Intelligent Sandbox.

      

Convert the VMDK and VHDX file to an image file

To create an analyzer VM, you must convert the VMDK and VHDX file to an image file.

For malware analysis, you can create multiple VMs that run on the same operating system, but with different applications. For example, you can create a Windows 7 SP1 analyzer VM for Internet Explorer 10 and another Windows 7 SP1 analyzer VM for Internet Explorer 9.

Users without administrator permissions are able to convert VMDK and VHDX files to image files.

Task

   
1.        

   Log on to the Intelligent Sandbox web interface.

      

   
2. Click Manage → Image & Software → Image.
   
3. From the VMDK and VHDX Image drop-down list, select the imported VMDK or VHDX file.
   
4. In the Image Name field, enter the image name that corresponds to your operating system.

   

       

Note

   

   

Image Name must not contain a space or any special characters. Accepted special characters are hyphens (-) or underscores (_).

Image names

   

       

Note

   

   

Ensure that you specify whether the OS is a 32-bit or a 64-bit in the Image Name field, else the samples will fail submission.

McAfee ePO and OS profiling work only when you use the default name.

   
5. Select the Operating System.

6 | Installation overview

Intelligent Sandbox attaches the name that you provide to the default name.

Example: You select Microsoft Windows 7 32-bit Service Pack 1, then enter with_PDF in the Image Name field.

The image file name is win7sp1_with_PDF.

   

       

Note

   

   

The image file name must be an alphabet, number, or underscore (_).

   

6. Click Convert.

   

7. On the Info window, click OK.

   
8.        

   View the image conversion logs.

          
              

   1. From the Select Log drop-down list, select the image name.

              

   2. Click View.

          
      

Accessing the Intelligent Sandbox web interface

The Intelligent Sandbox web interface is hosted on the Intelligent Sandbox Appliance. You can access the Intelligent Sandbox web interface from a remote machine using a supported browser.

Trellix Intelligent Sandbox web UI requirements and preparation

Before you access the web UI, ensure that you make changes to your browser settings. Also, make sure that your system meets the necessary requirements. For a complete list of system requirements for client systems, see KB87121.

Browser settings for HTML5 support

User-interactive mode (XMode) is used for activation of VM images and manual submission of files. This mode works with any browser that support HTML5 Canvas. You do not need to install Java to use the XMode feature.

Chrome version 44.0.2403 and higher and Mozilla Firefox version 40.0.3 and higher are supported. Microsoft Internet Explorer is not supported.

You need to modify Firefox settings to use the HTML5 feature.

   

1. From the Firefox homepage, click Options → Advanced → Certificates → View Certificates.

   

2. From the Certificate Manager window, click Servers.

   

3. Click Add Exception... and type https://<Host ATD IP address>:6080 and click Get Certificate.

   

4. Click Confirm Security Exception and then OK.

   

5. Click Activation or XMode.

6 | Installation overview

Security settings for Internet Explorer

When you try to access the web application, you might see the ActiveX control unsafe pop-up dialog box. Perform these steps to resolve this issue.

   

1. On your system, search for Edit Group Policy. The Local Group Policy Editor window is displayed.

   

2. From the Local Computer Policy tree, go to Computer Configuration → Administrative Templates → Windows Components and click Internet Explorer.

   

3. In the right window options, double-click Turn off the Security Settings Check feature and select Enabled.

   

4. Click Apply and then OK.

Security settings for Microsoft Edge

Before installing Microsoft Edge, you must make these changes on the Windows Registry.

   

1. On your system, open the Registry Editor.

   

2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate key.

   

3. Enter this information:

          
              
   • DWORD name: Allowsxs
              
   • DWORD value: 1
          
      

   

       

       

Note

   

   

You must create this key if it is not available.

Group Policy change for Microsoft Edge

You can modify a group policy to configure Microsoft Edge.

   

1. Open the Group Policy Editor.

   

2. Go to Computer Configuration → Administrative Templates → Microsoft Edge Update → Applications and select Allow Microsoft Edge Side by Side browser experience.

   

3. Click Edit Policy Setting and select Enabled.

   

4. Click OK.

Accessing Web UI using a URL

You can access the Trellix Intelligent Sandbox Web UI using a URL. For this, you need to set the appliance name and add it to your DNS server.

   Trellix Intelligent Sandbox 5.0.x Installation Guide    109    

6 | Installation overview

Set the appliance name using the set appliance name command. Then add this newly created appliance name to your DNS server. This allows you to access Trellix Intelligent Sandbox using a URL within your domain.

For example:

Set your appliance name to myatd. Add myatd to your DNS server.

If the domain name of your organization is www.example.com. You can access Trellix Intelligent Sandbox Web UI using myatd.example.com.

For more information about set appliance name, see Trellix Intelligent Sandbox CLI Reference Guide.

Log on to the Intelligent Sandbox web interface

To log on to the Intelligent Sandbox web interface for the first time, use the default credentials.

Before you begin

Set the appliance name using the set appliance name command. Then add the appliance name to your DNS server. This allows you to access Trellix Intelligent Sandbox using a URL within your domain.

Task

   
1.        

   Open your Internet browser, then use the following to log on to the Intelligent Sandbox web interface:

          
              

   • URL — https://<Intelligent Sandbox Appliance host name or IP address>

              

   • Login ID — admin

              

   • Password — admin

          
      
   

2. Click Log In.

   

3. Change the default password.

Copy existing image files from one Intelligent Sandbox Appliance to others on the same network

Any image file available can be concurrently copied to multiple Intelligent Sandbox Appliance on the same network. This helps reduce the additional effort of preparing image files for each individual standalone appliance.

Before you begin

   

• When copying the IMG file to an Intelligent Sandbox cluster, make sure that you copy it to the primary node and follow up with VM Sync to propagate the image to all nodes.

   110    Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

   

       

Note

   

   

We do not recommend copying images to backup or secondary nodes in a cluster directly.

   
•        

  Avoid copying into more than five destination Intelligent Sandbox Appliance concurrently.

     

Task

   
1.        

   Log on to the Intelligent Sandboxweb interface.

      
   
2.        

   Click Manage → Image & Software → Software.

      
   
3.        

   In Destination IP, enter the IP addresses of all devices where the IMG file needs to be copied, separated by semicolons (;).

      

   

       

Note

   

   

Invalid or unavailable IP addresses are ignored.

   
4.        

   In VM Image, select the image to be copied.

      
   
5.        

   Click Copy VM.

      

   

       

Note

   

   

This button is disabled if previous instances of Image copy are running.

What to do next

Verify that the image copied at the destination is same as the source. To do this, compare their hashes available under VM Profiles page.

   

       

Note

   

   

If Image Copy is in progress and either the source or destination Intelligent Sandbox goes offline, a partial image might appear in the destination Intelligent Sandbox which would be unusable.

Restart the Image Copy instance when both devices are online to fix the issue.

Managing VM profiles

After you convert the imported VMDK or VHDX file to an image file, you create a VM profile for that image file.

Trellix Intelligent Sandbox 5.0.x Installation Guide111

6 | Installation overview

   

       

Note

   

   

You cannot associate this VM profile with any other image file. Similarly, once associated, you cannot change the VM profile for an image file.

VM profiles contain the operating system and applications in an image file. This enables you to identify the images that you uploaded to Intelligent Sandbox and then use the appropriate image for dynamically analyzing a file. You can also specify the number of licenses that you possess for the operating system and the applications. Intelligent Sandbox factors this in when creating concurrent analyzer VMs from the corresponding image file.

You use the Intelligent Sandbox web application to manage VM profiles.

Configurations in a VM profile

Create VM profiles

You must configure each image file that you convert with a single, unused VM profile. You can convert the same virtual disk file image files multiple times. This enables you to create multiple image files from one virtual disk file.

VM profiles contain the operating system and applications in an image file. This enables you to identify the images that you uploaded to Intelligent Sandbox and then use the appropriate image to dynamically analyze files. You can also specify the number of licenses that you possess for the operating system and the applications. Intelligent Sandbox factors this in when creating concurrent analyzer VMs from the corresponding image file.

Task

   
1. Log on to the Intelligent Sandbox web interface, then select Policy → VM Profile → New.
   
2. From the Image drop-down list, select the image, then click Activate.
   Based on your browser settings, the activation window opens in a new tab or window.

   112    Trellix Intelligent Sandbox 5.0.x Installation Guide

6 | Installation overview

   

       

Note

   

   

       
• Ensure the pop-up blocker for your browser is not blocking the pop-up window. Add the ATD appliance IP under your pop-up blocker exceptions.
       
• Ensure that ports 6000 and higher (port 6000–6000 + number of VMs existing on ATD appliance) are open between the ATD Client and ATD Appliance. Check that the client's firewall allows connections on these ports. All firewalls between ATD and the client must allow connections through these ports.
       
• When in activation mode, the DNS does not function in the analyzer VM. To enable internet access, the customer must configure static DNS and reset DNS to DHCP prior to shutting down the VM.
   

   
3. Activate Windows on the VM.        
              
   1. Click Start → Control Panel → Windows Activation → Activate Windows now.
              
   2. Open Microsoft Word, then click Activate.
              
   3. On the Microsoft Office Activation Wizard, follow the on-screen prompts.
              
   4. Shut down the VM, then click Disconnect.
          
      
   
4. On the Intelligent Sandbox web interface, click Validate.
   
5. Close the 5n. flash not exist OK message.
   
6. Download Flash Player.        
              
   1. To run the original virtual disk image, use VMware ESXi or Microsoft Hyper-V.
              
   2. On the running VM, download Flash Player.
              
   3. Unzip the file.
              
   4. From the command line, run the following commands, then press Enter.                
                         
      • flashplayerX_X_X_win.exe
                         
      • flashplayerX_X_X_win_debug.exe
                         
      • flashplayerX_X_X_win_sa_debug.exe
                     
                 
              
   5. Close the Flash Player window.
              
   6. Stop the VM, then copy the virtual disk image to the Intelligent Sandbox Appliance.
          
      

If the validation fails, create a new virtual disk file with the correct settings, then create the analyzer VM.

   
7. Click Check Status, then verify that the following validation tests are successful on the Image Validation Log window.        
              
   • FTP connect to <VM IP address> OK
              
   • FTP login OK
              
   • FTP file upload OK
              
   • Telnet login successful
              
   • OS winxp
              
   • Multiprocessing OK
              
   • FTP OK
              
   • TELNET OK
              
   • AUTOLOGON OK
              
   • ADMINISTRATOR OK
              
   • FIREWALL OK
              
   • Sigcheck OK
              
   • Scan Complete
          
      

If the validation tests fail, create a new virtual disk file, then create the analyzer VM.

6 | Installation overview

   
8.        

   Create the VM profile.

          
              
   1.                

      Enter a name and short description for the VM profile.

                 
              
   2.                

      Select Default Profile, to set this as your default VM profile.

                 
              
   3.                

      In VM Login, enter the log on credential for the VM image.

                     

      If you want to log on as an Administrator, leave this field blank.

                 
              
   4.                

      In Maximum Licenses, enter the number of licenses you have for the operating system that you are using for this VM profile.

                 
              
   5.                

      Click Save.

                 
          
      
   
9.        

   On the Information window, click OK.

          
              
   •                

     To monitor the VM creation progress, click Dashboard. The VM creation progress appears on the VM Status monitor.

                
              
   •                

     To view the VM creation logs, click Manage → System.

                
          
      

Configuring Intelligent Sandbox for malware analysis

To configure Intelligent Sandbox or Virtual Intelligent Sandbox for malware analysis, log on to the Intelligent Sandbox web interface.

   

       

Important

   

   

Ensure that you change the password for cliadmin from the Command-line interface and atdadmin from the web interface for the configurations to be successful. Some of the configurations might fail if you continue using the default password.

High-level steps to configure malware analysis

This section provides the high-level steps on how to configure Intelligent Sandbox for malware analysis and reporting

Summarized steps for configuring malware analysis

   
1.        

   Set up the Intelligent Sandbox Appliance and ensure that it is up and running.

          
              
   •                

     Based on your deployment option, make sure the Intelligent Sandbox Appliance has the required network connections. For example, if you integrate it with Network Security Platform, make sure the Sensor, Manager, and the Intelligent Sandbox Appliance are able to communicate with each other.

                
              
   •                

     Make sure the required static analysis modules, such as the Gateway Anti-Malware Engine are up-to-date.

                
          
      
   
2.        

   Create the analyzer VMs and the VM profiles.

      
   
3.        

   Create the analyzer profiles that you need.

      
   
4.        

   If you want Intelligent Sandbox to upload the results to an FTP server, configure it and have the details with you before you create the profiles for the corresponding users.

      
   
5.        

   Create the required user profiles.

      
   
6.        

   Log on to Intelligent Sandbox web application using the credentials of a user you created and upload a sample file for analysis. This is to check if you have configured Intelligent Sandbox as required.