Prepare a Windows 10 image for analysis

Log on to the virtual machine, then run the VM Provisioner Tool.

Restart the virtual machine.

Turn off the firewall in the virtual image:

1. Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

2. Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

Disable Windows Defender:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Windows Defender, then turn off all features on the Windows Defender Settings page.

3. If a Windows Defender message appears, close the message screen.

Disable first log on animation:

1. Press the Windows and R keys simultaneously.

2. In the Run dialog box, type gpedit.msc, then press Enter.

3. In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

4. Double-click Show first sign-in animation, select Disabled, then click OK.

Enable required Windows features.

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Programs → Programs and Features → Turn Windows feature on or off.

3. Select Internet Information Services → FTP server → FTP Extensibility.

4. Select Internet Information Services → Web Management Tools → IIS Management Service.

5. Select .NET Framework 4.6 Advanced Services, and ensure that ASP.NET 4.6 is enabled.

6. Select WCF Service Library, ensure that TCP Port Sharing is enabled, then select OK.

7. If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

   This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

Edit the power options:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Power Options → Choose when to turn off the display, select Never for Turn off the display, then click Save changes.

Configure FTP settings in the virtual image:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Administrative Tools, then double-click Internet Information Services.

3. In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.

4. If you see the Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components? message, select Do not show this message, then click Cancel.

5. Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.

6. Right-click Sites, select Add FTP Site, then do the following.

   • Provide the FTP site name as root and Physical path as C:\, then click Next.

   • For Bindings and SSL Settings, select No SSL, then click Next.

   • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read, and Write under Permissions.

   • Click Finish.

7. Close the Internet Information Services (IIS) Manager page.

Turn off automatic updating for Windows:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Administrative Tools → Services, then double-click Windows Update.

3. Select Startup type as Disabled.

4. Stop the service if the service is running.

5. Press the Windows and R keys simultaneously, type gpedit.msc, then click OK.

6. In Local Group Policy Editor, select Computer Configuration → Administrative Templates → Windows Components → Windows Update.

7. On the right-pane, double-click Configure Automatic Updates.

8. Select Disabled, then click OK.

Set automatic logon:

1. Press the Windows and R keys simultaneously, type netplwiz, then press Enter.

2. In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

3. In the Automatically log on page, provide these credentials.

   • User name — admin

   • Password — cr@cker42

   • Confirm Password — cr@cker42

Configure Microsoft Office:

1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2007 on the virtual machine.

2. From any Microsoft Office software, select File → Options → Advanced, then under the Display section, enable the following options:

   • Disable hardware graphics acceleration

   • Disable Slide Show hardware graphics acceleration

3. Lower the security to run macros for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → Macro Settings, then select Enable all macros (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

4. Lower the security to run ActiveX for the Office applications. In Microsoft Word 2007, select the Microsoft Office option on the top left corner, then select Word options → Trust Center → Trust Center Settings → ActiveX Settings, then select Enable all controls without restrictions and without prompting (not recommended potentially dangerous code can run). Do the same for other applications such as Microsoft Excel and PowerPoint.

5. Select Word options → Trust Center → Trusted Center Settings → Trusted Locations, then use the Add new location... button to add C:\ under User Locations. Once added, double-click on the entry for C:\, then in the pop-up, select Subfolders of this location are also trusted, then click OK.

6. On the Welcome to Microsoft Office 2007 page, click Next button.

7. On the Sign-up for Microsoft Update page, select I don't want to use Microsoft Update, then click Finish.

8. When you open any of the Microsoft Office 2007 software, you would see the Help Protect and Improve Microsoft Office pop-up. From the pop-up select Don't make changes, then click OK.

Configure Adobe Reader:

1. To analyze PDF files, download Adobe Reader to the native host and install it to the VM.

2. In Adobe reader, if Adobe Reader Protected Mode message appears, select Open with Protected Mode disabled, then select OK.

3. If Accessibility Setup Assistance message appears, select Cancel.

4. Select Edit → Preferences → Updater, select Do not download or install updated automatically, select OK, then select Yes to confirm the changes.

Configure Java:

1. Open Java in the Control Panel.

2. In the Update tab, deselect Check for Updates Automatically.

3. In the Java Update Warning message, select Do Not Check and then click OK.

Configure system startup:

1. Run the msconfig command.

2. From the Startup tab, then click Open Task Manager.

3. Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

4. Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

5. In the System Configuration dialog, select Don't show this message again, then select Restart.

Configure the default browser:

1. In Internet Explorer, select Tools → Internet Options.

2. In Home page, select Use Blank or Use new tab based on the version of Internet Explorer.

3. From the Privacy tab, deselect Turn on Pop-up Blocker.

4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.

Enable .NET framework: Open command prompt with administrator privilege, then run one of these commands.

Disable the Windows Defender Application Guard.

1. Go to Run, then type gpedit.msc, and then click OK. This opens the Local Group Policy Editor.

2. Navigate to Computer Configuration → Administrative Templates → Windows Components → Windows Defender Application Guard.

3. In the right-pane, edit Turn on Windows Defender Application Guard in Enterprise Mode.

4. Select Disabled, then click OK.