Prepare a Windows 8 image for analysis

From the native system, set up Windows 8 to display in the Desktop mode instead of the default Metro UI mode when it starts.

1. Press the Windows and R keys simultaneously, which is the shortcut to open the Run dialog box.

2. In the Run dialog box, type regedit, then press Enter.

3. In Registry Editor, select HKEY_LOCAL_MACHINE → SOFTWARE → Microsoft → Windows NT → CurrentVersion → Winlogon, then double-click on Shell.

4. Change Value data to explorer.exe, explorer.exe (instead of the default value of explorer.exe), then click OK.

Log on to the virtual machine as administrator.

Turn off the firewall in the virtual image:

1. Press the Windows and X keys simultaneously, then select Control Panel → System and Security → Turn on Windows Firewall On or Off.

2. Select Turn off Windows Firewall (not recommended) for both Home or work(private) network location settings and Public network location settings, then click OK.

Disable Windows Defender:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Windows Defender → Settings → Administrators, deselect Turn on Windows Defender, then click Save changes.

3. Close the Windows Defender message box.

Disable first log on animation:

1. Press the Windows and X keys simultaneously.

2. In the Run dialog box, type gpedit.msc, then press Enter.

3. In the Local Group Policy Editor page, select Computer Configuration → Administrative Templates → System → Logon.

4. Double-click Show first sign-in animation, select Disabled, then click OK.

Enable required Windows features.

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Programs → Programs and Features → Turn Windows feature on or off.

3. Select Internet Information Services → FTP server → FTP Extensibility.

4. Select Internet Information Services → Web Management Tools → IIS Management Service.

5. Select Telnet Server.

6. Select .NET Framework 3.5(includes .NET 2.0 and 3.0) and then select Windows Communication Foundation HTTP Activation and Windows Communication Foundation Non-HTP Activation options, then press OK.

7. If the Windows needs files from Windows Update to finish installing some features message appears, select Download files from Windows Update.

   This operation might take around 5 minutes to complete. A confirmation message is displayed when the operation completes.

Edit the power options:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Power Options → Choose when to turn off the display, select Never for both Turn off the display and Put the computer to sleep options, then click Save changes.

3. Select Power Options → Choose what the power buttons do, select Change Settings that are currently unavailable for both Turn off the display and Put the computer to sleep options, then click Save changes.

4. For shutdown settings, deselect Turn on fast startup and Hibernate options, then click Save changes.

Start the telnet service in the virtual image:

1. Press the Windows and X keys simultaneously, select Computer Management → Services and Applications → Services, then double-click Telnet.

2. In the Telnet Properties (Local Computer) page, select Automatic for the Startup type, then select Apply → Start → OK.

Configure FTP settings in the virtual image:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Administrative Tools, then double-click Internet Information Services.

3. In the Internet Information Services page, expand the entry under Internet Information Services(IIS) Manager, then expand the tree under host name.

4. If you see the Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components? message, select Do not show this message, then click Cancel.

5. Select Sites, right-click on Default Web Site, select Remove, then click Yes to confirm.

6. Right-click Sites, select Add FTP Site, then do the following.

   • Provide the FTP site name as root and Physical path as C:\, then click Next.

   • For Bindings and SSL Settings, select No SSL, then click Next.

   • For Authentication and Authorization Information, select Basic under Authentication, select All Users under Allow access to, select both Read and Write under Permissions.

   • Click Finish.

7. Close the Internet Information Services (IIS) Manager page.

Turn off automatic updating for Windows:

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Windows Update → Change.

3. Select Never check for updates (not recommended), then click OK

Configure Telnet clients

1. Press the Windows and X keys simultaneously, select Control Panel, then select Small Icons under View by.

2. Select Administrator Tools → Computer Management.

3. Select Computer Management (Local) → System Tools → Local Users and Groups → Groups.

4. Double-click TelnetClients.

5. Click Add, type Administrator, click Check Names, then click OK.

Set automatic logon:

1. Press the Windows and R keys simultaneously, type netplwiz, then press Enter.

2. In the User Accounts window, deselect Users must enter a user name and password to use this computer, then click Apply.

3. In the Automatically log on page, provide these credentials.

   • User name — Administrator

   • Password — cr@cker42

   • Confirm Password — cr@cker42

Configure Microsoft Office:

1. To analyze Microsoft Word, Excel, and PowerPoint files, install Microsoft Office 2003 on the virtual machine.

2. Lower the security to run macros for the Office applications. In Microsoft Word 2003 and select Tools → Macro → Security, select Low, then click OK. Do the same for other applications such as Microsoft Excel and PowerPoint.

3. Go to http://www.microsoft.com/en-us/download/details.aspx?id=3 and download the required Microsoft Office compatibility pack for Word, Excel, and PowerPoint File Formats, then install them on the virtual machine.

   You need the compatibility pack to open Microsoft Office files that were created in a newer version of Microsoft Office. For example, to open a .docx file using Office 2003, you need the corresponding compatibility pack installed.

4. In the Compatibility Pack for the 2007 Office system dialog, select Click here to accept the Microsoft Software License Terms, then click OK.

Configure Adobe Reader:

1. To analyze PDF files, download Adobe Reader to the native host and copy it to the VM.

2. Open Adobe Reader and click Accept.

3. In Adobe Reader, select Edit → Preferences → General, then remove Check for updates.

4. In Adobe Reader, select Help → Check for updates → Preferences, then deselect Adobe Updates.

Configure Java:

1. Open Java in the Control Panel.

2. In the Update tab, deselect Check for Updates Automatically.

3. In the Java Update Warning message, select Do Not Check and then click OK.

Configure system startup:

1. Run the msconfig command.

2. From the Startup tab, then click Open Task Manager.

3. Select Java(TM) Update Scheduler (jusched) (if listed), then click Disable.

4. Select Adobe Acrobat SpeedLauncher (reader_sl) (if listed), then click Disable.

5. In the System Configuration message, select Restart.

6. In the System Configuration Utility message, select Don't show this message or launch the System Configuration Utility when Windows start, then click OK.

Configure the default browser:

1. In Internet Explorer, select Tools → Internet Options.

2. In Home page select Use Blank or Use new tab based on the version of Internet Explorer.

3. From the Privacy tab, uncheck Turn on Pop-up Blocker.

4. Go to the Advanced tab of the Internet Options and locate Security, then select Allow active content to run in files on My Computer.

Disable the HTTP auto proxy server: Open command prompt with administrator privilege, then run these commands.