M1 Mac Malware Analysis VM Setup with Windows 11 (Free)

* Chapters *

0:00 Intro
1:40 Hypervisor Overview
3:37 ARM VM Overview
6:17 Installing VMWare Fusion 22H2
6:35 Free Copy of Windows 11 ARM (beta)
7:25 Converting VHDX to VMDK
8:23 Create Windows VM
11:15 Disable Windows Defender
13:31 FLARE-VM for Windows 11 ARM

-----
OALABS PATREON

OALABS DISCORD

Twitch

OALABS GITHUB

UNPACME - AUTOMATED MALWARE UNPACKING
-----

UTM

VMWare Fusion Tech Preview 22H2 for M1

Windows Insider Registration

Windows 11 ARM Beta Release

Convert VHDX to VMDK

Windows ARM Install Guide for VMWare Fusion

LazyAdmin Disable Windows Defender

FLARE-VM Windows 11 Profile (OALABS GitHub)
** This is no longer supported due to major breaking changes to the original FLARE-VM repo

[netrunner]

I once again write a comment. I think this video absolutely deserves many more views and acknowledgements. Thanks to this video and the suggestion to use Windows 11 Arm as a workaround for x86/x64 instructions, I was finally able to create the testing environment that I needed and could not achieve before on my M1 Pro. It is full of comments on the forums/reddits from users who do not know about this possibility and have to opt for another laptop.
Again, thank you very much for this video.

[mytechnotalent]

Awesome as always! I have an M1 and this is very helpful!

[davitrindade]

best video I ever watched! Congratulations and thank you so much for sharing.

[ca]

Thank you very much! You saved me a lot of debugging time.

[kritikusi-]

I disable Defender by feeding it Malware. My kids, grand kids are going to know about your content. Marvelous.

[netrunner]

thank you very very very very much!! Unfortunately, I was about to sell my macbook 16 with M1 Pro specifically because of the difficulty of doing analysis on x86 and x64.

[LucaDAmico]

Hi, nice video as always. I’d just like to add that there is also a preview of Virtualbox 7, that should be able to run on Apple Silicon. I haven’t tried it yet, but during my last malware analysis speech, somebody told me that. Maybe it can be a free alternative when the tech preview of fusion will expire 😅

Edit: also, while I can do my RE stuff with x64dbg on Win11ARM, I had some issues running OllyDbg… it had some serious stability issue.

[je]

One thing to keep in mind is that some plugins for x64dbg (mapoanalyzer for one) won't work on W11 ARM and will crash x64dbg

[johndoe-kgnv]

Hello! Thank you for this! Has anyone here run into the issue that after restart to Safe Boot, when logging on it says an app is need and one simply cannot log on?

[LLv]

I tried with UTM but no success on reboot in safe mode and cant disable Windows Defender.

[dtybqrb]

Hi, I was wondering if you could do a more in-depth video about how life is like doing malware analysis using a m1? i am curious to know are you able to run older malware? which targeted OS's like windows xp or window 7 etc. While I feel apple silicon machines are amazing, they are quite limited due to not really able to run anything to test. Looks like we are stuck using win 11 cos if its good x86 support but not able to test like older os vulns to learn about. Any thoughts on this would be welcome since apple silicon is not going anywhere. Thanks

[skycracker]

Asking this more than a year after this video's release .... is this the best and most optimal way to build a Windows Malware Analysis environment on ARM Macs ?

[alphabetadministrator]

Hi can I run Remnux on Flare VM for Windows on ARM?

[doniyorismatilloev]

I am getting a zsh: command not found: qemu-img trying to convert it would you know why? Any suggestions?

[fsacer]

somehow M1 Mac and free do not go together in one sentence

[MatthiasToberer]

On Mac this works for me: qemu-img convert -p -O vmdk Windows11_....VHDX win11.vmdk