FlareWindows11 is the lab’s primary Windows VM for static and dynamic malware analysis. This guide builds it on Proxmox and keeps it isolated from production networks.

🖥️ 1️⃣ Proxmox VM Creation

Recommended VM Settings:

➡️ Tip: After Windows is installed, reset boot order to prioritize the disk.

💽 2️⃣ Install Windows 11

1. Boot from the Windows ISO.
2. Choose Windows 11 Professional.
3. If using VirtIO disks:
   • Load the VirtIO storage driver during disk selection.
4. Complete the installation process.

✅ Install QEMU Guest Agent (Recommended)

1. Mount the VirtIO ISO.
2. Install: qemu-ga-x86_64.msi.
3. Confirm the QEMU Guest Agent service is running.

🛠️ 3️⃣ Install Flare VM

• Follow instructions from Mandiant’s GitHub.
• During install, you can deselect tools (e.g., IDA Pro if you don’t have a license).
• Expect multiple reboots during installation — it’s a large toolkit.

🌐 4️⃣ Ensuring a Sandboxed Environment

1. Shutdown the VM.
2. Remove the original Proxmox network bridge attached to this VM.
3. Create a new virtual bridge in Proxmox:
   • Used on the LAN side of pfSense.
   • Shared by any machines placed on the internal lab LAN.
   • ⚠️ No physical NIC or IP address required.
4. Add this new bridge to the VM.
5. Boot the VM and confirm functionality.

✅ Final Checklist

• Windows 11 Pro installed and updated
• TPM & EFI enabled
• VirtIO drivers & QEMU Guest Agent installed
• Hostname set: FlareWindows11
• Flare VM successfully installed
• Original Proxmox bridge removed
• New isolated bridge created and attached

🔒 Security Notes

• ✅ Restrict Proxmox console and VM access.
• ✅ Keep this VM on isolated virtual bridges only (no physical NIC).
• ✅ Snapshot the VM once setup is complete for easy rollback.