nbeede / boombox

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

BoomBox

BoomBox is designed for malware analysts and incident responders. It allows for the rapid deployment of a dynamic malware analysis environment using Cuckoo Sandbox and a Windows 10 detonation chamber. Cuckoo is configured to use the physical machinery so that both Cuckoo and the Windows sandbox can be virtual machines on a single host.

Features

• Inetsim network simulation
• Cuckoo community modules
• Clean base snapshot of the Windows environment is taken as part of the build process
• Chocolatey package manager for Windows used to install Adobe Reader, Flash, Chrome, and Firefox.
  • NOTE: Microsoft Office has not been included due to licensing. If you have a license key, you can install Office and take a new clean base snapshot.

Requirements

• 20GB+ of free disk space
• 6GB+ of RAM
• Packer
• Vagrant
• VirtualBox

Quickstart

BoomBox includes a single build script for Linux, macOS, and Windows. This script will build and configure the Windows 10 and Cuckoo virtual machines from the ground up using Packer and Vagrant. The entire build process for BoomBox takes around 30-60 minutes.

Linux/macOS

• ./build.sh virtualbox - Build BoomBox from scratch.
• ./build.sh virtualbox --vagrant-only - Build BoomBox using pre-built Packer boxes hosted on Vagrant Cloud. This option is faster than building BoomBox from scratch.
• ./build.sh virtualbox --packer-only - This will only build the .Box files and will not build the VMs using Vagrant.

Windows

• ./build.ps1 -ProviderName virtualbox - Build BoomBox from scratch.
• ./build.ps1 -ProviderName virtualbox -VagrantOnly - Build BoomBox using pre-built Packer boxes hosted on Vagrant Cloud. This option is faster than building BoomBox from scratch.
• /.build.ps1 -ProviderName virtualbox -PackerOnly - This will only build the .Box files and will not build the VMs using Vagrant.

Manually Building BoomBox

1. Build the Windows sandbox using Packer

$ cd BoomBox/Packer
$ packer build --only=virtualbox-iso sandbox.json

2. Move the resulting .box file into the Boxes directory

   mv sandbox_virtualbox.box ../Boxes

3. cd ../Vagrant and inside the Vagrantfile change cfg.vm.box = "boomboxes/sandbox" to cfg.vm.box = ../Boxes/sandbox_virtualbox.box

4. Install the Vagrant-Reload plugin

   vagrant plugin install vagrant-reload

5. Run the ./build.sh for Linux/macOS or ./build.ps1 for Windows from the project root directory

6. Logs from the build process are located in the Vagrant directory as vagrant_up_<host>.log

Basic Vagrant Usage

Vagrant commands must be run from the "Vagrant" folder.

• Bring up all BoomBox hosts: vagrant up
• Bring up a specific host: vagrant up <hostname>
• Restart a specific host: vagrant reload <hostname>
• Restart a specific host and re-run the provision process: vagrant reload <hostname> --provision
• Destroy a specific host vagrant destroy <hostname>
• Destroy the entire BoomBox environment: vagrant destroy (Adding -f forces it without a prompt)
• SSH into a host: vagrant ssh cuckoo
• Check the status of each host: vagrant status
• Suspend the environment: vagrant suspend
• Resume the environment: vagrant resume

Lab Information

• Cuckoo Web Server: http://192.168.30.100:8080 - vagrant:vagrant
  • NIC1 attached to NAT
  • NIC2 attached to Host-only Adapter
• Windows Sandbox: 192.168.30.101
  • NIC1 attached to Host-only Adapter

Snapshots

There are revert.ps1 and revert.sh scripts that are to be used to restore a clean version of the Windows sandbox. This script will need to be run after each submission to Cuckoo to ensure a consistent detonation environment. This is a temporarily solution until there is a good way to have this done automatically after each detonation.

Todo

• Sandbox anti-evasion techniques
• Improve revert scripts to not rely on sleep
• Revert sandbox to clean snapshot on reboot
• Support additional Vagrant providers

Contributing

Check out CONTRIBUTING.md for details on submitting a pull request.

Credits

The majority of this project was directly borrowed from Chris Long's DetectionLab, which is an incredible resource for defenders looking to build a Windows lab.

boombox's Issues

Update sandbox.json file to the latest packer version.

i've taken the time to update the json file to work with the latest packer version. below is the fix. I'll try to spend some time learning github to update the fix...

{
"builders": [
{
"boot_command": "",
"boot_wait": "6m",
"communicator": "winrm",
"disk_size": "{{user disk_size}}",
"floppy_files": [
"{{user autounattend}}",
"./floppy/WindowsPowershell.lnk",
"./floppy/PinTo10.exe",
"./scripts/fixnetwork.ps1",
"./scripts/MakeWindows10GreatAgain.ps1",
"./scripts/MakeWindows10GreatAgain.reg",
"./scripts/rearm-windows.ps1",
"./scripts/disable-screensaver.ps1",
"./scripts/disable-winrm.ps1",
"./scripts/enable-winrm.ps1",
"./scripts/microsoft-updates.bat",
"./scripts/win-updates.ps1",
"./scripts/oracle-cert.cer"
],
"guest_additions_mode": "disable",
"guest_os_type": "Windows81_64",
"headless": false,
"iso_checksum": "{{user iso_checksum_type}}:{{user iso_checksum}}",
"iso_url": "{{user iso_url}}",
"shutdown_command": "shutdown /s /t 10 /f /d p:4:1 /c "Packer Shutdown"",
"type": "virtualbox-iso",
"vboxmanage": [
[
"modifyvm",
"{{.Name}}",
"--memory",
"2048"
],
[
"modifyvm",
"{{.Name}}",
"--cpus",
"2"
]
],
"vm_name": "sandbox",
"winrm_password": "vagrant",
"winrm_timeout": "4h",
"winrm_username": "vagrant"
}
],
"post-processors": [
{
"keep_input_artifact": false,
"output": "sandbox_{{.Provider}}.box",
"type": "vagrant"
}
],
"provisioners": [
{
"execute_command": "{{ .Vars }} cmd /c "{{ .Path }}"",
"remote_path": "/tmp/script.bat",
"scripts": [
"./scripts/enable-rdp.bat"
],
"type": "windows-shell"
},
{
"scripts": [
"./scripts/debloat-windows.ps1",
"./scripts/rearm-windows.ps1",
"./scripts/MakeWindows10GreatAgain.ps1"
],
"type": "powershell"
},
{
"type": "windows-restart"
},
{
"scripts": [
"./scripts/set-powerplan.ps1",
"./scripts/docker/disable-windows-defender.ps1"
],
"type": "powershell"
},
{
"execute_command": "{{ .Vars }} cmd /c "{{ .Path }}"",
"remote_path": "/tmp/script.bat",
"scripts": [
"./scripts/pin-powershell.bat",
"./scripts/compile-dotnet-assemblies.bat",
"./scripts/set-winrm-automatic.bat",
"./scripts/compact.bat"
],
"type": "windows-shell"
}
],
"variables": {
"autounattend": "./answer_files/10/Autounattend.xml",
"disk_size": "61440",
"iso_checksum": "27e4feb9102f7f2b21ebdb364587902a70842fb550204019d1a14b120918e455",
"iso_checksum_type": "sha256",
"iso_url": "https://software-download.microsoft.com/download/pr/17134.1.180410-1804.rs4_release_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso"
}
}

Cuckoo doesn´t work when using vagrant up

cuckoo:     Complete output from command python setup.py egg_info:
cuckoo:     Sorry, Python 3.4 or newer required
cuckoo:
cuckoo:     ----------------------------------------
cuckoo: Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-9FHkRN/idna/
cuckoo: You are using pip version 8.1.1, however version 21.0.1 is available.
cuckoo: You should consider upgrading via the 'pip install --upgrade pip' command.
cuckoo: [20:00:43]: Initializing Cuckoo Config...
cuckoo: /tmp/vagrant-shell: line 60: cuckoo: command not found
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/cuckoo.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/reporting.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [Errno 2] No such file or directory: '/root/.cuckoo/conf/physical.conf'
cuckoo: [20:00:43]: Installing community packages
cuckoo: /tmp/vagrant-shell: line 78: cuckoo: command not found
cuckoo: [20:00:43]: Installing supervisord configuration
cuckoo: cp: cannot create regular file '/root/.cuckoo/supervisord.conf': No such file or directory
cuckoo: [20:00:43]: Enable supervisord in systemctl
cuckoo: Created symlink from /etc/systemd/system/multi-user.target.wants/supervisord.service to /lib/systemd/system/supervisord.service.
cuckoo: [20:00:43]: Starting Supervisord
cuckoo: Job for supervisord.service failed because the control process exited with error code. See "systemctl status supervisord.service" and "journalctl -xe" for details.
cuckoo: [20:00:43]: Starting Cuckoo services
cuckoo: http://localhost:9001 refused connection
cuckoo: [20:00:43]: Everything has been setup correctly!

error while trying to build ujnder windows 11 [Deprecated configuration key: 'iso_checksum_type'.]

Checking if Packer is installed
Checking if Vagrant is installed...
Checking for pre-existing boxes...
Checking for vagrant instances...
Checking disk space...
Checking if the vagrant-reload plugin is installed
Prerequisite checks have finished.
Running Packer for sandbox
Using Packer to build the sandbox Box. This can take 90-180 minutes depending on bandwidth and hardware.
Error: Failed to prepare build: "virtualbox-iso"

1 error occurred:
* Deprecated configuration key: 'iso_checksum_type'. Please call packer fix
against your template to update your template to be compatible with the current
version of Packer. Visit https://www.packer.io/docs/commands/fix/ for more
detail.

==> Wait completed after 0 seconds

==> Builds finished but no artifacts were created.
Finished for sandbox. Got exit code: 1
packer_build_box : Something went wrong while attempting to build the sandbox box.
In C:\Users\jamy\Downloads\BoomBox-master\build.ps1:279 Zeichen:3

• packer_build_box -Box 'sandbox'

• + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
  + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,packer_build_box
  
  

PS C:\Users\jamy\Downloads\BoomBox-master\Packer>

Ubuntu 18.04 (server and desktop) install fails

i've tried all i know..
i've tried ubuntu 18.04 desktop and server

what i've done:
installed clean version of ubuntu 18.04

sudo apt update && sudo apt upgrade -y && sudo apt dist-upgrade -y
sudo apt install git -y
sudo git clone https://github.com/nbeede/BoomBox.git

install virtualbox 5.2

sudo apt-get -y install gcc make linux-headers-$(uname -r) dkms
wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add -
sudo sh -c 'echo "deb http://download.virtualbox.org/virtualbox/debian $(lsb_release -sc) contrib" >> /etc/apt/sources.list'
sudo apt-get update
sudo apt-get install virtualbox-5.2 -y
curl -O http://download.virtualbox.org/virtualbox/5.2.0/Oracle_VM_VirtualBox_Extension_Pack-5.2.0-118431.vbox-extpack
sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-5.2.0-118431.vbox-extpack

sudo ./build.sh virtualbox

sudo ./build.sh

Traceback (most recent call last):
25: from /usr/bin/vagrant:23:in <main>' 24: from /usr/bin/vagrant:23:in load'
23: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/bin/vagrant:146:in <top (required)>' 22: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/environment.rb:269:in cli'
21: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/cli.rb:46:in execute' 20: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/commands/status/command.rb:20:in execute'
19: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/plugin/v2/command.rb:212:in with_target_vms' 18: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/plugin/v2/command.rb:212:in map'
17: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/plugin/v2/command.rb:213:in block in with_target_vms' 16: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/plugin/v2/command.rb:180:in block in with_target_vms'
15: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/environment.rb:694:in machine' 14: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/vagrantfile.rb:79:in machine'
13: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/vagrantfile.rb:79:in new' 12: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/machine.rb:140:in initialize'
11: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/machine.rb:248:in communicate' 10: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/registry.rb:27:in get'
9: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/communicators/winrm/plugin.rb:15:in block in <class:Plugin>' 8: from /usr/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require'
7: from /usr/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' 6: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/communicators/winrm/communicator.rb:6:in <top (required)>'
5: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/communicators/winrm/communicator.rb:6:in require_relative' 4: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/communicators/winrm/shell.rb:8:in <top (required)>'
3: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/lib/vagrant/util/silence_warnings.rb:8:in silence!' 2: from /usr/share/rubygems-integration/all/gems/vagrant-2.0.2/plugins/communicators/winrm/shell.rb:9:in block in <top (required)>'
1: from /usr/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require' /usr/lib/ruby/2.5.0/rubygems/core_ext/kernel_require.rb:59:in require': cannot load such file -- winrm (LoadError)
You appear to have already created at least one Vagrant instance of BoomBox. This script does not support pre-created instances. Please either destroy the existing instances or follow the build steps in the README to continue.

#install vagrant and packer
sudo apt install vagrant -y
sudo apt install packer -y

#tried the packer install instructions:
sudo packer build --only=virtualbox-iso sandbox.json
virtualbox-iso output will be in this color.

==> virtualbox-iso: Downloading or copying ISO
virtualbox-iso: Downloading or copying: https://software-download.microsoft.com/download/pr/17134.1.180410-1804.rs4_release_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso
virtualbox-iso: Download progress: 1%
...
virtualbox-iso: Download progress: 100%
==> virtualbox-iso: Creating floppy disk...
virtualbox-iso: Copying files flatly from floppy_files
virtualbox-iso: Copying file: ./answer_files/10/Autounattend.xml
virtualbox-iso: Copying file: ./floppy/WindowsPowershell.lnk
virtualbox-iso: Copying file: ./floppy/PinTo10.exe
virtualbox-iso: Copying file: ./scripts/fixnetwork.ps1
virtualbox-iso: Copying file: ./scripts/MakeWindows10GreatAgain.ps1
virtualbox-iso: Copying file: ./scripts/MakeWindows10GreatAgain.reg
virtualbox-iso: Copying file: ./scripts/rearm-windows.ps1
virtualbox-iso: Copying file: ./scripts/disable-screensaver.ps1
virtualbox-iso: Copying file: ./scripts/disable-winrm.ps1
virtualbox-iso: Copying file: ./scripts/enable-winrm.ps1
virtualbox-iso: Copying file: ./scripts/microsoft-updates.bat
virtualbox-iso: Copying file: ./scripts/win-updates.ps1
virtualbox-iso: Copying file: ./scripts/oracle-cert.cer
virtualbox-iso: Done copying files from floppy_files
virtualbox-iso: Collecting paths from floppy_dirs
virtualbox-iso: Resulting paths from floppy_dirs : []
virtualbox-iso: Done copying paths from floppy_dirs
==> virtualbox-iso: Creating virtual machine...
==> virtualbox-iso: Creating hard drive...
==> virtualbox-iso: Attaching floppy disk...
==> virtualbox-iso: Creating forwarded port mapping for communicator (SSH, WinRM, etc) (host port 3827)
==> virtualbox-iso: Executing custom VBoxManage commands...
virtualbox-iso: Executing: modifyvm sandbox --memory 2048
virtualbox-iso: Executing: modifyvm sandbox --cpus 2
==> virtualbox-iso: Starting the virtual machine...
==> virtualbox-iso: Error starting VM: VBoxManage error: VBoxManage: error: The virtual machine 'sandbox' has terminated unexpectedly during startup with exit code 1 (0x1)
==> virtualbox-iso: VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component MachineWrap, interface IMachine
==> virtualbox-iso: Unregistering and deleting virtual machine...
==> virtualbox-iso: Deleting output directory...
Build 'virtualbox-iso' errored: Error starting VM: VBoxManage error: VBoxManage: error: The virtual machine 'sandbox' has terminated unexpectedly during startup with exit code 1 (0x1)
VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component MachineWrap, interface IMachine

==> Some builds didn't complete successfully and had errors:
--> virtualbox-iso: Error starting VM: VBoxManage error: VBoxManage: error: The virtual machine 'sandbox' has terminated unexpectedly during startup with exit code 1 (0x1)
VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component MachineWrap, interface IMachine

#---=========================================================---
Any suggestions would be appreciated

Issue with ./build.sh

Hi there I have followed the steps in the "Manually Building BoomBox" portion on your git repo.

After running step 3. running the vagrant plugin install vagrant-reload command in step 4. caused me to have to install an earlier version of vagrant. Once I got that working when I ran step 5. the ./build.sh command reports

There is a syntax error in the following Vagrantfile. The syntax error message is reproduced below for convenience: cfg.vm.box = /Boxes/sandbox

Windows 10: Timeout waiting for restart

./build.ps1 times out whilst waiting for VM to restart even though it has restarted on virtualbox. Does not register on powershell and goes ahead and deletes & deregisters VM, has happened twice now so definitely a bug.

pip update is required otherwise the cuckoo installation fails

After vagrant up i see:

Collecting setuptools (from jsonschema->pymisp==2.4.106->cuckoo)
  Using cached https://files.pythonhosted.org/packages/2f/8e/38259f4a44944a92068d5ff77230511a4c685604b47a81318f9e5cf2cc24/setuptools-49.2.0.zip
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "setuptools/__init__.py", line 21, in <module>
        import setuptools.version
      File "setuptools/version.py", line 1, in <module>
        import pkg_resources
      File "pkg_resources/__init__.py", line 1380
        raise SyntaxError(e) from e
                                ^
    SyntaxError: invalid syntax
    
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-cYz99c/setuptools/
You are using pip version 8.1.1, however version 20.1.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.

to fix add pip install --upgrade pip in bootstrap.sh before pip install -U supervisor

Windows 10 Install - "packer_build_box : Something went wrong while attempting to build the sandbox box."

I'm doing the "./build.ps1 -ProviderName virtualbox" build and when I run

./build.ps1 -ProviderName virtualbox -PackerPath C:\Users\Me\Downloads\Compressed\packer_1.6.3_windows_amd64\packer.exe

I get the following error

Finished for sandbox. Got exit code: 1
packer_build_box : Something went wrong while attempting to build the sandbox box.
At C:\Users\kmhs1\Downloads\BoomBox\build.ps1:279 char:3
+   packer_build_box -Box sandbox
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,packer_build_box

I was having issues earlier with even loading the script in powershell due to "running scripts is disabled on this system." However I fixed that by running CMD as admin and using the command

powershell Set-ExecutionPolicy RemoteSigned

Bringing that up in case it's relevant to the first issue.

TLS Error Powershell 1.0 install_choco.ps1

Hi there,
TLS 1.0 it's used by default using powershell..
We need to add this line in install_choco.ps1 to use TLS1.2 and avoid the SSL error.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Thanks you for you work btw !

Access cuckoo web portal from PC outside of the host machine

Hello, is there a way I access the cuckoo web portal via my PC that's on a different subnet? I want to pass through the Host Machine and open the cuckoo web portal on my PC instead of having to remote into the host machine and opening it up there.

My PC (10.10.10.10) ---> Host Machine (10.20.20.20)---> Cuckoo VM (Web Portal) (192.168.30.100)

Any help would be great! Thanks!

Failed to bring up sandbox after a reload. Exiting.

The sandbox vm is created and does a few reboots. It says "Attempting to reload and reprovision the host..." and then after a bit says "Failed to bring up sandbox after a reload. Exiting."

I see errors in the logs related powershell from vagrant:
Stderr from the command:

At C:\tmp\vagrant-shell.ps1:8 char:20
+ fix_eth1_static_ip() {
+                    ~
An expression was expected after '('.
At C:\tmp\vagrant-shell.ps1:16 char:27
+ apt_install_prerequisites() {
+                           ~
An expression was expected after '('.
At C:\tmp\vagrant-shell.ps1:38 char:25
+ configure_prerequisites() {
+                         ~
An expression was expected after '('.
At C:\tmp\vagrant-shell.ps1:47 char:16
+ install_cuckoo() {
+                ~
An expression was expected after '('.
At C:\tmp\vagrant-shell.ps1:51 char:18
+ configure_cuckoo() {
+                  ~
An expression was expected after '('.
At C:\tmp\vagrant-shell.ps1:95 char:6
+ main() {
+      ~
An expression was expected after '('.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ExpectedExpression`

insert malware in the vm

I want to install malware in the vm for malware analysis.

vagrant upload malware.exe C:\Users\vagrant\desktop\malware.exe

raise an error including :

Errno::ECONNREFUSED

I suggest to add an argument in order to install some files such as tools or virus for malware analysis.

Let's insert this line: https://github.com/nbeede/BoomBox/blob/master/build.ps1#L214