This script is designed to automate the configuration of a clean Windows 11 installation into a malware analysis environment. It streamlines the removal of security features and the installation of essential tooling.
It is recommended that this script is used alongside an optomised, "de-bloated" Windows image, such as Windows X-Lite or use Tiny11 Builder.
You MUST manually disable Tamper Protection before running this script. Windows prevents scripts and registry changes from disabling Defender if Tamper Protection is active.
- Open Windows Security.
- Go to Virus & threat protection > Manage settings.
- Switch Tamper Protection to Off.
- Operating System: Windows 10 or 11 (Clean installation preferred).
- Environment: Virtual Machine ONLY. Do not run this on your host machine.
- Network: Active Internet connection is required during execution to download Scoop and the analysis tools.
- Administrator Privileges: The script must be executed in a PowerShell terminal with "Run as Administrator" rights.
- Execution Policy: You must allow the execution of unsigned scripts for the duration of the setup.
- Open PowerShell as Administrator.
- Bypass Execution Policy to allow the script to run:
Set-ExecutionPolicy Bypass -Scope Process -Force
- Run the Ignition Script:
.\MalwareLab_Ignition.ps1
- Reboot the System: After the script completes, a reboot is mandatory to fully disable the Windows Defender services and finalise the configuration.
The script utilises Scoop and manual downloads to install portable versions of the following tools:
| Category | Tools Included |
|---|---|
| Static Analysis | Capa, Ghidra, Floss, IDA Free, PE-bear, PEStudio, Resource Hacker, vBinDiff, Detect It Easy (DIE) |
| .NET & Shellcode | dnSpyEx (dnSpy), scdbg |
| Dynamic Analysis | x64dbg, Wireshark, System Informer, Sysinternals Suite, Regshot, FakeNet-NG |
| Malicious Documents | LibreOffice, oletools, pcodedmp, PDFiD, pdf-parser |
| Utilities & Detection | Google Chrome, CyberChef, HxD, HashMyFiles, 7-Zip, Yara, Graphviz, OpenVPN |
All tools are linked in a MalwareTools folder created automatically on your Desktop.