Projects
Malware Analysis Lab
A hands-on lab for analyzing malware samples, tracking behavior, and documenting detection opportunities.
Lab
Mar 2026
Building a CAPE malware analysis server with Proxmox
I set up a CAPE malware analysis server (fork of cuckoo) inside Proxmox so that I could spin up a Windows virtual machine, execute malware safely, and then wipe it back to a clean slate.
Every sample runs inside the VM while CAPE captures behaviour, network activity, and system changes, it then generates a detailed report summarising indicators, captured files, and API calls observed during execution.
The lab workflow focuses on safe, repeatable analysis: deploy an isolated VM, run a sample, collect CAPE output, then reset the environment before the next run. The resulting reports are invaluable for people who build detection rules and improving incident response playbooks.
Beyond reporting, the lab helps prioritise detection opportunities by showing how malware behaves in practice, which signals are reliable, which are noisy, and where defensive coverage can be improved.
I plan to continue building and refining this lab as more free time becomes available to me.
Short Version:
- Deployed CAPE on Proxmox to orchestrate analysis VMs and isolate samples.
- Used a disposable Windows VM for execution and environment resets.
- Generated CAPE reports highlighting file, registry, process, and network activity.