Build an Isolated Malware Analysis Lab on Windows 11 with Hyper-V

What You Are Building

A Windows 11 virtual machine that can be infected deliberately, examined, and reverted to a clean state in seconds — with no network path to your real machine, your home network, or the internet.

Every other lab on this site that involves running something hostile assumes this environment exists. Build it once.

The design choices that matter:

• Internal-only virtual switch. Not "Default Switch", which has internet access through NAT. Internal-only means the VM can reach other VMs on the same switch and nothing else.
• Checkpoints, not reinstalls. Snapshot the clean state and roll back after each sample.
• No Enhanced Session, no shared folders, no clipboard sharing. Every convenience feature is a path between the VM and your host.

Before You Start: The Honest Warnings

Virtual machine escapes are rare but they are real. A VM is strong isolation, not perfect isolation. If you are handling something you believe is targeted or novel, use hardware you can wipe, on a network segment you control.

Do not enable internet access in this VM because a sample "needs" it. A sample that needs the internet needs it to talk to somebody, and giving it your home IP address is giving away information you cannot take back.

Step 1: Enable Hyper-V on the host

Check you are on an edition that supports it — Hyper-V is not available on Windows 11 Home.

From an elevated PowerShell prompt:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

Reboot when prompted. If the command fails, virtualisation is disabled in UEFI — reboot into firmware settings and enable Intel VT-x or AMD-V (often labelled SVM Mode).

Confirm afterwards:

Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V | Select-Object State

Step 2: Create an internal-only virtual switch

This is the step that makes the lab safe, so do it before the VM exists — a VM created first will default to a connected switch.

New-VMSwitch -Name "LabIsolated" -SwitchType Internal

Internal creates a switch that connects VMs to each other and to a virtual adapter on the host, but not to your physical network. Do not use External (bridges to your real network) and do not use the built-in "Default Switch" (NAT with internet access).

Now remove the host's route onto that switch, so even the host-to-VM path is closed:

Get-NetAdapter -Name "vEthernet (LabIsolated)" | Disable-NetAdapter -Confirm:$false

Re-enable it only when you deliberately need host-to-VM connectivity, and disable it again afterwards.

Step 3: Create the virtual machine

New-VM -Name "Win11-Analysis" `
  -MemoryStartupBytes 4GB `
  -Generation 2 `
  -NewVHDPath "D:\VMs\Win11-Analysis.vhdx" `
  -NewVHDSizeBytes 60GB `
  -SwitchName "LabIsolated"

Generation 2 gives you UEFI and Secure Boot, which Windows 11 requires. Then attach the ISO and configure the security settings Windows 11 needs:

Add-VMDvdDrive -VMName "Win11-Analysis" -Path "D:\ISO\Win11.iso"
Set-VMFirmware -VMName "Win11-Analysis" -EnableSecureBoot On
Set-VMKeyProtector -VMName "Win11-Analysis" -NewLocalKeyProtector
Enable-VMTPM -VMName "Win11-Analysis"
Set-VMProcessor -VMName "Win11-Analysis" -Count 2

Set the boot order to the DVD, then start it:

$dvd = Get-VMDvdDrive -VMName "Win11-Analysis"
Set-VMFirmware -VMName "Win11-Analysis" -FirstBootDevice $dvd
Start-VM -Name "Win11-Analysis"

Step 4: Install Windows without a network

Windows 11 Setup will ask for a network connection and try to require a Microsoft account. Since this VM has no internet, use the offline path: at the network screen press Shift + F10 to open a command prompt, run OOBE\BYPASSNRO, and let the machine restart. The setup then offers "I don't have internet" and lets you create a local account.

Use a local account with a simple password. This machine is disposable and never touches anything real.

Step 5: Turn off the features that are doorways

Inside the VM, after installation:

• Disable Enhanced Session Mode for this VM on the host: Set-VM -VMName "Win11-Analysis" -EnhancedSessionTransportType HvSocket then turn Enhanced Session off in the VM's connection window. Enhanced Session enables clipboard and drive redirection — exactly what you do not want.
• Do not install Integration Services beyond the defaults, and do not enable Guest Services (which allows file copy to the VM).
• Do not add shared folders. Move files in via a VHDX you attach and detach deliberately, or via the ISO drive.

Step 6: Install the analysis tooling

Download everything on your host, put it on a small VHDX, and attach that to the VM. A reasonable starting set:

• Sysinternals Suite — Process Explorer, Process Monitor, Autoruns, TCPView
• Sysmon, with a config (see the note below)
• Eric Zimmerman's tools — PECmd, AmcacheParser, AppCompatCacheParser, MFTECmd, Timeline Explorer
• A text editor and a hex editor

Install Sysmon with logging that will actually show you something:

sysmon64.exe -accepteula -i sysmonconfig.xml

Do not run Sysmon with no config — the default is extremely noisy and will bury the events you care about.

Step 7: Take the clean checkpoint

This is the step that makes the lab reusable. With the VM fully configured and shut down cleanly:

Checkpoint-VM -Name "Win11-Analysis" -SnapshotName "Clean-Baseline"

After every sample, revert:

Restore-VMCheckpoint -VMName "Win11-Analysis" -Name "Clean-Baseline" -Confirm:$false

Take a second checkpoint named Clean-Baseline-Instrumented after Sysmon and tooling are running, so you can roll back to a monitored state rather than reinstalling the tools each time.

Step 8: Verify the isolation before you trust it

Do not skip this. Inside the VM:

ping 8.8.8.8
ping <your host's LAN IP>

Both must fail. Test-NetConnection -ComputerName 8.8.8.8 -Port 443 must also fail. If either succeeds, you are on the wrong switch — recheck Step 2 and confirm the VM's adapter is bound to LabIsolated.

Only after both fail is the lab ready.

Working In It

Revert to the clean checkpoint before each sample, not after. Reverting after leaves the machine dirty for however long until you next remember.

Keep notes outside the VM. Anything you write inside disappears on the next rollback.

When you need two machines — a target and an attacker box — create the second VM on the same LabIsolated switch. They will see each other and nothing else, which is exactly the topology the technique labs assume.

Related

• Windows 11 forensic artifacts overview — what to look at once something has run
• Scheduled task persistence: the attack and its artifacts — the first lab that uses this environment

FAQ

Can I do this on Windows 11 Home?

Not with Hyper-V — the role is not available on Home. The practical alternatives are VirtualBox or VMware Workstation Player, both free, both able to create a host-only or internal network with no internet route. The isolation principles in this article apply unchanged; only the commands differ.

Is a virtual machine safe enough for real malware?

For commodity malware, yes, provided the network is genuinely isolated and you have not enabled shared folders, clipboard sharing, or Guest Services. VM escape vulnerabilities exist and are occasionally exploited, so a VM is strong isolation rather than absolute isolation. For anything you believe is targeted or novel, use dedicated hardware on a network you can burn.

Why not use the Default Switch?

The Default Switch provides NAT with full internet access. A sample running behind it can reach its command-and-control infrastructure, exfiltrate whatever it found, and identify your home IP address. An Internal switch has no route off the host, which is the entire point.

How much RAM and disk does the VM need?

4 GB RAM and 60 GB disk is comfortable for a Windows 11 analysis VM. You can run at 2 GB, but Windows 11 is unpleasant there and some tooling struggles. Use a dynamically expanding VHDX so the file only grows to what is actually used, and keep checkpoints in mind — each one consumes additional space.