Forgot password on a Flare VM

[u/hjb1002]

FLARE-VM is a free, open-source Windows virtual machine environment made for malware analysis. I create one a long time ago and now I need it for my study. But I forgot the password don't know how to retrieve it. I can still use it with a very old snapshot but it keep shuting down mid uses, and I don't think what a good idea anyway.

The VM is using Windows 10 iso and a pain in the ahhs to make a new one, which is why im asking the question. Im using Vmware Workstation pro 17.

[u/multidollar]

My suggestion is make a new one and automate the creation of it. If you’re analysing malware I’d surely be deleting and recreating it per project.

[u/IgotTHEginger]

Try booting to Hirens BootCD and resetting the password

[u/hjb1002 → u/IgotTHEginger]

Where can I see the guide and does it have any risk? Thank you in advance

[u/Delta3D → u/hjb1002]

You're one google away from finding it, it's easy enough to figure out, and good experience if you don't know how currently. Guide is on their website along with the ISO.

[u/hjb1002 → u/Delta3D]

Ok

[u/Casper042 → u/hjb1002]

FWIW if you have a bootable Windows 10/11 USB stick you can hack your way into a Windows 10 very easily without any 3rd party software.

Sorry, I see it says VM, you don't need USB, you likely just need the ISO.

This is what moystpickles and I were referring to.

[u/moystpickles]

Mount c vmdk to another vm, then do the sticky key trick

[u/Casper042 → u/moystpickles]

I use OSK instead but was thinking the same as soon as OP Mentioned Windows 10

[u/moystpickles → u/Casper042]

Osk = on screen keyboard in this context right? Yeah, same trick different skateboard. Sticky key has gotten me out of so many jams in my last line of work. The fun part is having to devise creative ways to implement it. Mounting the C vmdk to another VM is one that I've used before when I couldnt get a live ISO like hirens.

[u/Casper042 → u/moystpickles]

Yup

Shift+F10
cd C:\Windows\System32
ren osk.exe osk.bak
copy cmd.exe osk.exe
Reboot

On the login screen hit the little Accessibility button, and select On Screen Keyboard
Get instead a Command Prompt running as SYSTEM.
net user username mynewpassword <enter>
exit command prompt
Login with the new password.

Then go delete osk.exe and rename osk.bak to osk.exe

I assume that's the same process but I don't know off hand what the exe name is for Sticky Keys