I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.
Rather than standing up my own AD controller and fake domain every time I want to test with a different domain name, I was hoping to write a PowerShell script to fake information on the local system to look like it was joined to an arbitrary domain.
I tried editing the registry values in
HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, but the system still showed as a workgroup system.
Is there any way to make Windows (and therefore Windows malware) think it's a member of a domain, without actually joining a domain?