Dropdown prototype

anti-behavioral-analysis/sandbox-detection.md

@@ -25,14 +25,14 @@
 </tr>
 </table>
 
-Sandbox Detection
-=================
+# Sandbox Detection
+
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
 
 The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.
  
-Methods
--------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
@@ -47,19 +47,19 @@ Methods
 |**Test API Routines**|B0007.010|Calls Windows API routines with invalid arguments to identify error supression.|
 
 
-<a name="examples"></a>Use in Malware
---------------
+## Use in Malware
+
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|B0007.005|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|[[2]](#2)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[2]](#2)|
 |[**Terminator**](../xample-malware/terminator.md)|2013|--|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif uses malware macros to evade sandbox detection.|
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[6]](#6)|
 
-Detection
----------
+## Detection
+
 |Tool: capa|Mapping|APIs|
 |---|---|---|
 |[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)|CreateFile|
@@ -70,12 +70,43 @@ Detection
 |[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
 |[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
 
-<a name="snippet"></a>Code Snippets
--------------
-[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md#snippet) 
+## Code Snippets
+
+<details>
+<summary> Sandbox Detection::Product Key/ID Testing (B0007.005)</summary>
+<pre>
+asm
+push    ebx
+add     esp, 0FFFFFEF4h
+xor     ebx, ebx
+push    esp             ; phkResult
+push    1               ; samDesired
+push    0               ; ulOptions
+push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
+push    80000002h       ; hKey
+call    RegOpenKeyExA
+test    eax, eax
+jnz     short loc_405387
+mov     [esp+110h+cbData], 101h
+lea     eax, [esp+110h+cbData]
+push    eax             ; lpcbData
+lea     eax, [esp+114h+Data]
+push    eax             ; lpData
+push    0               ; lpType 
+push    0               ; lpReserved
+push    offset ValueName ; "ProductId"
+mov     eax, [esp+124h+hKey]
+push    eax             ; hKey
+call    RegQueryValueExA
+lea     eax, [esp+110h+Data]
+cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
+jnz     short loc_405387
+mov     bl, 1
+</pre>
+</details>
+
+## References
 
-References
-----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
  
 <a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik