From 86594f12a2fd39f97eef3e84ebb7cedd071dace9 Mon Sep 17 00:00:00 2001 From: ryan Date: Thu, 20 Oct 2022 13:51:21 -0400 Subject: [PATCH] Link --- anti-behavioral-analysis/sandbox-detection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index df43ecb..3da7a7b 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -39,7 +39,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.| |**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.| -|**Product Key/ID Testing**|[B0007.005](./b0007.005.md)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| +**Product Key/ID Testing**|[B0007.005](#b0007005)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.| |**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.| |**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.| @@ -72,8 +72,9 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t ## Code Snippets +### B0007.005
- Sandbox Detection::Product Key/ID Testing (B0007.005) + Sandbox Detection::Product Key/ID Testing 
 asm
 push    ebx