admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

update methods

Browse Source
This commit is contained in:
Desiree Beck
2020-01-14 19:51:37 -05:00
parent 7c8c81d26c
commit 9e702a18dc
1 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/detect-vm.md
+24 -24
View File
@@ -21,36 +21,36 @@ Methods
* **Check Running Services**: VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)
* **Check Virtual Devices**: The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)
* **Check Windows**: Malware may check windows for VM-related characteristics such as:
* Window size: tiny window size may indicate a VM.
* Unique windows: may check for the presence of known windows from analysis tools running in a VM.
* Title bars: may inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.
* *Window size*: tiny window size may indicate a VM.
* *Unique windows*: may check for the presence of known windows from analysis tools running in a VM.
* *Title bars*: may inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.
* **Guest Process Testing**: Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.
* **HTML5 Performance Object Check**: In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.
* **Human User Check**: Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5).
* **Modern Specs Check**: Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment:
* Total physical memory: most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).
* Drive size: most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).
* USB drive: checks whether there is a potential USB drive; if not a virtual environment is suspected.
* Printer: checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.
* Processor count: checks number of processors; single CPU machines are suspect.
* Keyboard layout
* Software: checks whether software is relatively current.
* *Total physical memory*: most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).
* *Drive size*: most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).
* *USB drive*: checks whether there is a potential USB drive; if not a virtual environment is suspected.
* *Printer*: checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.
* *Processor count*: checks number of processors; single CPU machines are suspect.
* *Keyboard layout*
* *Software*: checks whether software is relatively current.
* **Unique Hardware/Firmware Check**: Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:
* BIOS: characteristics of the BIOS, such as version, can indicate virtualization.
* I/O Communication Port: VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.
* CPU Name
* CPU Location: When an Operating System is virtualized, the CPU is relocated. [[2]](#2)
* MAC Address: VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)
* *BIOS*: characteristics of the BIOS, such as version, can indicate virtualization.
* *I/O Communication Port*: VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.
* *CPU Name*
* *CPU Location*: When an Operating System is virtualized, the CPU is relocated. [[2]](#2)
* *MAC Address*: VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)
* **x86 Instruction Testing**: The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)
* SIDT (red pill): Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.
* SGDT/SLDT (no pill): The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
* SMSW
* STR
* CPUID: Checking the CPU ID found within the registry can provide information to system type.
* IN
* RDTSC
* VMCPUID
* VPCEXT
* *SIDT (red pill)*: Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.
* *SGDT/SLDT (no pill)*: The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
* *SMSW*
* *STR*
* *CPUID*: Checking the CPU ID found within the registry can provide information to system type.
* *IN*
* *RDTSC*
* *VMCPUID*
* *VPCEXT*
Malware Examples
----------------