Emulate virtual machines to avoid malware infections - GrrCON 2014
- 1. Emulate VM environment to avoid malware infections Jordi Vazquez
- 2. 2 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 3. 3 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 4. 4 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 5. 5 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 6. 6 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 7. 7 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 8. 8 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 9. 9 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 10. Who am I? Page 10 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 11. 11 1. Introduction / Motivation 2. Previous concepts 3. Virtual machine Detection 4. How malware detects VMs 5. Virtual machine emulation 6. Experimental results 7. Conclusions Agenda GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 12. 12 1. Introduction GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 13. Introduction Source: http://research.dissect.pe/docs/blackhat2012-presentation.pdf Page 13 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 14. Introduction If malware tries to avoid Virtual machines… 14 ! Why not try to emulate these environments to avoid infections? GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 15. Introduction The purposes 15 Study the characteristics of VirtualBox Specific drivers Registry keys Processes VirtualBox Guest Additions Files ! Know how the malware detects a virtual machine ! Try to replicate these configurations on a physical computer GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 16. 16 2. Previous Concepts GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 17. Previous Concepts What is Virtual Machine? Page 17 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 18. Previous Concepts What is Cuckoo Sandbox? Automated malware analysis tool Open Source Project Written in Python Extensible Reporting system (memory dumps, registry access, API calls, screenshots, network activity) Page 18 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 19. Previous Concepts What is Cuckoo Sandbox? (How It works) Page 19 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 20. 20 3. Virtual Machine Detection GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 21. Virtual Machine Detection Why? ! Malware researchers increasingly use virtual machine technology to analyze samples, since it offers many benefits: ! Multiple operating systems Ability to reset to a previous snapshot undoing changes made by malware Easily monitored Isolation ! Typical methods to detect a VME ! 1. Look for VME artifacts in processes, file system and registry 2. Look for VME specific virtual hardware 3. Look for VME specific processor capabilities Page 21 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 22. Virtual Machine Detection - VMWare Artifacts in processes, system files and registry Page 22 | GrrCON Hacker Conference | 16-17 Oct, 2014 VMWare tools Some references in system files to “VMWare” Some references in the registry to “VMWare” Some drivers: vmmouse.sys vmhgfs.sys
- 23. Virtual Machine Detection - Virtual Box 23 GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 24. Virtual Machine Detection - Virtual Box 24 VS GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 25. Specific files with VirtualBox Guest Additions System 32 Guest Additions Folder System32Drivers • VBoxDisp.dll • VBoxHook.dll • VBoxMRXNP.dll • VBoxOGLarrayspu.dll • VBoxOGLerrorspu.dll • VBoxOGLcrutil.dll • VBoxOGLerrorspu.dll • VBoxOGLfeedbackspu.dll • VBoxOGLpackspu.dll • VBoxoglpassthroughspu.dll • VBoxTray.exe • VBoxService.exe • VBoxControl.exe Page 25 | GrrCON Hacker Conference | 16-17 Oct, 2014 • VBoxDisp.dll • VBoxDrvInst.exe • VBoxVideo.inf • VBoxVideo.sys • VBoxControl.exe • VBoxGuest.sys • VBoxGuest.inf • VBoxMouse.sys • VBoxMouse.inf • VBoxTray.exe • VBoxWHQLFake.exe • DIFxAPI.dll • VBoxMouse.sys • VBoxGuest.sys • VBoxSF.sys • VBoxVideo.sys Virtual Machine Detection - Virtual Box
- 26. Specific files and processes with VirtualBox Guest Additions Installed DRVSTOREVBoxGuest_ED40339D75DAC80 DECCD6CCCDB8E202724F5321D Page 26 | GrrCON Hacker Conference | 16-17 Oct, 2014 DRVSTOREVBOXVideo_5C9060E4 72F2B1E3E9D5353B27AF6B8DABF99D47 Processes • VBoxControl.exe • VBoxGuest.cat • VBoxGuest.inf • VBoxGuest.sys • VBoxTray.exe • VBoxDisp.dll • VBoxVideo.inf • VBoxVideo.sys • VBoxVideo.cat • VboxService.exe Virtual Machine Detection - Virtual Box
- 27. Virtual Machine Detection - Virtual Box Folder Key Type Value HKLMSoftwareOracleVirtualBox Guest Additions InstallDir REG_SZ Guest Additions folder 27 Revision REG_SZ Revision number Version REG_SZ Version number VersionExt REG_SZ Version number HKLMHardwareDEVICEMAPScsiScsi Port 0ScSi Bus 0Target Id 0Logical Unit Id 0 Identifier REG_SZ VBOX HARDDISK HKLMHardwareDEVICEMAPScsiScsi Port 0ScSi Bus 0Target Id 1Logical Unit Id 0 Identifier REG_SZ VBOX CD-ROM HKLMHardwareDESCRIPTIONSystem SystemBiosVersion REG_MULTI_SZ VBOX -1 VideoBiosVersion REG_MULTI_SZ Oracle VM VirtualBox Version (version number) HKLMHardwareAcpiDSDTVBOX__VBOXBIOS 00000002 00000000 REG_BINARY DSDT......VBOX VBOXBIOS....INTL Specific registry keys GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 28. Virtual Machine Detection - Virtual Box Folder Key Type Value HKLMSystemCurrentControlSetServicesDiskEnum 0 REG_SZ IDE 28 DiskVBOX_HARDDISK________________ ___________1.0_____ 42566264366366323661362d32656239 39632031 HKLMSystemCurrentControlSetServicesVBoxGuest DisplayName REG_SZ VirtualBox Guest Driver ImagePath REG_EXPAND_SZ system32DRIVERSVBoxGuest.sys HKLMSystemCurrentControlSetServicesVBoxGuest Enum 0 REG_SZ PCI VEN_80EE&DEV_CAFE&SUBSYS_00000 000&REV_003&267a616a&0&20 HKLMSystemCurrentControlSetServicesVBoxMouse DisplayName REG_SZ VirtualBox Guest Mouse Service ImagePath REG_EXPAND_SZ system32DRIVERSVBoxMouse.sys HKLMSystemCurrentControlSetServicesVBoxMouse Enum 0 REG_SZ ACPIPNP0F034&1d401fb5&0 Specific registry keys *These keys are in ControlSet001, ControlSet002 and CurrentControlSet folders GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 29. Virtual Machine Detection - Virtual Box Folder Key Type Value HKLMSystemCurrentControlSetEnumIde DiskVBOX_HARDDISK4256636463663 29 FriendlyName REG_SZ VBOX HARDDISK HKLMSystemCurrentControlSetEnumIde DiskVBOX_HARDDISK9257936463871 FriendlyName REG_SZ VBOX CD-ROM HKLMSystemCurrentControlSetServices VBoxService DisplayName REG_SZ VirtualBox Guest Aditions Service ImagePath REG_EXPAND_SZ system32VBoxService.exe Description REG_SZ Manages VM runtime information and utilities for guest operating systems. ObjectName REG_SZ LocalSystem HKLMSystemCurrentControlSetServices VBoxServiceEnum 0 REG_SZ RootLEGACY_VBOXSERVICE 0000 HKLMSystemCurrentControlSetServicesVBoxSF DisplayName REG_SZ VirtualBox Shared Folders ImagePath REG_EXPAND_SZ system32DRIVERSVBoxSF.sys Specific registry keys GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 30. Virtual Machine Detection - Virtual Box Folder Key Type Value HKLMSystemCurrentControlSetServices VBoxSFEnum 30 0 REG_SZ RootLEGACY_VBOXSF0000 HKLMSystemCurrentControlSetServices VBoxSFNetworkProvider DeviceName REG_SZ DeviceVboxMinRdr Name REG_SZ VirtualBox Shared Folder ProviderPath REG_SZ %Systemroot% System32VBoxMRXNP.dll HKLMSystemCurrentControlSetServices VBoxVideo ImagePath REG_EXPAND_SZ system32DRIVERSVBoxVideo.sys HKLMSystemCurrentControlSetServices VBoxVideoDevice0 InstalledDisplayDrivers REG_MULTI_SZ VBoxDisp HKLMSystemCurrentControlSetServices VBoxVideoEnum 0 REG_SZ PCI VEN_80EE&DEV_BEEF&SUBSYS_ 00000000&REV_003&267a616a& 0&10 HKLMSystemCurrentControlSetServices VBoxVideoVideo Service REG_SZ Vbox Video Specific registry keys GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 31. Virtual Machine Detection - Virtual Box Specific registry keys Page 31 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 32. Virtual Machine Detection - Virtual Box Example Source: http://pastebin.com/RU6A2UuB Page 32 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 33. Virtual Machine Detection - Virtual Box Example <Demo> Source: http://pastebin.com/RU6A2UuB Page 33 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 34. Virtual Machine Detection - Virtual Box Themida Page 34 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 35. Virtual Machine Detection - Virtual Box Themida <Demo> Page 35 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 36. Virtual Machine Detection - Virtual Box Physical Machine Virtual Machine 36 Pafish GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 37. 4. How malware detects Virtual Machines Page 37 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 38. How malware detects Virtual Machines Trojan-spy.win32.Carberp Source: http://github.com/hzeroo/Carberp/blob/master/source - absource/pro/all source/BlackJoeWhiteJoe/Source Page 38 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 39. How malware detects Virtual Machines Trojan-Dropper.Win32.Agent.dvyh Technical Details about Net-Worm.Win32.Kolab.wwh: https://www.securelist.com/en/descriptions/17168948/Trojan-Dropper.Win32.Agent.dvyh Page 39 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 40. How malware detects Virtual Machines Net-Worm.Win32.Kolab.wwh Technical Details about Net-Worm.Win32.Kolab.wwh: http://www.securelist.com/en/descriptions/10113051/Net-Worm.Win32.Kolab.wwh Page 40 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 41. How malware detects Virtual Machines Net-Worm.Win32.Kolab.wwh Technical Details about Net-Worm.Win32.Kolab.wwh: http://www.securelist.com/en/descriptions/10113051/Net-Worm.Win32.Kolab.wwh Page 41 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 42. How malware detects Virtual Machines Net-Worm.Win32.Kolab.wwh Technical Details about Net-Worm.Win32.Kolab.wwh: http://www.securelist.com/en/descriptions/10113051/Net-Worm.Win32.Kolab.wwh Page 42 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 43. 43 5. Virtual Machine emulation GrrCON Page | Hacker Conference | 16-17 Oct, 2014
- 44. Conclusions Main findings and future lines of research Main findings It’s possible to simulate a virtual machine with a python script. We can avoid infections by unknown malware. ! ! Future lines of research Investigate more VM Solutions and Sandboxes. (VmWare, Sandboxie…) Try the script with more malware samples. Investigate possible side-effects in a real environment. Page 44 | GrrCON Hacker Conference | 16-17 Oct, 2014
- 45. Thank you! https://github.com/jordisk ! Jordi@jordivazquez.com @jordisk
- 46. https://github.! com/jordisk Jordi@jordivazquez.com @jordisk
- 47. https://github.! com/jordisk Jordi@jordivazquez.com @jordisk
- 48. https://github.! com/jordisk Jordi@jordivazquez.com @jordisk
- 49. Thank you! https://github.com/jordisk ! Jordi@jordivazquez.com @jordisk