anti vm

ori: https://www.cyberbit.com/anti-vm-and-anti-sandbox-explained/




1. Checking CPU Instructions: 
The result of the following instructions with specific input can help malware identify virtual environments:

• CPUID: This instruction is executed with EAX=1 as input, the return value describes the processors features. The 31^st bit of ECX on a physical machine will be equal to 0. On a guest VM it will equal to 1.

• “Hypervisor brand”: by calling CPUID with EAX=40000000 as input,1 the malware will get, as the return value, the virtualization vendor string in EAX, ECX, EDX.
  For example:
  
  • Microsoft: “Microsoft HV”
  • VMware : “VMwareVMware”

• MMX: an Intel instruction set, designed for faster processing of graphical applications. These are usually not supported in Virtual Machines so their absence may indicate that the malware is running in a VM.
  For example:

• IN – “VMWare Magic Number”: this technique is useful for detecting a VMware environment. In VMWare, communication with the host is done through a specific I/O port. The code below will execute successfully if running inside a VM. Otherwise it will fail.

2. Checking for Known Mac Addresses: 
Prefixes of MAC addresses indicate the network adapter’s vendor. The MAC address can be retrieved in multiple ways, including the using of WMIC (wmic -> nic list)

• 00:05:69 (Vmware)
• 00:0C:29 (Vmware)
• 00:1C:14 (Vmware)
• 00:50:56 (Vmware)
• 08:00:27 (VirtualBox)

3. Checking for Registry Keys 
The existence of the following registry entries indicates the existence of virtualization software:

• HKLM\SOFTWARE\Vmware Inc.\\\Vmware Tools
• HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
• SYSTEM\CurrentControlSet\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S
• SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#vmwvmcihostdev
• SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers

4. Checking for Processes Indicating a VM
Any of the following processes may indicate a virtual environment. Malware can retrieve this info in multiple ways like: WMIC, Win API and CMD. WMIC (wmic -> process list), Win API (Process32First, Process32Next), and Tasklist.exe.

• Vmware
  • Vmtoolsd.exe
  • Vmwaretrat.exe
  • Vmwareuser.exe
  • Vmacthlp.exe
• VirtualBox
  • vboxservice.exe
  • vboxtray.exe

5. Checking for Existence of Files Indicating a VM 
When these files are found to exist in the file system, this may indicate the existence of virtualization software. These can also be retrieved in multiple ways like: WMIC, Win API and CMD.

• VMware

C:\windows\System32\Drivers\Vmmouse.sys
C:\windows\System32\Drivers\vm3dgl.dll
C:\windows\System32\Drivers\vmdum.dll
C:\windows\System32\Drivers\vm3dver.dll
C:\windows\System32\Drivers\vmtray.dll
C:\windows\System32\Drivers\VMToolsHook.dll
C:\windows\System32\Drivers\vmmousever.dll
C:\windows\System32\Drivers\vmhgfs.dll
C:\windows\System32\Drivers\vmGuestLib.dll
C:\windows\System32\Drivers\VmGuestLibJava.dll
C:\windows\System32\Driversvmhgfs.dll

• VirtualBox

C:\windows\System32\Drivers\VBoxMouse.sys
C:\windows\System32\Drivers\VBoxGuest.sys
C:\windows\System32\Drivers\VBoxSF.sys
C:\windows\System32\Drivers\VBoxVideo.sys
C:\windows\System32\vboxdisp.dll
C:\windows\System32\vboxhook.dll
C:\windows\System32\vboxmrxnp.dll
C:\windows\System32\vboxogl.dll
C:\windows\System32\vboxoglarrayspu.dll
C:\windows\System32\vboxoglcrutil.dll
C:\windows\System32\vboxoglerrorspu.dll
C:\windows\System32\vboxoglfeedbackspu.dll
C:\windows\System32\vboxoglpackspu.dll
C:\windows\System32\vboxoglpassthroughspu.dll
C:\windows\System32\vboxservice.exe
C:\windows\System32\vboxtray.exe
C:\windows\System32\VBoxControl.exe
6. Checking for Running Services
Identifying whether one the following processes is running indicates a virtual environment.
These can also be retrieved in multiple ways WMIC, Win API and CMD
(wmic -> Service list, sc.exe /query) 

• VMTools
• Vmhgfs
• VMMEMCTL
• Vmmouse
• Vmrawdsk
• Vmusbmouse
• Vmvss
• Vmscsi
• Vmxnet
• vmx_svga
• Vmware Tools
• Vmware Physical Disk Helper Service

mata api

mandian: 46% incedent , tiada malware di install.

100% attack, curi credential


Attack lifecylce:
-Initial Recon
-Initial Compromise(laptop, end user device)
-Establish Foothold
-Escalate Privileges
-Internal Recon
-Complete Mission(data theft) (disini baru ada bussiness impact.)

Prevention:
-Malware problem
-Endpoint EPP
-Tactical Intellgigence
-MSSP

Detection Breach
-First Atack, usually malware, tapi lepas breach, human attacker.
- Endpont Detection and Response(EDR)
- Operational Threat Intellignence
-MDR, Manage Detection and REsponse




Fin7
mimikatz
gizmodo
doubleagent

miniFlame

Once installed, MiniFlame operates as a backdoor and enables the malware operators to obtain any file from an infected machine, according to research from Kaspersky Lab.

The malware can also capture screenshots from infected PCs when people use a

• specified application, 
• IM service, or 
• FTP client, or 

send data to a C&C server.

"Separately, at the request from MiniFlame's C&C operator, an additional data-stealing module can be sent to an infected system, which infects USB drives and uses them to store data that's collected from infected machines without an Internet connection," said Kaspersky Lab.

To recap the malware family tree: Flame was discovered in May 2012. It was initially dismissed by some security researchers as bloatware, in part because of the application's size--20 MB with all modules installed, versus an average of up to 1 MB for most other malware. But ongoing analysis of Flame yielded numerous surprises, including its designers having tapped world-class crypto to imbue the malware with the ability to spoof Windows Update and automatically install itself on targeted computers.

Relation on Flame and Gauss
MiniFlame's ability to be used as a plug-in by either Flame or Gauss clearly connects the collaboration between the development teams of both Flame and Gauss," according to Kaspersky Lab's research. "Since the connection between Flame and Stuxnet/Duqu has already been revealed, it can be concluded that all these advanced threats come from the same 'cyber warfare' factory."



ref> http://www.informationweek.com/security/vulnerabilities/meet-flame-espionage-malware-cousin-mini/240009131