Procedure examples

H1N1 disable recovery options and deletes shadow copies from the victim.

BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.

RansomHub has placed a ransom note on comrpomised systems to warn victims and provide directions for how to retrieve data.

ShrinkLocker renames disk labels on victim hosts to the threat actor's email address to enable the victim to contact the threat actor for ransom negotiation.

SameCoin can alter the victim’s background to display an image showing the name of Hamas’s military wing.

After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".

BlackCat can change the desktop wallpaper on compromised hosts.

Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.

ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.

Meteor can change both the desktop wallpaper and the lock screen image to a custom image.

Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.

INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

Remcos has the ability to modify the desktop wallpaper.

TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.

Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.

Hildegard has used xmrig to mine cryptocurrency.

Skidmap is a kernel-mode rootkit used for cryptocurrency mining.

Bonadan can download an additional module which has a cryptocurrency mining extension.

Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.

DarkGate can deploy follow-on cryptocurrency mining payloads.

Kinsing has created and run a Bitcoin cryptocurrency miner.

CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.

LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.

Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.

Bumblebee has the ability to perform anti-virtualization checks.

Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.

Raspberry Robin contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.

IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.

Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Bisonal can check to determine if the compromised system is running on VMware.

Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.

Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.

StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.

RTM can detect if it is running within a sandbox or other virtualized analysis environment.

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.

Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.

XLoader can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.

Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.

Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.

Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.

Kevin can sleep for a time interval between C2 communication attempts.

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.

Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.

Gelsemium can use junk code to generate random activity to obscure malware behavior.

Mini Shai-Hulud has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.

Pikabot performs a variety of system checks to determine if it is running in an analysis environment or sandbox, such as checking the number of processors (must be greater than two), and the amount of RAM (must be greater than 2GB).

SynAck checks its directory location in an attempt to avoid launching in a sandbox.

Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.