Sub-technique of T1497 Virtualization/Sandbox Evasion.View on attack.mitre.org
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Windows Management Instrumentation, PowerShell, System Information Discovery, and Query Registry to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment.
Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Once executed, malware may also use File and Directory Discovery to check if it was saved in a folder or file with unexpected or even analysis-related naming artifacts such as `malware`, `sample`, or `hash`.
Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions. In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output.
Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.
Rules on DetectionCode tagged with T1497.001.
| Rule | Level | Log source |
|---|---|---|
| Powershell Detect Virtualization Environment | medium | windows / ps_script |
| System Information Discovery Using System_Profiler | medium | macos / process_creation |
| System Information Discovery Via Sysctl - MacOS | medium | macos / process_creation |
| Used by | Procedure example |
|---|---|
| GroupDarkhotel | Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with |
| GroupEvilnum | Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments. |
| GroupGamaredon Group | Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document. |
| GroupKimsuky | Kimsuky has detected and killed virtual environments by using the PowerShell cmdlet `Get-CimInstance` that searches the classname of the computer system manufacturer through an if statement of `if($computerSystem.Manufacturer -match "VMware" -or $computerSystem.Manufacturer -match "Microsoft" -or $computerSystem.Manufacturer -match "VirtualBox")`. |
| GroupOilRig | OilRig has used macros to verify if a mouse is connected to a compromised machine. |
| GroupVolt Typhoon | Volt Typhoon has run system checks to determine if they were operating in a virtualized environment. |
| GroupWIRTE | WIRTE has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments. |
| Used by | Procedure example |
|---|---|
| MalwareAstaroth | Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments. |
| ToolAsyncRAT | AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments. |
| MalwareAttor | Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions. |
| MalwareBadPatch | BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information. |
| MalwareBlack Basta | Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing. |
| MalwareBlackByte Ransomware | BlackByte Ransomware checks for files related to known sandboxes. |
| MalwareBLUELIGHT | BLUELIGHT can check to see if the infected machine has VM tools running. |
| MalwareBumblebee | Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products. |
| Used by | Procedure example |
|---|---|
| CampaignFrankenstein | During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution. |
| CampaignOperation Dream Job | During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
