Emulate virtual machines To avoid malware infections

Transcription

1 Emulate virtual machines To avoid malware infections Jordi Vázquez Aira Institut Obert of Catalonia (Barcelona, Spain) PAGE 1

2 Introduction The premise & Purposes The premise: If malware tries to avoid Virtual machines Why not try to emulate these environments? Purposes! Study the characteristics of VirtualBox! Specific drivers! Registry keys! VirtualBox Guest Additions Files! Know how the malware detects a virtual machine environment! Try to replicate these configurations on a physical computer PAGE 2

3 How does malware detect Virtual Machine? - Differences between Virtual machines and physical computers - Examples PAGE 3

4 Differences between VMs and physical computers Specific files with VirtualBox Guest Additions System32 VBoxDisp.dll VBoxHook.dll VBoxMRXNP.dll VBoxOGLarrayspu.dll VBoxOGLcrutil.dll VBoxOGLerrorspu.dll VBoxOGLfeedbackspu.dll VBoxOGLpackspu.dll VBoxoglpassthroughspu.dll VBoxTray.exe VBoxService.exe VBoxControl.exe Guest Additions folder VBoxDisp.dll VBoxDrvInst.exe VBoxVideo.inf VBoxVideo.sys VBoxControl.exe VBoxGuest.sys VBoxGuest.inf VBoxMouse.sys VBoxMouse.inf VBoxTray.exe VBoxWHQLFake.exe DIFxAPI.dll System32\Drivers VBoxMouse.sys VBoxGuest.sys VBoxSF.sys VBoxVideo.sys PAGE 4

5 Differences between VMs and physical computers Specific files with VirtualBox Guest Additions DRVSTORE\VBoxGuest_ED40339D 75DAC80DECCD6CCCDB8E202724F5321D VBoxControl.exe VBoxGuest.cat VBoxGuest.inf VBoxGuest.sys VBoxTray.exe DRVSTORE\VBOXVideo_5C9060E4 72F2B1E3E9D5353B27AF6B8DABF99D47 VBoxDisp.dll VBoxVideo.inf VBoxVideo.sys VBoxVideo.cat PAGE 5

6 Differences between VMs and physical computers Specific registry keys Folder Key Type Value HKLM\Software\Oracle\VirtualBox Guest Additions HKLM\Hardware\DEVICEMAP\Scsi\Scsi Port 0\ScSi Bus 0\Target Id 0\Logical Unit Id 0 HKLM\Hardware\DEVICEMAP\Scsi\Scsi Port 0\ScSi Bus 0\Target Id 1\Logical Unit Id 0 InstallDir REG_SZ Guest Additions folder Revision REG_SZ Revision number Version REG_SZ Version number VersionExt REG_SZ Version number Identifier REG_SZ VBOX HARDDISK Identifier REG_SZ VBOX CD-ROM HKLM\Hardware\DESCRIPTION\System SystemBiosVersion REG_MULTI_SZ VBOX -1 HKLM\Hardware\Acpi\DSDT\VBOX \VBOXBIOS\ VideoBiosVersion REG_MULTI_SZ Oracle VM VirtualBox Version (version number) REG_BINARY DSDT...VBOX VBOXBIOS...INTL PAGE 6

7 Differences between VMs and physical computers Specific registry keys Folder Key Type Value HKLM\System\CurrentControlSet\Services \Disk\Enum HKLM\System\CurrentControlSet\Services \VBoxGuest HKLM\System\CurrentControlSet\Services \VBoxGuest\Enum HKLM\System\CurrentControlSet\Services \VBoxMouse 0 REG_SZ IDE \DiskVBOX_HARDDISK 1.0 \ d DisplayName REG_SZ VirtualBox Guest Driver ImagePath REG_EXPAND_SZ system32\drivers \VBoxGuest.sys 0 REG_SZ PCI \VEN_80EE&DEV_CAFE&SUBS YS_ &REV_00\3&267a 616a&0&20 DisplayName REG_SZ VirtualBox Guest Mouse Service ImagePath REG_EXPAND_SZ system32\drivers \VBoxMouse.sys *These HKLM\System\CurrentControlSet\Services keys are in ControlSet001, ControlSet002 and CurrentControlSet 0 folders REG_SZ ACPI \VBoxMouse\Enum \PNP0F03\4&1d401fb5&0 PAGE 7

8 Differences between VMs and physical computers Specific registry keys Folder Key Type Value HKLM\System\CurrentControlSet\Enum\Ide \DiskVBOX_HARDDISK\ HKLM\System\CurrentControlSet\Enum\Ide \DiskVBOX_HARDDISK\ HKLM\System\CurrentControlSet\Services \VBoxService FriendlyName REG_SZ VBOX HARDDISK FriendlyName REG_SZ VBOX CD-ROM DisplayName REG_SZ VirtualBox Guest Aditions Service ImagePath REG_EXPAND_SZ system32\vboxservice.exe Description REG_SZ Manages VM runtime information and utilities for guest operating systems. ObjectName REG_SZ LocalSystem HKLM\System\CurrentControlSet\Services \VBoxService\Enum HKLM\System\CurrentControlSet\Services \VBoxSF 0 REG_SZ Root \LEGACY_VBOXSERVICE \0000 DisplayName REG_SZ VirtualBox Shared Folders *These keys are in ControlSet001, ControlSet002 and CurrentControlSet folders PAGE 8 ImagePath REG_EXPAND_SZ system32\drivers \VBoxSF.sys

9 Differences between VMs and physical computers Specific registry keys Folder Key Type Value HKLM\System\CurrentControlSet \Services\VBoxSF\Enum HKLM\System\CurrentControlSet \Services\VBoxSF \NetworkProvider HKLM\System\CurrentControlSet \Services\VBoxVideo HKLM\System\CurrentControlSet \Services\VBoxVideo\Device0 HKLM\System\CurrentControlSet \Services\VBoxVideo\Enum 0 REG_SZ Root\LEGACY_VBOXSF \0000 DeviceName REG_SZ \Device\VboxMinRdr Name REG_SZ VirtualBox Shared Folder ProviderPath REG_SZ %Systemroot% \System32\VBoxMRXNP.dll ImagePath REG_EXPAND_SZ system32\drivers \VBoxVideo.sys InstalledDisplayDrivers REG_MULTI_SZ VBoxDisp 0 REG_SZ PCI \VEN_80EE&DEV_BEEF&SUBS YS_ &REV_00\3&267a 616a&0&10 HKLM\System\CurrentControlSet Service REG_SZ Vbox Video *These \Services\VBoxVideo\Video keys are in ControlSet001, ControlSet002 and CurrentControlSet folders PAGE 9

10 Examples Trojan-spy.win32.Carberp Source: github.com/hzeroo/carberp/blob/master/source - absource/pro/all%20source/blackjoewhitejoe/source/vmdetect.cpp PAGE 10

11 Examples Usual methods to detect VMs Source: PAGE 11

12 Virtual Machine emulation Code structure Sample code PAGE 12

13 Virtual Machine emulation Code structure Import python libraries Create and modify registry keys Set up environment variables Create files Download libraries Register libraries PAGE 13

14 Virtual Machine emulation Sample code Full code available in: PAGE 14

15 Experimental results Themida Pafish Malware PAGE 15

16 Experimental results Themida PAGE 16

17 Experimental results Pafish Before After PAGE 17

18 Experimental results Net-Worm.Win32.Kolab.vw à Before Script Anti-debugging: The System registry key value:[hklm\system\controlset001\services\disk\enum] "0" Contains the strings: Vmware, Vbox, Virtual or QEMU It copied to the system folder Tries to detect if it s in a VM VM not detected VM detected The Original file is not deleted The original file self-destructs PAGE 18

19 Experimental results Net-Worm.Win32.Kolab.vw à After Script Anti-debugging: The System registry key value:[hklm\system\controlset001\services\disk\enum] "0" Contains the strings: Vmware, Vbox, Virtual or QEMU It copied to the system folder Tries to detect if it s in a VM VM not detected VM detected The Original file is not deleted The original file self-destructs PAGE 19

20 Conclusions Main findings Future lines of research PAGE 20

21 Conclusions Main findings and future lines of research Main findings! We can successfully simulate a virtual machine with a simple python script.! Most malware checks are in the Windows registry or files.! This technique should never be used individually. Future lines of research! Continue investigating virtual machines.! Try the script with more malware samples.! Investigate possible side-effects in a real environment. PAGE 21

22 Thank You Jordi Vázquez Aira Institut Obert of Catalonia (Barcelona, Spain) PAGE 22