{"id":68026,"date":"2017-01-19T11:51:00","date_gmt":"2017-01-19T19:51:00","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=68026"},"modified":"2025-06-05T19:13:14","modified_gmt":"2025-06-06T02:13:14","slug":"stopping-malware-fake-virtual-machine","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/stopping-malware-fake-virtual-machine\/","title":{"rendered":"Stopping Malware With a Fake Virtual Machine"},"content":{"rendered":"

As we explained in a previous post<\/a>, some advanced malware can detect a virtual environment such as a sandbox to avoid detection and analysis. Some threats can also detect monitoring tools used for malware analysis. Often such malware will not execute or change their behavior to appear harmless. Because some malware uses these tactics, planting fake virtual machine artefacts or fake analysis tools on a system could stop their malicious behavior. We have created a quick proof of concept (POC) to demonstrate this defensive tactic.<\/p>\n

Some malware use a mutex or registry key to avoid re-infecting a machine. For example, a previous version of Locky used a registry key with the string \u201clocky\u201d to check if the machine was already infected. This variant also used a basic check to verify if the local language was Russian<\/a>; if it was, the ransomware did not infect the machine. With this kind of information, security analysts can proactively configure these artefacts to boost protection against some malicious software.<\/p>\n

The following diagram illustrates this concept:<\/p>\n

\"20170118<\/a><\/p>\n

 <\/p>\n

Proof of concept functions<\/strong><\/h2>\n

Sandboxes and virtual environments are full of artefacts that betray their analysis environment. Malware can protect itself against these by running some checks to detect such environments before performing any malicious actions. Our POC will reproduce a virtual environment on a normal user machine. It is available at https:\/\/github.com\/fr0gger\/RocProtect-V1<\/a>.<\/p>\n

Creating fake registry keys <\/strong><\/h2>\n

A lot of registry keys are created by specific tools or by sandbox emulation. Using the Windows API RegCreateKeyEx we can create all the (fake) keys normally created by a virtual hypervisor.<\/p>\n

The following list shows of few of the potential registry keys that malware can detect:<\/p>\n