Lab 17-1

Analyze the malware found in Lab17-01.exe inside VMware. This is the same malware as Lab07-01.exe, with added anti-VMware techniques. NOTE: The anti-VM techniques found in this lab may not work in your environment.

Analysis

The Analysis of Lab07-01.exe can be found here.

I will try to go over the Lab, however as I’m using Virtualbox I’m certain there will be roadblocks to prevent me to completely answer all the questions.

Questions

1. What anti-VM techniques does this malware use?

   This Malware variant uses several Anti-VM techniques. First, in the main function, after checking for the presence of the Mutex, in case it doesn’t exist the Malware uses the Red Pill Anti-VM technique, by using the sidt instruction:

   

   Then it uses the str instruction, in order to retrieve the segment selector from the task register:

   

   At some point the Malware calls sub_401100:

   

   Inside this function the Malware uses the No Pill technique:

   

2. If you have the commercial version of IDA Pro, run the IDA Python script from Listing 17-4 in Chapter 17 (provided here as findAntiVM.py). What does it find?

   Using the provided script, it is possible to confirm the 3 Anti-VM Techniques previously mentioned at 1).

   

   Here’s an example on IDA Pro highlighting 2 of them:

   

3. What happens when each anti-VM technique succeeds?

   In the first two techniques, if the Malware is successful in detecting the VM it will eventually reach loc_40132D, where there’s a call to sub_401000. Inside this function the Malware deletes itself by combining GetModuleFileNameA, GetShortPathNameA, and ShellExecuteA (with cmd.exe /c del ).

   If the third technique is detected, the Malware will exit.

4. Which of these anti-VM techniques work against your virtual machine?

   In my case neither technique would work since the first two are used to detect VMWare (I’m currently using VirtualBox), and the third one doesn’t work on multiprocessor hardware.

   In the following image it is possible to see EIP at 401250, after executing both Anti-VM techniques. In order to make it easier to view, both instructions have breakpoints. Without changing anything on the jumps, code reached execution 401250:

   

   The third technique was also ineffective. It is possible seeing EIP at 4012E6, after executing sub_401100 (also highlighted by the breakpoint):

   

5. Why does each anti-VM technique work or fail?

   In my case neither technique would work since the first two are used to detect VMWare (I’m currently using VirtualBox), and the third one doesn’t work on multiprocessor hardware.

6. How could you disable these anti-VM techniques and get the malware to run?

   The easier way to bypass these techniques is to patch the code.

   Here the two jumps followed by the Red Pill technique and str instruction are filled with NOPs:

   

   Also, the jump after the No Pill technique filled in with NOPs is effective in bypassing the technique executed within sub_401100: