Anti-VM & Sandbox Evasion Techniques

Anti-VM & Sandbox Evasion Techniques

Overview and Learning Objectives

Environment-aware malware checks whether it is running inside a virtual machine or automated sandbox before executing its payload. By the end of this lesson, you will be able to:

• Identify all major categories of anti-VM and sandbox evasion techniques
• Understand the hardware, software, and behavioral fingerprints that betray virtual environments
• Configure analysis VMs to minimize detection surface
• Recognize evasion code patterns in static and dynamic analysis
• Map findings to MITRE ATT&CK T1497 (Virtualization/Sandbox Evasion)

ATT&CK Reference: T1497 - Virtualization/Sandbox Evasion. Sub-techniques include T1497.001 (System Checks), T1497.002 (User Activity Based Checks), T1497.003 (Time Based Evasion). Used extensively by Emotet, TrickBot, Dridex, and many RAT families.

Why Malware Detects VMs

Analysts run malware in virtual machines. Automated sandboxes use VMs. If malware detects a VM environment, it can:

Category 1: Hardware Fingerprinting

CPUID Hypervisor Detection

The CPUID instruction returns processor info. VMs modify certain CPUID leaves to indicate hypervisor presence:

; Check hypervisor present bit (ECX bit 31 of CPUID leaf 1)
MOV  EAX, 1              ; Feature information leaf
CPUID
BT   ECX, 31             ; Bit 31 = hypervisor present
JC   vm_detected          ; Jump if hypervisor bit is set

; Get hypervisor vendor string (CPUID leaf 0x40000000)
MOV  EAX, 0x40000000
CPUID
; EBX:ECX:EDX contains vendor string
; "VMwareVMware" for VMware
; "Microsoft Hv" for Hyper-V
; "KVMKVMKVM"    for KVM
; "VBoxVBoxVBox"  for VirtualBox

MAC Address Vendor Prefixes

VM vendors use specific OUI (Organizationally Unique Identifier) prefixes:

// Get adapter info and check MAC prefix
GetAdaptersInfo(adapterInfo, &bufLen);
if (memcmp(adapterInfo->Address, "\x00\x0C\x29", 3) == 0)
    return TRUE;  // VMware detected

Resource Checks (Disk, RAM, CPU)

Sandboxes typically have minimal resources compared to real workstations:

// Disk size check -- sandboxes often have small virtual disks
ULARGE_INTEGER totalBytes;
GetDiskFreeSpaceExA("C:\\", NULL, &totalBytes, NULL);
if (totalBytes.QuadPart < 60000000000ULL)  // Less than 60 GB
    ExitProcess(0);

// RAM check -- sandboxes often allocate minimal memory
MEMORYSTATUSEX memInfo;
memInfo.dwLength = sizeof(memInfo);
GlobalMemoryStatusEx(&memInfo);
if (memInfo.ullTotalPhys < 2147483648ULL)  // Less than 2 GB RAM
    ExitProcess(0);

// CPU core count -- sandboxes often have 1-2 cores
SYSTEM_INFO sysInfo;
GetSystemInfo(&sysInfo);
if (sysInfo.dwNumberOfProcessors < 2)
    ExitProcess(0);

// Screen resolution -- sandboxes may use small resolutions
int width = GetSystemMetrics(SM_CXSCREEN);
int height = GetSystemMetrics(SM_CYSCREEN);
if (width < 1024 || height < 768)
    ExitProcess(0);

Analyst Tip: Configure your analysis VM with at least 4 GB RAM, 100 GB disk, 2+ CPU cores, and a realistic screen resolution (1920x1080) to avoid triggering these checks.

Category 2: Registry and File Artifacts

VMware Artifacts

// Registry keys
RegOpenKeyExA(HKEY_LOCAL_MACHINE,
    "SOFTWARE\\VMware, Inc.\\VMware Tools", ...);
RegOpenKeyExA(HKEY_LOCAL_MACHINE,
    "SYSTEM\\CurrentControlSet\\Services\\VMTools", ...);

// Files and drivers
FindFirstFileA("C:\\Windows\\System32\\drivers\\vmhgfs.sys", ...);
FindFirstFileA("C:\\Windows\\System32\\drivers\\vmmouse.sys", ...);
FindFirstFileA("C:\\Windows\\System32\\drivers\\vm3dmp.sys", ...);

// Processes: vmtoolsd.exe, vmwaretray.exe, vmacthlp.exe

VirtualBox Artifacts

// Registry
RegOpenKeyExA(HKEY_LOCAL_MACHINE,
    "SOFTWARE\\Oracle\\VirtualBox Guest Additions", ...);

// Files and drivers
FindFirstFileA("C:\\Windows\\System32\\drivers\\VBoxGuest.sys", ...);
FindFirstFileA("C:\\Windows\\System32\\drivers\\VBoxMouse.sys", ...);
FindFirstFileA("C:\\Windows\\System32\\drivers\\VBoxSF.sys", ...);

// Processes: VBoxService.exe, VBoxTray.exe

Complete VM Artifact Checklist

Category 3: Behavioral / Sandbox Detection

System Uptime and Activity

// Short uptime suggests fresh sandbox
if (GetTickCount() < 600000)  // Less than 10 minutes
    ExitProcess(0);

// Few running processes suggests sandbox
int processCount = 0;
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 pe = { sizeof(pe) };
if (Process32First(snap, &pe)) {
    do { processCount++; } while (Process32Next(snap, &pe));
}
if (processCount < 30)  // Real systems typically have 50+ processes
    ExitProcess(0);

User Activity Checks

// Check for recent user interaction (mouse movement)
POINT p1, p2;
GetCursorPos(&p1);
Sleep(5000);
GetCursorPos(&p2);
if (p1.x == p2.x && p1.y == p2.y)
    ExitProcess(0);  // No mouse movement = automated sandbox

// Check for recently opened documents
// Malware checks shell:recent folder for document count
// Few or no recent documents suggests sandbox

// Check for installed programs
// A real system has many installed applications
// Sandboxes often have minimal software installed

Username and Hostname Blacklists

GetUserNameA(userName, &size);
// Known sandbox/analyst usernames
char *blacklist[] = {
    "sandbox", "malware", "virus", "sample",
    "test", "john", "user", "admin",
    "currentuser", "analyzer", NULL
};
for (int i = 0; blacklist[i]; i++) {
    if (_stricmp(userName, blacklist[i]) == 0)
        ExitProcess(0);
}

Analysis Tool Detection

// Check for running analysis tools
char *tools[] = {
    "ollydbg.exe", "x64dbg.exe", "x32dbg.exe",
    "ida.exe", "ida64.exe", "idaq.exe",
    "procmon.exe", "procexp.exe", "processhacker.exe",
    "wireshark.exe", "fiddler.exe", "tcpview.exe",
    "autoruns.exe", "regmon.exe", "filemon.exe",
    "pestudio.exe", "die.exe", NULL
};

// Check for analysis DLLs loaded in process
GetModuleHandleA("sbiedll.dll");   // Sandboxie
GetModuleHandleA("dbghelp.dll");   // Debugger
GetModuleHandleA("api_log.dll");   // API monitoring
GetModuleHandleA("snxhk.dll");     // Avast sandbox

Category 4: Time-Based Evasion

Sleep Acceleration Detection

Sandboxes often fast-forward Sleep calls to speed up analysis. Malware detects this:

DWORD t1 = GetTickCount();
Sleep(10000);  // Request 10 second sleep
DWORD t2 = GetTickCount();
if ((t2 - t1) < 9000) {
    // Sleep was accelerated -- we are in a sandbox
    ExitProcess(0);
}

Delayed Execution

// Simple long sleep to outlast sandbox timeout
Sleep(300000);  // Sleep 5 minutes
// Most sandboxes timeout after 2-3 minutes

// Alternative: loop-based delay (harder to fast-forward)
volatile DWORD x = 0;
for (DWORD i = 0; i < 0xFFFFFFFF; i++) { x += i; }

// Alternative: WaitForSingleObject on a never-signaled event
HANDLE hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
WaitForSingleObject(hEvent, 300000);  // 5 minute wait

API Hammering

A newer evasion technique where malware makes millions of benign API calls to waste sandbox analysis time:

// Make millions of harmless API calls to delay sandbox analysis
for (int i = 0; i < 10000000; i++) {
    GetCurrentProcessId();  // Benign but time-consuming
}
// Sandbox may timeout before reaching malicious code

Hardening Your Analysis VM

To minimize VM detection, configure your environment:

VMware (.vmx file settings):

monitor_control.restrict_backdoor = "TRUE"
SMBIOS.reflectHost = "TRUE"
isolation.tools.getPtrLocation.disable = "TRUE"
isolation.tools.setPtrLocation.disable = "TRUE"

VirtualBox:

VBoxManage modifyvm "AnalysisVM" --paravirt-provider none
VBoxManage modifyvm "AnalysisVM" --macaddress1 AABBCCDDEEFF
VBoxManage setextradata "AnalysisVM" "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor" "Dell Inc."

General hardening checklist:

• Remove VM guest additions/tools before analysis
• Set MAC address to a non-VM vendor prefix
• Allocate 4+ GB RAM, 100+ GB disk, 2+ CPU cores
• Use realistic hostname and username (e.g., "JohnSmith-PC")
• Install common software (Office, browser, PDF reader)
• Create fake documents in user folders
• Set system uptime > 30 minutes (or adjust GetTickCount hook)
• Use a realistic screen resolution (1920x1080)

Practical Exercise

1. Analyze a sample with anti-VM checks using CAPA:

capa sample.exe | grep -i "virtual\|sandbox\|evasion"

2. List all evasion techniques found and classify by category
3. Determine what environments the malware specifically avoids
4. Document what happens on each detection (exit, decoy, delay)
5. Harden your analysis VM using the checklist above
6. Re-run the sample and verify it now executes its payload
7. Map all findings to ATT&CK T1497 and its sub-techniques