VIrtual Machine Detection Techniques

This post will cover techniques that can be used to detect virtualized environment.
Sample Analyzed -
hxxps://virustotal.com/en/file/46686679e58fe4767e6796ddb27f31f3a46e4310abb6cf51b031a0181ba08ddf/analysis/

1.VMWare Backdoor
This techniques uses special I/O port to send command and get output.

VMware Command Execution code









In above image VMWare I/O port is 'VX' (5658h). Command number 0x0A (get vmware version).
VMware version is return in register EAX as shown below.





More About VM Backdoor Port https://sites.google.com/site/chitchatvmback/backdoor

2.VPCEXT
VPCEXT instruction is used to detect presence of Virtual PC.






If opcode 0F 3F b1 b2 is run outside Virtual PC, illegal instruction exception is thrown otherwise return value in ebx register is checked.If value in ebx register is 0 which means Virtual PC detected.

3.DMIDECODE Utility
dmidecode is a tool for dumping a computer's DMI (some say SMBIOS ) table contents in a human-readable format.
About dmidecode http://gnuwin32.sourceforge.net/packages/dmidecode.htm

Check if dmidecode utility is present on system.If yes then start dmidecode without any parameters









Read output of dmidecode command.





Search below pattern in output of dmidecode command using Perl regular expression.
pattern to search











Instructions to check above pattern in dmidecode output.


















4.DEEP FREEZE
It protects endpoints by Freezing a snapshot of a computer’s desired configuration and settings defined by the IT Admin. With an instant reboot, any unwelcome or unwanted changes are removed from the system, restoring it to its pristine Frozen state.
About Deep Freeze http://www.faronics.com/products/deep-freeze

Detect Deep Freeze service "DFServ" is running or not using OpenServiceW windows API.If Deep Freeze is installed a valid handle will be return and al register will be set to 1 which mean Deep Freeze Detected.















Deep Freeze service running on system.















5.REGISTRY ENTRIES,DRIVER FILES
Detect registry entries related to QEMU,VirtualBox,VMWARE.

a.QEMU
Read below registry entries value and convert value to uppercase and find string "QEMU".
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
HARDWARE\Description\System\SystemBiosVersion

b.VIRTUAL BOX
Read below registry entries value and convert value to uppercase and find string "VBOX".
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
HARDWARE\Description\System\SystemBiosVersion

Read below registry entry value and convert value to uppercase and find string "VIRTUALBOX".
HARDWARE\Description\System\VideoBiosVersion

Check below registry key exists.
SOFTWARE\Oracle\VirtualBox Guest Additions

Check below driver file exists.
WINDOWS\system32\drivers\VBoxMouse.sys

c.VMWARE
Read below registry entries value and convert value to uppercase and find string "VMWARE".
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier

Check below registry key exists.
SOFTWARE\VMware, Inc.\VMware Tools

Check below driver files exist.
WINDOWS\system32\drivers\vmhgfs.sys
WINDOWS\system32\drivers\vmmouse.sys

Comments

  1. I appreciate your efforts because it conveys the message of what you are trying to say. It's a great skill to make even the person who doesn't know about the subject could able to understand the subject

    Virtual Machines & Scale-Sets |App Services|
    Cloud Services
    | Azure Active Director

    ReplyDelete

  2. Thankyou for sharing Good information...
    AWS Online Training

    ReplyDelete
  3. Hey there would you mind letting me know which hosting company you're working with? I've loaded your blog in 3 completely different browsers and I must say this blog loads a lot faster then most. Can you suggest a good hosting provider at a honest price? Thanks a lot, I appreciate it!
    cloud services perth

    ReplyDelete
  4. When I started study from Pass4sure Amazon dumps, I knew its usefulness and was sure about my success. I downloaded it and pursued the suggested method of preparation. I will advice everyone to take help from Amazon questions and answers for distinguishing results.

    ReplyDelete
  5. Nice and good article. It is very useful for me to learn and understand easily.Thankyou!!
    Docker Training in Hyderabad
    Docker and Kubernetes Online Training
    Docker Training

    ReplyDelete
  6. I was searching for loan to sort out my bills& debts, then i saw comments about Blank ATM Credit Card that can be hacked to withdraw money from any ATM machines around you . I doubted thus but decided to give it a try by contacting {skylinktechnes@yahoo.com} they responded with their guidelines on how the card works. I was assured that the card can withdraw $5,000 instant per day & was credited with $50,000 so i requested for one & paid the delivery fee to obtain the card, i was shock to see the UPS agent in my resident with a parcel{card} i signed and went back inside and confirmed the card work's after the agent left. This is no doubts because i have the card & has made used of the card. This hackers are USA based hackers set out to help people with financial freedom!! Contact these email if you wants to get rich with this Via email skylinktechnes@yahoo.com or whatsapp: +1(213)785-1553

    ReplyDelete
  7. 24*7 Apple Technical Support is leading Apple support website where you get services provider of Apple remote tech support the USA for third party products and services. Contact Apple Support phone number +1-855-516-8225.

    Apple Customer Service
    Macbook Customer Service
    iTunes Customere service
    iPad Customer Service
    Technical Help Number
    iPhone Customer Service

    ReplyDelete

  8. BEST WAY TO HAVE GOOD AMOUNT TO START A GOOD BUSINESS or TO START LIVING A GOOD LIFE….. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (williamshackers@hotmail.com) for how to get it and its cost . ………. EXPLANATION OF HOW THESE CARD WORKS………. You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT $1,000, 2nd VAULT $2,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done. ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. email (williamshackers@hotmail.com) We are located in USA.

    ReplyDelete

  9. Really it is very great information that you have shared and thanks for sharing the information with us. if any problem related to Lexmark customer support phone number
    Lexmark support
    Lexmark printer support
    Lexmark printer customer service
    Lexmark printer technical support

    ReplyDelete
  10. I would like to thank you for the efforts you have made in writing this article. good information in this article, thanks .
    Epson scanner support
    Epson scanner
    Epson scanner number
    Epson scanner service

    ReplyDelete

  11. Thanks for sharing such a good content with your blogs. I really enjoying your blog while reading. if you need any kind of information CONNECT BROTHER PRINTER
    brother printer support
    wireless printer support
    laser printer support
    inkjet printer support number
    printer driver support number

    ReplyDelete
  12. I would like to thank you for the efforts you have made in writing this article. good information in this article, thanks
    TechMax ProInfo

    ReplyDelete
  13. BE SMART AND BECOME RICH IN LESS THAN 3DAYS (williamshackers@hotmail.com)… It all depends on how fast you can be to get the new PROGRAMMED blank ATM card that is capable of hacking into any ATM machine,anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for job online about a month ago..It has really changed my life for good and now I can say I'm rich and I can never be poor again. The least money I get in a day with it is about $50,000.(fifty thousand USD) Every now and then I keeping pumping money into my account. Though is illegal,there is no risk of being caught ,because it has been programmed in such a way that it is not traceable,it also has a technique that makes it impossible for the CCTVs to detect you..For details on how to get yours today, email the hackers on : (williamshackers@hotmail.com). Tell your loved once too, and start to live large. That's the simple testimony of how my life changed for good…Love you all …the email address again is email (williamshackers@hotmail.com)…

    ReplyDelete
  14. BECOME RICH WITH THE USE OF BLANK ATM CARDHave you Ever heard of the Blank ATM card capable of making cash withdrawal without being track or harm? BEST WAY TO HAVE GOOD AMOUNT OF MONEY TO START BUSINESS..Hack and take money directly from any ATM Machine Vault with the use of already programmed ATM Card which runs in automatic mode.This is an opportunity you all have been waiting for. Get this BLANK CARD that can hack any ATM MACHINE and withdraw money from anywhere in the world. You do not require anybody's account number before you can use it. Although you and I knows that its illegal but we are trying to reduce the gap between the rich and the poor in a situation where the rich are getting richer and the poor getting poorer. There is no risk using it. It has SPECIAL FEATURES, that makes the machine unable to detect this very card,And its transaction can'tGet yours now and provide for your families, make your kids happy by providing for all their needs.make up your mind before applying, straight deal!!! The price include shipping fees and charges, order now: contact us via Email: (freeblankatmcards@gmail.com) or whatsapp our head office in USA on,( +15162316120 )WITHDREW $5,500 EVERY DAY CARD COST $250USDWITHDREW $10,000 EVERY DAY CARD COST $350USDWITHDREW $20,000 EVERY DAY CARD COST $450USDWITHDREW $30,000 EVERY DAY CARD COST $550USDWITHDREW $40,000 EVERY DAY CARD COST $650USDWITHDRAW $50,000 EVERY DAY CARD COST $750USD

    ReplyDelete
  15. If you are facing any kind of issue like in your apple devices. Contact Apple Support Department by Apple Support Number +1 877-771-8477 and our Technician Assist You and Resolve your Apple technical issues. http://www.tech-supportphonenumber.com/

    iTunes Support Number
    iPad Support Number
    iPhone Support Number
    Mac Support Number

    ReplyDelete
  16. INSTEAD OF GETTING A LOAN, CHECK OUT THE BLANK ATM CARD IN LESS THAN 24hours {oscarwhitehackersworld@gmail.com}


    I want to testify about OSCAR WHITE blank ATM cards which can withdraw money from any ATM machines around the world. I was very poor before and have no hope then I saw so many testimony about how OSCAR WHITE send them the blank ATM card and i use it to collect money in any ATM machine and become rich. I also email him and he sent me the blank card. I have use it to get $100,000 dollars. withdraw the maximum of $5,000 daily.OSCAR WHITE is giving out the card just to help the poor. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email Him on how to get it now via: oscarwhitehackersworld@gmail.com or whats-app +1(323)-362-2310

    ReplyDelete



  17. INSTEAD OF GETTING A LOAN,, I GOT SOMETHING NEW
    Get $10,050 USD every week, for six months!

    See how it works
    Do you know you can hack into any ATM machine with a hacked ATM card??
    Make up you mind before applying, straight deal...
    Order for a blank ATM card now and get millions within a week!: contact us
    via email address:: besthackersworld58@gmail.com or whats-app +1(323)-723-2568

    We have specially programmed ATM cards that can be use to hack ATM
    machines, the ATM cards can be used to withdraw at the ATM or swipe, at
    stores and POS. We sell this cards to all our customers and interested
    buyers worldwide, the card has a daily withdrawal limit of $2,500 on ATM
    and up to $50,000 spending limit in stores depending on the kind of card
    you order for:: and also if you are in need of any other cyber hack
    services, we are here for you anytime any day.
    Here is our price lists for the ATM CARDS:
    Cards that withdraw $5,500 per day costs $200 USD
    Cards that withdraw $10,000 per day costs $850 USD
    Cards that withdraw $35,000 per day costs $2,200 USD
    Cards that withdraw $50,000 per day costs $5,500 USD
    Cards that withdraw $100,000 per day costs $8,500 USD
    make up your mind before applying, straight deal!!!

    The price include shipping fees and charges, order now: contact us via
    email address::besthackersworld58@gmail.com or whats-app +1(323)-723-2568

    ReplyDelete
  18. Roku device is the best service in the USA, Do you have an issue with your Roku Device? Get instant solution and support by Roku Helpline Number. We are dealing with a wide range of Roku streaming players and provide a complete solution for Roku devices.call +1-855-879-1273 visit here https://roku-helpnumber.com/

    Roku Help Number
    Roku Customer Service Number
    Roku Technical Support Number

    ReplyDelete
  19. GET HACK BLANK ATM CARD TO WITHDRAW FREE CASH

    Hey guys regards to hackatmcardofficials am Elisa Brace I wanna tell you a bit about my experience on this card called hack BLANK ATM CARD which can be use to withdraw money on any ATM machine without even having an account or even money on account, and you can also use the hack ATM card to order things online,it is a registered card you don't have to be scared to buy one and use it it works real like magic ,I have heard about this card long time ago I was carefully searching so i don't get scam over this, search about it on net about the service and never so during the lock down i finally gave a try not minding the outcome i was surprise when the courier service called me and delivered it to me here in my home here Texas USA .
    I was so happy and had to go down to the walmart close to me and used it on the atm machine and I was suprise I cashed out over $5,500 bucks and had to pay for 3 cards which i got huge bucks outta it. living a good live now in my new house with a nice car i got from this.the truth is i paid $400 both the delivery and programming of the card which withdraws maximum of $5,500 was told it will work for a whole year cashing out $5,500 daily, note this card was not given free you will pay to get your desire amount of card mail them and follow their instructions on the the cashing out amount this is a welcome development guys contact them if you are really in need of huge financial support via their official email: blankatmdeliveryxpress@gmail.com thanks for reading stay safe i love you guys.

    ReplyDelete
  20. Watch your favorite live sports, news, entertainment, and more. Plus, get unlimited access to the entire Roku streaming library To activate Roku code go to URL if you need help to activate Roku.
    roku com link
    Roku com link activation
    roku.com/link not working
    Enter link code
    Roku activation link

    ReplyDelete

Post a comment

Popular posts from this blog

Analyzing ATM Malwares

FireEye FLARE CTF 2017 : APK Challenge 8

Debugging MBR : IDA Pro and Bochs Emulator

Samsung CTF : Chicken or Egg Reversing Challenge

FireEye FLARE CTF 2017 : PEWPEWBOAT Challenge 5

Memory Forensics : Tracking Process Injection

DoublePulsar Backdoor

Google CTF 2017 : Android RE Challenge

Windows Registry Forensics