To make sure that you're able to have a really good
conversation with your malware author, you also need to
make sure that malware runs properly.
We talked about simulating the network. Right. How do
we‑‑‑we're on a virtual machine. Yes,
some malware is kind of getting over the fact that it's
going to be on a virtual machine,
but some malware still does care. Correct. And so how do we
make that virtual machine hide and look like a real machine?
Are there techniques for that?
So there are a number of ways that we can do this.
Remember that the virtual machine software, there's no way that it
can completely look like a piece of hardware. However, there're
some changes that we can do to the virtual machine software itself
to make it look more real.
We'll talk about some ways that we can do it within the OS,
but right now we're just going to talk about how we can change VMware itself
to look more real and not look like like VMware. Now understand there's no
way that we're going to get through everything, we're going to be able to
hide from everything, but we can at least do some things to change this
initially. So we can kind of look to see how our changes are affecting the
operating system, we can go ahead and run a tool called Pafish, and this tool
kind of goes through all of the different checks that malware does in order
to see if it's on a VM and tells us what it detects it and what it doesn't.
So what I'm going to do is I'm going to run Pafish, and we'll run it once,
and we're going to see all the stuff that it detects,
and then we're going to make our changes,
and then we'll run it again, and we'll see the difference
between the two. And the same people who make Pafish aren't
the same people who make the malware,
right? No. So it's not false sense of security.
No, Pafish is an open source tool, so you can actually go in,
you can see how it's doing these checks.
You could see exactly what it's doing. If you didn't trust
the executable that you can download,
you can actually go in and compile it yourself.
So it is a safe piece of software.
It's not malware. It's just using the same checks.
That being said, your antivirus is probably going to detect this.
That makes sense because it is using those those checks. But,
again, this is why we're executing it in a virtual machine.
Absolutely.
All right, let's check this out.
So what I'm going to do is it's a command line tool, so
I'm going to open up a command line,
and I am going to run as administrator just so I give it all of the
privileges that it needs to run within an environment.
I always run everything as an administrator. Exactly. So, here I've got my tool.
It's just pafish.exe. I've got an old log file in there.
I'm just going to delete that. It'll create a new one.
And then I'm going to run Pafish.
You don't have to give it any parameters or anything like that.
You just go ahead and run it. It is a command line tool.
It's a command line tool. And you can see it's already going through,
and it's doing some detections. It's looking for, Is there a debugger?
I don't a debugger running, so we're good.
But then it does this checking the difference between CPU timestamps.
And it found it.
You could see that it went through.
I'll scroll back up a little bit.
You can see that,
while we do have a bunch of things that it did not find that
we're okay on, it did find a number of ways that it could
detect that we're in a virtual machine.
Yeah,
that's interesting. So I know VMware and a type‑2 hypervisor in
general use CPU queuing, they share the time of the CPU.
So it's using those timestamps to understand that the usage time for the
host versus the usage time for the virtual machine? Yeah,
well,
I I think in here what it's doing is it's going through,
it's taking a snapshot of the time,
running through some instructions and taking a second
snapshot and kind of comparing those two.
And it kind of knows how much time should have
elapsed between those two time periods.
And if it doesn't match up, then it knows that it's either
being analyzed or it's in a virtual machine.
And this is actually a very common technique that malware does in order
to kind of detect if it's being analyzed or not. That's really smart
because the host is going to use up some of the CPU ticks. That's just
the way it is. Exactly. That's great.
So we've run this.
What we're going to do here is we're going to modify VMware itself.
In order to do that, we need to shut down our VM.
So I'm going to shut down my VM because VMware does not like it if
you make changes to the VM itself while the VM's running. So I'm
going to shut this down. It should only take a second. And then
while it's shutting down,
I'm actually going to close VMware out just so I don't have anything running
and just in case that the virtual machine needs to do anything. And what I'm
going to do here is I'm going into my virtual machines. Again, we're using a
Windows 10 virtual machine, and what I want to do is I want to go to the
VMware VMX file. The VMX file is the configuration file for the entire
virtual machine.
Now this is just a text file.
If you would go and double‑click right here,
it would actually launch VMware, and we don't want that.
So I'm going to right‑click on it.
And then I am just going to open it with Notepad++. And you can see
here, we can kind of scroll through everything, you can see that it
has a bunch of configuration options.
So it kind of looks like options that you can get to in the
options for the properties from the VM.
Yeah, absolutely.
A lot of these options you can actually get to within the GUI of the VM of
VMware. We'll actually go in and modify one more setting within the GUI just
because it's a little bit easier and there're some back‑end checks that it
does. If we would modify it in here, it might not work right.
But what we're going to do is we have our VMX file here.
I am going to take these settings, and we'll make the settings available.
These are settings that are going to modify our VM a little bit.
It's going to modify the underlying way that VMware
kind of virtualizes the environment.
And these settings are going to allow us to bypass some of those checks.
All I'm going to do... You're saying we're going to put
these in the demo content for the course?
Yes, absolutely.
Great. So all I'm doing is I'm copying these.
I'm going to paste them into our VMX file and then save it.
So this is just in addition to what is already existing inside the VMX file?
Yes, absolutely.
So I'm going to close that out. And just to show you what happens
when you double‑click on it, we've already saved our VMX file,
I'm going to double‑click on this.
And it should open it up in VMware. So, great, this is where we want to go.
I'm not going to launch it yet because we want to do one more setting. So
I'm going to go up into the Virtual Machine Settings.
Click Edit. Then I'm going to go down to the Network Adapter.
What we want to do is we want to change the MAC address
of our network adapter. Oh good, I was going to ask you
about the MAC address. Right,
because VMware, it has its own prefix for MACs, and malware know
this, so it knows that all it needs to do is check the MAC address
of the network interface of what it's on.
And if it's one of these MAC addresses assigned to VMware, then it knows
that it's in VMware. So we're going to change that.
So all I do is I go into the Network Settings.
I click Advanced,
and then down here with the MAC address, now you can click Generate and it's
going to generate a new one. But it's got the same prefix.
Yeah, it's going to have the same prefix.
So all I'm going to do here,
honestly, is I'm just going to change this 00 to, I'll say, 05.
That's probably assigned to something else.
But for our purposes because we're in a virtual network,
it doesn't matter. We're good as long as we somehow don't happen to choose
the same NIC as something else on our virtual network,
which the odds of that are pretty small, we should be okay.
Is there any benefit to choosing something that matches a specific
type of hardware? There is. If you want to simulate a specific
type of hardware, then you would have to go in and research what
type of hardware that was.
I've never seen any malware that would actually go that in‑depth to see
if the MAC address kind of matches to what it's on. That would be pretty
advanced to do. I guess an attacker could do that. There are some ideas
for you attackers. Exactly. But for our purposes, this should be okay.
So, hopefully, if I click OK, it'll work. See, so, this is what I was
talking about, the back‑end checks that VMware does. Apparently, in MAC
addresses, the first byte can't be odd. Because I changed it to an odd
number, if I would have changed that in the configuration file,
it wouldn't have done this check, and my VM wouldn't have been able to launch.
It's like this is a weird hacker trick that I get to know
now. I'll know the answer to this 10 years later is that
it can't be an odd number.
So when you do hacker Jeopardy,
I know what to do. So I'm going to change that from a 5 to a 4,
and hopefully this will work now. We're good.
I'm going to click OK. And then I'm going to power on our machine.
Now the thing that I want to say too while our machine is coming
up, all these changes that we made, we made to the underlying
hardware of the way that VMware works.
Making these changes can make your virtual machine unstable.
These are undocumented changes that VMware doesn't necessarily support.
So understand any of these changes could end up blue screening your
system or crashing VMware. So your mileage may vary as to if these
work. But as we'll see in a second,
these are going to allow you to kind of hide from some of these checks.
Awesome.
Are there any particular changes that you made that you want to call out? I see
one of them is the IBM Corporation asset tag for the bios.
Yeah, so a lot of the bios tags,
or even actually a lot of places within the virtual machines software and
VMware, it actually says that the company name is VMware. So what some of
these changes do is they go in and they modify it from saying VMware to
IBM. You can modify that to Dell or or any other thing that you want. You
can make up your own name.
As long as it doesn't say VMware, you should be good. It's just string matching.
Exactly.
We're just going to log back into our virtual machine here, and
notice that my user name is John. It's not my name,
and it's not sandbox. Don't name your virtual machine sandbox.
Don't name your username sandbox. Surprisingly, there are
commercial sandboxes that do this. But don't make it look
like you're actually analyzing it.
Because then when you get in a chat with your malware author,
they might make fun of you.
They might, and they're not nice.
So what I'm going to do here just so we can kind of see all this
is I'm going to go into Pafish, the directory where we have
Pafish running, and the log files here,
and I just want to save this log file off so it doesn't get
overwritten, so we can kind of do a comparison.
Okay, so that's the before log.
Yeah, this is the before,
so I'll just call this pafish_before. Close enough. And then, again,
I'm going to rerun Pafish.
So I'm opening up my command prompt as an
administrator, going into the Pafish directory,
and I'm ready to run.
So I'm going to run it again. And, remember,
and we'll do a comparison after we run this, but, remember,
we saw a whole bunch of checks.
We saw a whole bunch of those red traced things.
So as we run this now, we should see less. Less red is usually good. More green,
less red.
All right. So it's running, and you can even see right
away that the one you called up before, the timestamp
check, we've already bypassed that.
Now it does a different timestamp check, which is still traced.
Remember, I said we're not going to be able to bypass everything,
but there is definitely much less red than there was
before. Absolutely. I'm actually super impressed that we
bypassed the time check. In fact, if we go in here,
I'm going to open up the before.
Here's our before log, and you can see the different places that it
checked it, traced using mouse activity. At the very top,
we have our timestamp counters.
Let me open up the new log, and we'll kind of compare the two.
And you can see the one on the left is our before, the one on the right is
our after. And the one on the right, we made these checks.
It still detected something, but it's definitely much less than our before.
So the changes we made did go in and hide our VM from the malware
checks. With the ones that that it is checking,
we could go in, and we could do some analysis and research and
figure out how we can hide from those as well.
And I'm sure that there are other things that we can
go in, modifying the registry, making some of those changes.
Maybe there're other configuration changes that we can make to hide from these.
But for the most part, I would say we're doing pretty good.
Yeah, absolutely.
Like even just taking a quick look now, I can see that mouse activity, I'm
sure there're ways we can, have you heard of Sikuli?
Yes. So you can use Sikuli to simulate user input and stuff as scripted.
Absolutely.
And then there's a reg key for SCSI.
I guess we're using SCSI as the hard drive,
but we can simply change the ID or something like that. Exactly.
And then go right here.
It's calling out a registry key, which is probably going to have VMware in it.
We could just go to that registry key and rename it and then bypass it. Yeah,
that's great.