Top Banner
0 VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT
23

VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

Jun 13, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

0

VMRAYMALWAREANALYSISSANDBOXEFFICACY

ASSESSMENT

Page 2: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

1

ContentsAboutVMRay...........................................................................................................................................2AboutMRGEffitas....................................................................................................................................2AboutUkatemi.........................................................................................................................................2Introduction.............................................................................................................................................3Testdetails...............................................................................................................................................4

High-levelresults..........................................................................................................................................8Detailedresults............................................................................................................................................9

In-thewildtests........................................................................................................................................9Custommalwaretests............................................................................................................................10Anti-antiVM...........................................................................................................................................11Supportedfiletypesandanalysisenvironments...................................................................................14Usefulreports.........................................................................................................................................16Easyinteractionwiththesandboxduringtheanalysis..........................................................................18YARArulesimplemented........................................................................................................................18Strongresistanceagainstpackers..........................................................................................................18Hashbasedreputation,MetadefenderandVirusTotalintegration.......................................................19Maliciousscriptsaredetected...............................................................................................................19SolidbrowserexploitdetectionviaURLanalysis...................................................................................21

Conclusion..................................................................................................................................................22

Page 3: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

2

AboutVMRayVMRayisaCyberSecuritycompanythatprovidesbothacloud-basedandon-premisesproduct,VMRayAnalyzer,fordetectingmalware-relatedthreatsusingdynamicprogramanalysis.

VMRayuseshypervisor-basedmonitoringbuiltontheacademicworkofthetwoco-founders.VMRayAnalyzerisprimarilyusedbyCERTsandSOCsinlargeenterprises,telecomsandtechnologyvendorsforanalyzingandidentifyingmalware,inparticulartargetedattacksrelatedtoAPTs.

AboutMRGEffitasMRGEffitasisaUKbased,independentITsecurityresearchorganisationthatfocusesonprovidingcutting-edgeefficacyassessmentandassuranceservices,thesupplyofmalwaresamplestovendorsandthelatestnewsconcerningnewthreatsandotherinformationinthefieldofITsecurity.

MRGEffitas’origindatesbackto2009whenSvetaMiladinov,anindependentsecurityresearcherandconsultant,formedtheMalwareResearchGroup.ChrisPickardjoinedinJune2009,bringingexpertiseinprocessandmethodologydesign,gainedinthebusinessprocessoutsourcingmarket.

TheMalwareResearchGrouprapidlygainedareputationastheleadingefficacyassessorinthebrowserandonlinebankingspaceand,duetoincreasingdemandforitsservices,wasrestructuredin2011whenitbecameMRGEffitas,withtheparentcompanyEffitas.

Today,MRGEffitashasateamofanalysts,researchersandassociatesacrossEMEA,UATPandChina,ensuringatrulyglobalpresence.

Sinceitsinception,MRGEffitashasfocusedonprovidingground-breakingtestingprocessesandrealisticallymodelingreal-worldenvironmentsinordertogeneratethemostaccurateefficacyassessmentspossible.

MRGEffitasisrecognizedbyseveralleadingsecurityvendorsastheleadingtestingandassessmentorganizationintheonlinebanking,browsersecurityandcloudsecurityspacesandhasbecometheirpartnerofchoice.

Ouranalystshavethefollowingtechnicalcertificates:

OffensiveSecurityCertifiedExpert(OSCE),OffensiveSecurityCertifiedProfessional(OSCP),MalwareAnalysis(DeloitteNL),CertifiedInformationSystemsSecurityProfessional(CISSP),SecurityTubeLinuxAssemblyExpert,SecurityTubePythonScriptingExpert,CertifiedPenetrationTestingSpecialist(CPTS),ComputerHackingForensicsInvestigator(CHFI),andMicrosoftCertifiedProfessional(MCP).

AboutUkatemiUkatemiTechnologiesisaspin-offfromtheCrySySLab,Budapest.ItwasfoundedinDecember2012bymembersofCrySySLabwiththemissiontoaddressproblemsoftargetedattacksincyberspace.Targetedattacksoftenuseadvancedmethods,aimtocompromisehighprofiletargets,arestealthyandpersistent,and,therefore,difficulttodetectandmitigate.Ukatemifocusesonprovidingtoitsclientscustomizedthreatintelligencereportsandincidenthandlingservices,includingmalwareanalysis.Ukatemiprovidespersonalizedservicesthatmaynotbeprocuredelsewhere.

Page 4: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

3

IntroductionVMRaycommissionedMRGEffitastoconductanefficacyanalysisofitsVMRaymalwareanalysissandboxproduct.Thissandboxiscapableofdetectingtraditionalmalware,malwaresimulatingAPTattackers,documentscontainingexploits,exploitsonURLs,andothermaliciousactivities.

ThetermAdvancedPersistentThreat(APT)referstoapotentialattackerthathasthecapabilityandtheintenttocarryoutadvancedattacksagainstspecifichigh-profiletargetsinordertocompromisetheirsystemsandmaintainpermanentcontrolovertheminastealthymanner.APTattacksoftenrelyonnewmalware,whichisnotyetknowntoandrecognizedbytraditionalanti-virusproducts.APTattackerstypicallyusespearphishingorwateringholetechniquestodeliverthemalwaretovictimcomputerswhereitisinstalledbyenticingtheusertoopenthefilecontainingthemalwareorthelinkpointingtoit.Installationofthemalwaremayalsoinvolveexploitingsomeknownorpubliclyunknownvulnerabilityinthevictimsystem,orsocialengineering.Oncethemalwareisinstalled,itmayconnecttoaremoteCommand&Controlserver,fromwhichitcandownloadupdatesandadditionalmodulestoextenditsfunctionality.Inaddition,themalwaremayuserootkittechniquesinordertoremainhiddenandtoprovidepermanentremoteaccesstothevictimsystemfortheattackers.

Astraditionalanti-virusproductsseemtoberatherineffectiveindetectingnewmalware,andhence,mitigatingAPTattacks,arangeofnewsolutions,specificallydesignedtodetectAPTattacks,haveappearedonthemarketintherecentpast.Theseanti-APTtoolsopenthosefilesinasandboxenvironmentonvirtualmachinesundervariousconfigurationsettings,analyzethebehaviourproducedbythevirtualmachines,andtrytoidentifyanomaliesthatmayindicatethepresenceofamalwareoranexploitationattempt.

Thereisnodoubtthatthesenewtoolsareuseful.However,determiningtherealeffectivenessofthesetoolsischallenging,becausemeasuringtheirdetectionratewouldrequiretestingthemwithnew,previouslyunseenmalwaresampleswithcharacteristicssimilartothoseofadvancedmalwareusedbyAPTattackers.Developingsuchtestsamplesrequiresspecialexpertiseandexperienceobtainedeitherthroughthedevelopmentofadvancedtargetedmalwareoratleastthroughextensiveanalysisofknownsamples.

WeatMRGEffitasandUkatemidecidedtojoinforcesandperformatestofleadingAPTattackdetectiontoolsusingcustomdevelopedsamples.MRGEffitashasextensiveexperienceintestinganti-virusproducts,whileUkatemihasaverygoodunderstandingofAPTattacksgainedthroughtheanalysisofmanytargetedmalwarecampaigns(includingDuqu,Flame,MiniDukeandTeamSpy).Therefore,collaboratingandbringingtogetherourcomplementarysetsofexpertiselookedlikeapromisingidea.

Page 5: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

4

TestdetailsThefollowingcomponentsandtestcaseswereusedduringthetest:

• Numberofin-the-wildexploits:10• Numberofin-the-wildmalware:60• Numberoffullcustommalware:2• Numberofdifferentcustomexploitobfuscation(Java,Flash):1• Numberofdifferentsandboxevasiontechniques:10• Publiclyknown,butcustomizablemalwaresamples:15• Numberofstandardoff-the-shelveexploitkit(e.g.Metasploit)testcases:10• Sampleswithcustomcrypters:1• Sampleswithknowncrypters:2• Numberofdifferentdeliverymethods(exploit,macro,javaself-signed,ActiveX,HTML5,etc):4• Totalnumberoftestcases:~95

ThetargetplatformwasWindows764-bit,withInternetExplorer11andrecentversionsofFirefox,Chrome,AdobeFlashPlayer,AdobeAcrobat,MicrosoftOffice,SilverlightandJavaRuntimeEnvironment.

WetestedbrowserexploitsthattargetInternetExplorerandFlashasthesearethemostprevalentattacksatpresent.BesidestheseexploitsweusedPDF,RTF,andDOCXtypeexploits.Non-prevalentfile-typeslikeAVIandCHMwereoutofscope.

AfterafirstroundoftestssomeissueswereidentifiedintheVMRayanalysisenvironment.MRGEffitasprovidedfeedbacktotheVMRayteamonsuggestedadjustmentstoaddresstheseissues.Thisreportcontainstheresultoftheretestaftersomeoftheseissueswereaddressed.

Ourtestsincludedthefollowingparametersandcustomdevelopedtools:

• Weusedencodedshellcodestoavoiddetection• WeusedPowerShell,VisualBasicScriptandBatch-basedattackstosimulateAPT

attackers• WedevelopedMicrosoftOfficefileswithdirectshellcodeexecution(noPEisdroppedto

thehard-disk)

Page 6: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

5

• WeusedknownpackerslikeThemidaandVMProtectandalsodevelopedtwonewcustompackers(XOR,Compress+XOR)

• WeusedknownRATslikePoisonIvyandNJRat

Page 7: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

6

• WetestedshellcodeexecutionembeddedintoPython,RubyscriptsorGobinaries• WedevelopedsampleswithMD5-basedhashcollisions• WeusedexploitstargetingFlash,Java,AdobeReader,MicrosoftOfficeandSilverlight• Weusedencodedpayloaddeliveryduringexploits• Weusedlateralmovementinatest,andasafirststep,weextractedhashesfromthe

machinewhichcanbeusedinpass-the-hashattacks• Wedevelopedcustomexploitencryptionmethodswhereapassivenetworklistener

devicecannotreplaytheexploit,becauseitlackstheencryptionkeys• Wedeveloped10newmalwareanalysissandboxdetectiontechniques

Page 8: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

7

• WesignedsomemalwaresampleswithbothvalidandinvalidcertificatestosimulateAPTattackers

• Themajorityofthein-the-wildmalwareandexploitkittestsweredonelive• Weusedthefollowingexploit-kitsinourexploitkittests:Rig,Sundown,Metasploit

Page 9: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

8

High-levelresultsAfterperformingthetests,weidentifiedthefollowingstrengthsoftheVMRaymalwareanalysissandbox:

• Thesandboxisverystrongathidingboththevirtualizationlevelfrommalwarerunninginthesandbox(anti-anti-vm)andanyspecificartefactsofthesandboxitself.

• Thenumberofsupportedanalysisenvironmentsandfiletypesareaboveindustryaverage.• Thereportsareusefulforbothbeginnersandadvancedusers.• Itiseasytointeractwiththeanalysisenvironmentduringanalysisincasemanualactionsare

neededtotriggerthemaliciousactivity.• Theanalysisenvironmentisconfigurablewithprescripts,whichprovidesoptionsforadvanced

userstofine-tunetheanalysisenvironment.• TheYARArulesareeffectivetodetectknownbutpackedmalwarebyinspectingthememory

whenthecodeisunpacked.• TheYARArulesareeffectivetodetectknownexploitslikeOfficefiles,PDF• Thesandboxwillanalyzemalwarethatispacked–packersarethebiggestenemiesoftraditional

antivirusengines.• Thesandboxhashash-basedreputationcheckingandMetadefenderintegration• Besidesexecutables,maliciousscriptswritteninPowerShellarealsodetected• ThesandboxhassolidexploitdetectionviaURLanalysis• TheRESTAPIinterfaceiswelldocumented

Page 10: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

9

DetailedresultsIn-thewildtestsFollowingarethemalwareanalysissandboxresultsofthein-the-wildmalwaresamples.VTIscoresaretheresultsofthedynamicexecutionofthemalwareinsidethesandbox.

In-the-wild-malware TestResults

%ofsamplesdetectedasMalicious* 88%%ofsamplesdetectedasBlacklisted* 12%

TotalDetectionEfficacy 100%

*VMRaySeverityScoreChart

Blacklisted VMRay’sreputationenginerecognizesthesampleasaknownmaliciousfile

Malicious VMRay’sdynamicanalysisenginedeterminesthatthefileismaliciousbasedonspecificbehaviorpatterns

Suspicious VMRay’sdynamicanalysisenginedeterminesthatthefileissuspiciousbasedonspecificbehaviorpatterns

NotSuspicious VMRay’sdynamicanalysisenginedeterminesthatthefileisnotsuspiciousbasedonbehaviorpatterns

Whitelisted VMRay’sreputationenginerecognizesthesampleasaknownbenignfile

Figure1-FinaldetectionviaVTIandreputationforin-the-wildmalware

12%

88%

Finalin-the-wildsampledetection

blacklisted

malicious

Page 11: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

10

CustommalwaretestsVMRayAnalyzerdetectedthemajorityofcustommalwaresamplesasmalicious,therebyhighlightingitsabilitytodetecthighlyevasiveandadvancedmalware.Insomecustommalwaretestscenarios,VMRay’sdynamicanalysisenginedeterminedthatthefilewassuspicious(butnotmalicious)basedonspecificbehaviorpatterns.ThereareseveralreasonswhyVMRay’sdynamicanalysisenginemayonlyclassifyafileassuspiciousandnotmalicious.Forexample,ifthecommandandcontrolserverisinactiveatthetimeoftheanalysis,thesamplemaybedeemedtobelessmaliciousthanitactuallyis.Similarly,iftheC&Cisavailable,butnomaliciousactionsarereceivedfromthecommandandcontrolserverduringtheanalysis,thesamplemayonlybeclassifiedassuspicious.PleasenotethatthisisageneralshortcomingofdynamicmalwareanalysisandisnotspecifictoVMRayAnalyzer.

Page 12: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

11

Anti-antiVMFinding

Therearethreemaintypeofattackswhereattackerscandetectthemalwareanalysissandbox,andchangethemalwarebehaviourifananalysisenvironmentisdetected:

1.Detectionofvirtualizationsoftware(Virtualbox,VMWare,QEMU,KVM…)

2.Identifyadifferencebetweenthetargetcomputer(e.g.desktopcomputerwithuseractivity)andaplainanalysisenvironments.

3.Context–awareorenvironment-awaremalware,wherethemalwaresampleonlytriggersifspecificfactorsaremet,e.g.itstartsonagivendateonly,oritchecksthepresenceofaspecificenvironmentvariable,registrykey,etc.Itisevenpossibletoencryptthemalwarepayloadbasedonthevalueofthisvariable,sowithoutknowing(orguessing)thecorrectvalue,thepayloadcannotbedecrypted.

VMRayhasaseriesofblogpostsonsandboxevasiontechniqueshere:https://www.vmray.com/blog/sandbox-evasion-techniques-part-1/

Whenitcomestodetectionofvirtualizationsoftware,thede-factostandardisthePafishtool:https://github.com/a0rtega/pafish

VMRayisimplementedasamodifiedKVM/QEMU,sowecanonlyexpectVMdetectionsontheKVM/QEMUpart.ByrunningthePafishtool,wecanseethatthereisnotasingledetectionofthevirtualizationenvironment.Note:sometimes,PafishdetectsthatVMRaydoesnotsimulatemousemovement,butthisisabuginPafish(thewindowtocheckistooshort),andnotinVMRay.

Page 13: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

12

Page 14: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

13

Whenitcomestodetectingthedifferencebetweenthetargetcomputerandtheanalysisenvironment,thefollowingresearchisuseful:

https://github.com/MRGEffitas/Sandbox_tester

https://www.youtube.com/watch?v=-wN5XvrfuxY

Byrunningthetool,wecanbesurethattheVMRayenvironmentfakesthefollowinginordertobeundetectableformalwarewhichtargetsthedesktopenvironment:

• Thereareiconsandfilesonthedesktop• Therearestandardapplicationsinstalled• ThereareapplicationswithGUIrunninginthebackground• Therearenon-defaultbookmarksinInternetExplorer• Thereisaprinterattachedtothesystem• Allthehardwaredescriptorsmatchadesktopsystem• Thegettickcountandlastbootuptimeshowsthatthesystemisalreadyupandrunningfora

while• Thescreenresolutionmatchesadesktopresolution• Thesysteminteractswithmessageboxes(atrickcommonlyusedinRATsamples)• Thesleepdetectionofthescriptcan’tdetectthepresenceofsleephooking,butinreality,

sleepsarefast-forwarded.

Page 15: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

14

• Non-defaultdesktopbackgroundisused

Todefeatcontext-awaremalware(almostexclusivelyusedinAPTattacks),onehastoknowwhatconfiguration/environmentisexpectedbythemalware.Whenthisisknown,eithertheprescriptsortheinteractionwiththeVMduringtheanalysiscanbeusedtotriggerthemaliciouspayloadbythemalware.Alternatively,whenrunon-prematacustomersite,VMRaycanusethecustomer’sowngoldimagesastargetmachinesforanalysis.

SupportedfiletypesandanalysisenvironmentsFinding

Thesupportedfiletypesandanalysisenvironments(withOS,programversionsandpatchlevels)makeitusefultoanalyseanyin-the-wildthreat.

Page 16: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

15

Page 17: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

16

UsefulreportsFinding

Thereportsgeneratedbythesystemareusefulforbothbeginnersandadvancedusers.

Page 18: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

17

Page 19: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

18

EasyinteractionwiththesandboxduringtheanalysisFinding

Itisnotuncommonthatthesamplewon’tstartwithoutanyspecificuseractivity.E.g.somesamplesuse

aninstaller,whereauserhastoclickthroughaseriesofwindowsbeforethemaliciouspayloadis

delivered.TheVMRaymalwareanalysissandboxenvironmenthasautomatedusersimulation,providing

themouseandkeyboardinputthemalwarewouldtypicallyexpect.Italsomakesiteasytomanually

interactwiththeenvironmentduringanalysis,byonlyusingthewebbrowserandHTML5technology.

Fortaskswhichcanbeautomated,prescriptscanbewrittenanduploadedtotheanalysisenvironment.

Thesescriptscanchangetheanalysisenvironmentforthespecifiedmalware.EXE,BatchFile,Windows

scriptinghostfileetc.canbeusedforaprescript.

YARArulesimplementedFinding

YARA“providesarule-basedapproachtocreatedescriptionsofmalwarefamiliesbasedontextualor

binarypatterns.”Itisagreattooltoclassifyknownmalware,andalsotoidentifynewsamplesfor

knownmalwarefamilies.YARAisespeciallyeffectivewhenthesampleispacked,buttheruleisusedon

theunpacked,in-memoryprocess.YARAcanalsobeusedtodetectdocumentfiles(Word,Excel,PDF)

containingexploits.

VMRayincorporatesYARArulestodetectthevariantsfromknownfamilies,andtodetectnewsamples

ofknownexploits.Theyareappliedtovariousanalysisartifacts(extractedfiles,processdumps,network

dumps,etc.).

StrongresistanceagainstpackersFinding

Traditionalendpointprotectioncanbebypassedbypackerswithrelativeease.Bypackingafile,the

behaviourofthemalwareiskept,butthestructureoftheoriginalmalwareislost,thusblacklistslike

signaturebaseddetectionscanbebypassedeasily.Malwareanalysissandboxesweredevelopedto

Page 20: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

19

inspectthebehaviourofthesamples.Soanymalwareanalysissandboxshouldhavegoodresistance

againstpackers–andsodoesVMRay.Alotofpackersintegratedanti-sandboxsolutions,whichmakes

theanalysisinasandboxhard.Thisiswhyanti-anti-sandboxsolutionsimplementedintoVMRayare

important.

Hashbasedreputation,MetadefenderandVirusTotalintegrationFinding

Samplehashescanbesenttoexternalreputationengines,andifthesampleisalreadyknown,theresult

ofthereputationcheckcanbeincludedinthereport.

Incasethesampleisnotknowntothereputationenginebythehash,butisknowntooneormoreAV

engines,MetadefendercanbeintegratedintoVMRay,andthedetectioncanbeimprovedwiththe

knowledge-baseofthemultipleAVscannersrunninginMetadefender.Iftheconfidentialityofthefiles

arenotimportant,thefilescanbedirectlyuploadedtoVirusTotal.

MaliciousscriptsaredetectedFinding

SomemalwareanalysissandboxesfocusmostlyonEXEfiles.Butattackersuseavarietyoffilesand

techniques.OneofthemostrecenttargetedattacksemployedPowerShell.VMRaycandetect

obfuscatedormaliciousPowerShellattacks–andnotjustbycheckingthebehaviourofthemalware

processes,butbycheckingforknowntechniquesusedinPowerShellattacks–e.g.useofencoded

PowerShellattacks.

Page 21: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

20

Page 22: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

21

SolidbrowserexploitdetectionviaURLanalysisFinding

TheURLanalysismodulewasabletodetectin-the-wildexploitkitslikeRIGorSundownonliveURLs.

TheexploitkitstargetedvulnerabilitiesinInternetExplorerandinFlash.

Page 23: VMRAY MALWARE ANALYSIS SANDBOX EFFICACY ASSESSMENT · There are three main type of attacks where attackers can detect the malware analysis sandbox, and change the malware behaviour

22

ConclusionWefoundtheVMRaymalwareanalysissandboxtobeanexcellenttooltodetectmalicioussoftware,

documentscontainingexploitsormaliciousURLs.Thedevelopersofthesystemclearlyunderstandthe

threatlandscape,anddevelopedthesystemaccordingly.Itishighlyrecommendedfordigitalforensics

andincidentresponse(DFIR)professionalsandaspartofasuiteoftoolsforCERTs.


Related Documents
FireEye Wins Global Advanced Malware Sandbox Market ...

FireEye Wins Global Advanced Malware Sandbox Market ...

Category: Documents
Defeating Evasive Malware (VMRay Whitepaper) - Malware … · 2020-03-10 · the presence of a virtual machine or hypervisor. • Evasion by using time, event or environment based

Defeating Evasive Malware (VMRay Whitepaper) - Malware...

Category: Documents
Tasty Malware Analysis with T.A.C.O. - FIRST · Tasty Malware Analysis with T.A.C.O. ... Malware Analysis Challenges ... • DLL Side-loading 9. Cuckoo Sandbox • Popular open-source

Tasty Malware Analysis with T.A.C.O. - FIRST · Tasty...

Category: Documents
Advanced Malware Sandbox Market Analysis - FireEye · K083-74 1 K083-74 September 2016 Advanced Malware Sandbox Market Analysis “Must Have” Security Technology Reaches Mass Adoption

Advanced Malware Sandbox Market Analysis - FireEye ·...

Category: Documents
STEALTH SANDBOX ANALYSIS OF MALWARE

STEALTH SANDBOX ANALYSIS OF MALWARE

Category: Documents
Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox....

Category: Technology
Malware Sandbox Analysis

Malware Sandbox Analysis

Category: Documents
2016 HITCON Malware is In the Memory · Cuckoo Sandbox - Malware Automatic Analysis System - Windows ... . ... New Malware Analysis System

2016 HITCON Malware is In the Memory · Cuckoo Sandbox -...

Category: Documents
Detectionofdebuggeraware malware - Aalborg Universitetprojekter.aau.dk/projekter/files/213622016/master.pdf · Detectionofdebuggeraware malware Project Report ... and a Cuckoo Sandbox

Detectionofdebuggeraware malware - Aalborg...

Category: Documents
Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

Memory Forensics -  · Memory Forensics An introduction ......

Category: Documents
STEALTH SANDBOX ANALYSIS OF MALWARE · ABSTRACT STEALTH SANDBOX ANALYSIS OF MALWARE Omer Sezgin U˘gurlu¨ M.S. in Computer Engineering Supervisor: Assist. Prof. Dr. Ali Aydin Selc¸uk

STEALTH SANDBOX ANALYSIS OF MALWARE · ABSTRACT STEALTH...

Category: Documents
Deep Malware Analysis - Joe Sandbox Sandbox Cloud Feature... · Sandbox Cloud Deep Malware Analysis Classification Ransomware Spreading Phishing Banker Adware Trojan / Bot Spyware

Deep Malware Analysis - Joe Sandbox Sandbox Cloud...

Category: Documents