Analyzing Malware Sandbox Evasion Techniques

TL;DR

• 目的：Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction che…
• 适用：恶意软件分析/逆向
• 输入：样本文件/二进制/HASH
• 输出：漏洞报告/发现清单
• 红线：样本在隔离沙箱中执行；禁止连接生产网络
• 关联：上游：003-src-session-start → 下游：071-configuring-oauth2-authorization-flow, 073-hunt-rag-vector, 072-hunt-llm-ai

Analyzing Malware Sandbox Evasion Techniques

Quick Start

# Cuckoo 提交样本
cuckoo submit /path/to/sample.exe
# Cuckoo 查看报告
cuckoo web --url http://localhost:8000

Overview

Sandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.

When to Use

• When investigating security incidents that require analyzing malware sandbox evasion techniques
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports
• Python 3.8+ with json library for report parsing
• Behavioral report exports in JSON format

Workflow

1. Parse Cuckoo/AnyRun behavioral report JSON files
2. Extract API call sequences for timing-related functions
3. Identify VM artifact detection via registry queries and WMI calls
4. Detect sleep inflation by comparing requested vs actual sleep durations
5. Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)
6. Score evasion sophistication based on technique count and diversity
7. Map detected techniques to MITRE ATT&CK T1497 sub-techniques

Output Format

JSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).

Workflow

1. Recon — Identify authentication mechanisms via 005-analyzing-tls-certificate-transparency-logs and 017-configuring-tls-1-3-for-secure-communications
2. Endpoint discovery — OAuth flows, SAML endpoints, JWT tokens, session cookies
3. Token analysis — Decode JWT, check signature, inspect claims
4. Auth bypass testing — Token replay, none algorithm, scope escalation
5. Verification — Run 111-fp-check for cross-tool verification
6. Documentation — Fill report template

Advanced Techniques

Detect Sandbox via Timing Attacks

import time

start = time.time()
# 执行一些操作
time.sleep(0.001)
elapsed = time.time() - start

if elapsed > 0.5:
    print("Sandbox detected (timing)")

Detect VM via Hardware Fingerprints

import subprocess

# CPUID 指令可检测 VM
if subprocess.run(["grep", "-q", "hypervisor", "/proc/cpuinfo"]).returncode == 0:
    print("VM detected")

Bypass via Long Sleep

import ctypes
# 30 分钟睡眠以绕过沙箱超时
ctypes.windll.kernel32.Sleep(1800 * 1000)