Anti-virtualization technique used by malware and measures that can be taken

Malware analysis has been improved over the years. In the analysis process, which can be divided into dynamic and static, dynamic analysis processes have developed due to the fact that static analysis cannot give behavioral results. Sandboxes can perform automatic dynamic analysis in very short time and present the report to the analyst. Therefore, today's malware has begun to use anti-analysis methods to be not detected or even if they detected they prolong the analysis times of their behavior. The motivation of malware to do this is to increase all kinds of returns. Therefore, in order to avoid all analysis techniques, new techniques are being developed and the use of these techniques by malware is increasing. The use of virtual environments is actively involved in malware analysis. It is essential for manual analysis due to the ability to create an optional environment, does not contain any personal data and transition between analysis steps is simple. Also, they preferred by sandboxes since they provide same facilities. Malware uses many methods to ensure that it is not malicious in both analysis processes. The anti-virtualization method, which is one of these methods, covers a vii wide area among all anti-analysis methods since virtual environments are also used in sandboxes. The difference in the virtualization techniques used by the products used for virtualization is the motivation of malicious software developers to work more on this issue. Therefore, many anti-virtualization techniques are currently being used by malware. Hardware and software controls can be performed for the detection of virtual environment. System resources or the signatures of virtualization platform can be checked by hardware. There is also information about virtualization platforms that can be accessed from within the operating system by software. Structures such as the Windows Registry, Windows Management Instrumentation facilitate the detection of virtual machines since they contain signatures belonging to many virtualization platforms, especially when there is a Windows operating system in the virtual machine. In this study, anti-virtualization methods used by malware are examined on VMware the most preferred virtualization environment and on Windows 10 the most preferred operating system. Measures that can be taken against these virtualization methods are explained. Another method used against virtualization is Windows Management Instrumentation. This method, which was not taken precaution by most sandboxes, was examined and the ways to prevent this method by using hooking technique were explained. A hooking application has been developed that can be used for Windows Management Instrumentation and it has been shown that anti-virtualization techniques can be taken with this application.