search

hatching / vmcloak

Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
483 stars 120 forks source link

Values in HKLM\Hardware are reset after reboot #23

Closed wbenny closed 8 years ago

wbenny commented 9 years ago

Wouldn't it be appropriate to run subset of functions from bootstrap.py (namely, the registry renaming) after reboot?

jbremer commented 9 years ago

Would probably make sense ;)

doomedraven commented 9 years ago

i put .bat into startup dir, and after reboots i have patched machine :)

jhg commented 9 years ago

@jbremer sense is that when a malware reload machine, then look that is a VM, also Cuckoo has problems when VM reload during analysis.

@doomedraven is one solution, problem is that a malware search in startup dir or in run or runonce registry keys, then it look .bat and know that is a VM for malware analysis. One step more is that .bat change name random each time, but still a malware can search into .bat content or only when not look .bat run reality.

jbremer commented 8 years ago

This functionality has since moved to Cuckoo itself, so going to close this issue now. Thanks!