Malware Analysis in Virtual Machines

MALWARE ANALYSIS IN
VIRTUAL MACHINES
Before you can run malware to perform dynamic
analysis, you must set up a safe environment. Fresh
malware can be full of surprises, and if you run it on
a production machine, it can quickly spread to other
machines on the network and be very difficult to remove. A safe environment
will allow you to investigate the malware without exposing your machine or
other machines on the network to unexpected and unnecessary risk.
You can use dedicated physical or virtual machines to study malware
safely. Malware can be analyzed using individual physical machines on airgapped networks. These are isolated networks with machines that are disconnected from the Internet or any other networks to prevent the malware from
spreading.
Air-gapped networks allow you to run malware in a real environment
without putting other computers at risk. One disadvantage of this test scenario, however, is the lack of an Internet connection. Many pieces of malware depend on a live Internet connection for updates, command and
control, and other features.
30 Chapter 2
Another disadvantage to analyzing malware on physical rather than virtual machines is that malware can be difficult to remove. To avoid problems,
most people who test malware on physical machines use a tool such as Norton Ghost to manage backup images of their operating systems (OSs), which
they restore on their machines after they’ve completed their analysis.
The main advantage to using physical machines for malware analysis is
that malware can sometimes execute differently on virtual machines. As
you’re analyzing malware on a virtual machine, some malware can detect
that it’s being run in a virtual machine, and it will behave differently to
thwart analysis.
Because of the risks and disadvantages that come with using physical
machines to analyze malware, virtual machines are most commonly used for
dynamic analysis. In this chapter, we’ll focus on using virtual machines for
malware analysis.
The Structure of a Virtual Machine
Virtual machines are like a computer inside a computer, as illustrated in Figure 2-1. A guest OS is installed within the host OS on a virtual machine, and
the OS running in the virtual machine is kept isolated from the host OS.
Malware running on a virtual machine cannot harm the host OS. And if the
malware damages the virtual machine, you can simply reinstall the OS in the
virtual machine or return the virtual machine to a clean state.
Figure 2-1: Traditional applications run as shown in the left
column. The guest OS is contained entirely within the virtual
machine, and the virtual applications are contained within
the guest OS.
VMware offers a popular series of desktop virtualization products that
can be used for analyzing malware on virtual machines. VMware Player is free
and can be used to create and run virtual machines, but it lacks some features necessary for effective malware analysis. VMware Workstation costs a
little under $200 and is generally the better choice for malware analysis. It
Application
Application
Application
Physical Machine
Virtual
Application
Virtual
Application
Virtual Machine
Guest OS
Host OS
Malware Analysis in Virtual Machines 31
includes features such as snapshotting, which allows you to save the current
state of a virtual machine, and the ability to clone or copy an existing virtual
machine.
There are many alternatives to VMware, such as Parallels, Microsoft Virtual PC, Microsoft Hyper-V, and Xen. These vary in host and guest OS support and features. This book will focus on using VMware for virtualization,
but if you prefer another virtualization tool, you should still find this discussion relevant.
Creating Your Malware Analysis Machine
Of course, before you can use a virtual machine for malware analysis, you
need to create one. This book is not specifically about virtualization, so we
won’t walk you through all of the details. When presented with options, your
best bet, unless you know that you have different requirements, is to choose
the default hardware configurations. Choose the hard drive size based on
your needs.
VMware uses disk space intelligently and will resize its virtual disk dynamically based on your need for storage. For example, if you create a 20GB hard
drive but store only 4GB of data on it, VMware will shrink the size of the virtual hard drive accordingly. A virtual drive size of 20GB is typically a good
beginning. That amount should be enough to store the guest OS and any
tools that you might need for malware analysis. VMware will make a lot of
choices for you and, in most cases, these choices will do the job.
Next, you’ll install your OS and applications. Most malware and malware
analysis tools run on Windows, so you will likely install Windows as your virtual OS. As of this writing, Windows XP is still the most popular OS (surprisingly) and the target for most malware. We’ll focus our explorations on
Windows XP.
After you’ve installed the OS, you can install any required applications.
You can always install applications later, but it is usually easier if you set up
everything at once. Appendix B has a list of useful applications for malware
analysis.
Next, you’ll install VMware Tools. From the VMware menu, select VM
Install VMware Tools to begin the installation. VMware Tools improves the
user experience by making the mouse and keyboard more responsive. It also
allows access to shared folders, drag-and-drop file transfer, and various other
useful features we’ll discuss in this chapter.
After you’ve installed VMware, it’s time for some configuration.
Configuring VMware
Most malware includes network functionality. For example, a worm will perform network attacks against other machines in an effort to spread itself. But
you would not want to allow a worm access to your own network, because it
could to spread to other computers.
32 Chapter 2
When analyzing malware, you will probably want to observe the malware’s
network activity to help you understand the author’s intention, to create signatures, or to exercise the program fully. VMware offers several networking
options for virtual networking, as shown in Figure 2-2 and discussed in the
following sections.
Figure 2-2: Virtual network configuration options for a network adapter
Disconnecting the Network
Although you can configure a virtual machine to have no network connectivity, it’s usually not a good idea to disconnect the network. Doing so will be
useful only in certain cases. Without network connectivity, you won’t be able
to analyze malicious network activity.
Still, should you have reason to disconnect the network in VMware, you
can do so either by removing the network adapter from the virtual machine
or by disconnecting the network adapter from the network by choosing
VMRemovable Devices.
You can also control whether a network adapter is connected automatically when the machine is turned on by checking the Connect at power on
checkbox (see Figure 2-2).
Setting Up Host-Only Networking
Host-only networking, a feature that creates a separate private LAN between the
host OS and the guest OS, is commonly used for malware analysis. A host-only
LAN is not connected to the Internet, which means that the malware is contained within your virtual machine but allowed some network connectivity.
Malware Analysis in Virtual Machines 33
NOTE When configuring your host computer, ensure that it is fully patched, as protection in
case the malware you’re testing tries to spread. It’s a good idea to configure a restrictive
firewall to the host from the virtual machine to help prevent the malware from spreading to your host. The Microsoft firewall that comes with Windows XP Service Pack 2
and later is well documented and provides sufficient protection. Even if patches are
up to date, however, the malware could spread by using a zero-day exploit against the
host OS.
Figure 2-3 illustrates the network configuration for host-only networking.
When host-only networking is enabled, VMware creates a virtual network
adapter in the host and virtual machines, and connects the two without
touching the host’s physical network adapter. The host’s physical network
adapter is still connected to the Internet or other external network.
Figure 2-3: Host-only networking in VMware
switch. In this case, the host machine is still connected to the external
network, but not to the machine running the malware.
When using more than one virtual machine for analysis, you’ll find
it useful to combine the machines as a virtual machine team. When your
machines are joined as part of a virtual machine team, you will be able to
manage their power and network settings together. To create a new virtual
machine team, choose FileNewTeam.
Using Multiple Virtual Machines
One last configuration combines
the best of all options. It requires
multiple virtual machines linked
by a LAN but disconnected from
the Internet and host machine, so
that the malware is connected to a
network, but the network isn’t
connected to anything important.
Figure 2-4 shows a custom
configuration with two virtual
machines connected to each
other. In this configuration, one
virtual machine is set up to analyze malware, and the second
machine provides services. The
two virtual machines are connected to the same VMNet virtual
Figure 2-4: Custom networking in VMware
External
Network
Virtual Machine
Host
Physical Machine
NIC NIC NIC
Host
Physical Machine
NIC
Services
Virtual Machine
NIC
Analysis
Virtual Machine
NIC
External
Network
VMNet
34 Chapter 2
Using Your Malware Analysis Machine
To exercise the functionality of your subject malware as much as possible, you
must simulate all network services on which the malware relies. For example,
malware commonly connects to an HTTP server to download additional malware. To observe this activity, you’ll need to give the malware access to a
Domain Name System (DNS) server to resolve the server’s IP address, as
well as an HTTP server to respond to requests. With the custom network
configuration just described, the machine providing services should be running the services required for the malware to communicate. (We’ll discuss a
variety of tools useful for simulating network services in the next chapter.)
Connecting Malware to the Internet
Sometimes you’ll want to connect your malware-running machine to the
Internet to provide a more realistic analysis environment, despite the obvious risks. The biggest risk, of course, is that your computer will perform
malicious activity, such as spreading malware to additional hosts, becoming a
node in a distributed denial-of-service attack, or simply spamming. Another
risk is that the malware writer could notice that you are connecting to the
malware server and trying to analyze the malware.
You should never connect malware to the Internet without first performing some analysis to determine what the malware might do when connected.
Then connect only if you are comfortable with the risks.
The most common way to connect a virtual machine to the Internet using
VMware is with a bridged network adapter, which allows the virtual machine to be
connected to the same network interface as the physical machine. Another
way to connect malware running on a virtual machine to the Internet is to
use VMware’s Network Address Translation (NAT) mode.
NAT mode shares the host’s IP connection to the Internet. The host
acts like a router and translates all requests from the virtual machine so
that they come from the host’s IP address. This mode is useful when the
host is connected to the network, but the network configuration makes it
difficult, if not impossible, to connect the virtual machine’s adapter to the
same network.
For example, if the host is using a wireless adapter, NAT mode can be
easily used to connect the virtual machine to the network, even if the wireless
network has Wi-Fi Protected Access (WPA) or Wired Equivalent Privacy (WEP)
enabled. Or, if the host adapter is connected to a network that allows only
certain network adapters to connect, NAT mode allows the virtual machine
to connect through the host, thereby avoiding the network’s access control
settings.
Connecting and Disconnecting Peripheral Devices
Peripheral devices, such as CD-ROMs and external USB storage drives, pose
a particular problem for virtual machines. Most devices can be connected
either to the physical machine or the virtual machine, but not both.
Malware Analysis in Virtual Machines 35
The VMware interface allows you to connect and disconnect external
devices to virtual machines. If you connect a USB device to a machine while
the virtual machine window is active, VMware will connect the USB device
to the guest and not the host, which may be undesirable, considering the
growing popularity of worms that spread via USB storage devices. To modify
this setting, choose VMSettingsUSB Controller and uncheck the Automatically connect new USB devices checkbox to prevent USB devices from
being connected to the virtual machine.
Taking Snapshots
Taking snapshots is a concept unique to virtual machines. VMware’s virtual
machine snapshots allow you save a computer’s current state and return to
that point later, similar to a Windows restore point.
The timeline in Figure 2-5 illustrates how taking snapshots works. At 8:00
you take a snapshot of the computer. Shortly after that, you run the malware
sample. At 10:00, you revert to the snapshot. The OS, software, and other
components of the machine return to the same state they were in at 8:00,
and everything that occurred between 8:00 and 10:00 is erased as though it
never happened. As you can see, taking snapshots is an extremely powerful
tool. It’s like a built-in undo feature that saves you the hassle of needing to
reinstall your OS.
Figure 2-5: Snapshot timeline
After you’ve installed your OS and malware analysis tools, and you have
configured the network, take a snapshot. Use that snapshot as your base,
clean-slate snapshot. Next, run your malware, complete your analysis, and
then save your data and revert to the base snapshot, so that you can do it all
over again.
But what if you’re in the middle of analyzing malware and you want to do
something different with your virtual machine without erasing all of your
progress? VMware’s Snapshot Manager allows you to return to any snapshot
at any time, no matter which additional snapshots have been taken since
then or what has happened to the machine. In addition, you can branch
your snapshots so that they follow different paths. Take a look at the following example workflow:

While analyzing malware sample 1, you get frustrated and want to try
another sample.
You take a snapshot of the malware analysis of sample 1.
You return to the base image.
8:00 8:30 9:00 9:30 10:00
Snapshot
Taken
Launch
Malware
Malware Executing Revert to
Snapshot
36 Chapter 2
You begin to analyze malware sample 2.
You take a snapshot to take a break.
When you return to your virtual machine, you can access either snapshot
at any time, as shown in Figure 2-6. The two machine states are completely
independent, and you can save as many snapshots as you have disk space.
Figure 2-6: VMware Snapshot Manager
Transferring Files from a Virtual Machine
One drawback of using snapshots is that any work undertaken on the virtual
machine is lost when you revert to an earlier snapshot. You can, however,
save your work before loading the earlier snapshot by transferring any files
that you want to keep to the host OS using VMware’s drag-and-drop feature.
As long as VMware Tools is installed in the guest OS and both systems are
running Windows, you should be able to drag and drop a file directly from
the guest OS to the host OS. This is the simplest and easiest way to transfer
files.
Another way to transfer your data is with VMware’s shared folders. A
shared folder is accessible from both the host and the guest OS, similar to a
shared Windows folder.
The Risks of Using VMware for Malware Analysis
Some malware can detect when it is running within a virtual machine, and
many techniques have been published to detect just such a situation. VMware
does not consider this a vulnerability and does not take explicit steps to avoid
Malware Analysis in Virtual Machines 37
detection, but some malware will execute differently when running on a virtual machine to make life difficult for malware analysts. (Chapter 17 discusses
such anti-VMware techniques in more detail.)
And, like all software, VMware occasionally has vulnerabilities. These can
be exploited, causing the host OS to crash, or even used to run code on the
host OS. Although only few public tools or well-documented ways exist to
exploit VMware, vulnerabilities have been found in the shared folders feature, and tools have been released to exploit the drag-and-drop functionality.
Make sure that you keep your VMware version fully patched.
And, of course, even after you take all possible precautions, some risk is
always present when you’re analyzing malware. Whatever you do, and even
if you are running your analysis in a virtual machine, you should avoid performing malware analysis on any critical or sensitive machine.
Record/Replay: Running Your Computer in Reverse
One of VMware’s more interesting features is record/replay. This feature in
VMware Workstation records everything that happens so that you can replay
the recording at a later time. The recording offers 100 percent fidelity; every
instruction that executed during the original recording is executed during a
replay. Even if the recording includes a one-in-a-million race condition that
you can’t replicate, it will be included in the replay.
VMware also has a movie-capture feature that records only the video output, but record/replay actually executes the CPU instructions of the OS and
programs. And, unlike a movie, you can interrupt the execution at any point
to interact with the computer and make changes in the virtual machine. For
example, if you make a mistake in a program that lacks an undo feature, you
can restore your virtual machine to the point prior to that mistake to do
something different.
As we introduce more tools throughout this book, we’ll examine many
more powerful ways to use record/replay. We’ll return to this feature in
Chapter 8.