Hyper-V Virtual Machine Hardening

This article shows how a virtual machin(VM) can be modified to evade detection from malware. This process is also called VM hardening. In dynamic malware analysis, researchers use virtual machines to execute malware in a safe and isolated environment in order to monitor and investigate its behavior. This is why malware author started to use Anit-VM techniques to detect if their programs are running inside a virtual environment and subsequently evade the analysis process. In this article a virtual machine is set up and a number of open-source VM-detection tools is executed to see how the VM can be detected by malware. Afterwards countermeasures are implemented to mitigate the detection rate of the tools.

Setup

Hyper-V is used for the virtualization. This is because it is a Type 1, bare-metal, Hypervisor, which runs directly on the host's hardware to control the hardware and to manage guest operating systems.

Further specifications are:

Host OS: Windows 11
Hypervisor: Microsoft Hyper-V
Guest OS (VM OS): Windows 10

Three tools are used for the VM detection. They are all open-source and can be found on GitHub:

Initial Test Run

After the virtual machine setup is complete and all the tools have been installed, a first test can be conducted.

In the unmodified, native machine the tools show a number of positive checks, that hint towards a VM:

Pafish 13 + VMAware 13 + Al-Khaser 31 = 57 positive detections

These numbers are likely to vary between different setups and tool versions.

Hardening Steps

This section contains some system modifications that lower the number of positive detections.

Virtual Hardware Specifications

Common checks aim at the system hardware. If the disk, memory or processor contain strange values, which typcially cannot be found on normal machines, the malware might see this as a sign of a VM.

Very low or odd numbers are highly unlikey in a physical machine. Therefore, see that the VM has at least the following requirements:

60-80 GB disk size
4-8 GB memory size and no odd numbers
At least 4 processor cores and no odd numbers

With Hyper-V, these values can be configured in the machine settings:

Windows Registry

The Windows registry is a central database in Microsoft Windows that stores configuration information and settings for the operating system, installed applications and hardware components.

The manufacturers of virtualisation software also store information for their products here. products. Malware checks whether known keys exist or whether they contain special strings such as ‘virtual’ or the manufacturer's name.

Delete the following Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters

From this Key, delete the substring "virtual" from the values: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk\Enum