Attempts to identify installed AV products by registry key
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Antivirus
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVG\SZBrowser
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Secure VPN
- Registry:
- HKEY_LOCAL_MACHINE\Software\AVG\Antivirus
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Cleanup
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVG\TuneUp
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\SZBrowser
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Cleanup
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Avast
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Tuneup
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\SecureLine
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast
- Registry:
- HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Business Agent
- Registry:
- HKEY_LOCAL_MACHINE\Software\AVAST Software\Avast
Looks for the Windows Idle Time to determine the uptime
PID |
API |
Arguments |
2624 |
NtQuerySystemInformation |
- information_class:
- 8
|
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available
PID |
API |
Arguments |
2572 |
GlobalMemoryStatusEx |
N/A |
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation
PID |
API |
Arguments |
2624 |
GetDiskFreeSpaceExW |
- total_number_of_free_bytes:
- 0
- free_bytes_available:
- 5237858304
- root_path:
- total_number_of_bytes:
- 0
|
Queries information on disks, possibly for anti-virtualization
PID |
API |
Arguments |
2624 |
NtCreateFile |
- create_disposition:
- 1
- file_handle:
- 0x000001c4
- filepath:
- \??\PhysicalDrive0
- desired_access:
- 0x00100080
- file_attributes:
- 0
- filepath_r:
- \??\PhysicalDrive0
- create_options:
- 96
- status_info:
- 0
- share_access:
- 3
|
2624 |
DeviceIoControl |
- input_buffer:
|