Hypervisor AMSI Interception for VM Malware Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware employing detection evasion techniques can evade detection by antimalware software integrated with the Windows Antimalware Scan Interface (AMSI) due to its presence within the virtual machine, leading to incomplete malware analysis.
Innovation Solution
A hypervisor-based monitoring service intercepts AMSI events and registers a dummy AMSI provider to analyze data outside the virtual machine, using virtual machine introspection to detect and block AMSI bypass attempts, allowing for more comprehensive malware analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antimalware software is integrated with AMSI inside the virtual machine, then malware detection capability is improved, but malware can detect the presence of AMSI and evade detection
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the malware in the virtual machine and the AMSI scanning system. The hypervisor intercepts AMSI function calls and redirects them to a dummy AMSI provider inside the VM, while the actual scanning is performed by the monitoring service outside the VM. This mediator approach allows detection while preventing malware from detecting the real AMSI provider.
Solution Approach 2:
The patent creates a dummy AMSI provider that copies the interface of the real AMSI provider but does not perform actual scanning. This copy deceives malware into thinking the real AMSI is present and operational, while the hypervisor captures all scanning attempts and analyzes them externally. The copy maintains compatibility without exposing the real detection system.
2Measurement precision
If a real AMSI provider is loaded into the virtual machine for scanning, then malware analysis is improved, but the malware can detect and bypass the scanner
Solution Approach 1:
The hypervisor acts as an intermediary that captures AMSI function calls before they reach the dummy provider. The monitoring service outside the VM receives these intercepted calls and performs the actual malware analysis, maintaining high detection accuracy while preventing malware from detecting the analysis system.
Solution Approach 2:
Instead of having the AMSI provider detect malware directly inside the VM, the patent inverts the detection architecture: the dummy provider appears to be the detector, but the real detection happens outside the VM through the hypervisor. This inversion prevents malware from detecting the analysis system while maintaining accurate malware analysis capability.
3Adaptability or versatility
If AMSI scanning is performed inside the virtual machine, then integration with Windows services is improved, but the scanning system can be detected by malware
Solution Approach 1:
The hypervisor serves as an intermediary that maintains AMSI integration with Windows services outside the VM while preventing malware inside the VM from detecting the scanning system. All AMSI function calls are intercepted and redirected, allowing Windows service integration to function normally while the malware remains unaware of the real scanning system.
Solution Approach 2:
The dummy AMSI provider inside the VM creates a copy of the AMSI interface that maintains compatibility with Windows services and applications, allowing them to function normally. This copy prevents malware from detecting the real scanning system while the hypervisor captures and analyzes all scanning attempts externally.
Data Source
AI summary
A hypervisor-based service monitors antimalware scan interface (AMSI) events triggered from inside a virtual machine (VM) to analyze behavior of software samples. A sample is loaded into a VM for execution by an AMSI-enabled application/service of the VM. The monitoring service can register a dummy AMSI provider for the VM, which enables the AMSI for compatible applications/services of the VM upon registration but does not implement buffer scanning or analysis. The monitoring service hooks into at least a first function of the AMSI by which buffers are submitted for a malware scan. Upon invocation of the function from inside the VM, the monitoring service intercepts the buffer submission and analyzes the buffer based on criteria for detecting an AMSI bypass attempt. If at least a first AMSI bypass detection criterion is satisfied, the monitoring service blocks the attempted AMSI bypass and continues monitoring execution of the sample.