# Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques
## 4 Analytics Environment and Methodology
### Analytics Environment
Our initial release of MORRIGU supports five different anti-evasion methods, which we choose due to them being recognised as common methods of malware evasion [2], yet could also yield different malware behaviours based on how the method parameters are configured and so benefit from dynamic reconfiguration. The five methods are as follows. * **Guest Additions Uninstalled (GAU):** This script will perform uninstallation of the Guest Additions software on the virtualised environment. It will also check the Windows Registry for the phrase \"Guest Additions\" to ensure that all traces are removed. Due to practicalities with the testing set-up, it was more efficient to remove the installed tools rather than install when required. * **Trigger-Based Activation/Time Jump (TJ):** This script will perform a \"time jump\" by increasing the system clock by 59 min (as a default value); 59 min was chosen as the default so that both hour and minute would be updated. * **Common Artefact Creation (CAC):** This script will create new files within the user directories (Documents, Downloads, Favourites, Desktop and Pictures) to simulate user activity. For the Documents, Downloads and Desktop folders, the script creates files in these directories based on four commonly used file types: TXT, PDF, ZIP and CSV. For the pictures folder, the contents of pre-existing Windows Themes Cached Files location are copied across and the files are renamed simply to a random number with a jpg extension. For the Favourites folder, a URI is currently created to a single website (which could be extended to a set of websites as defined by the user). * **Registry Edit (RegEdit):** This script will search name-value pairs in the Windows Registry, and will perform find and replace on any given phrases. For our study, we replace \"VirtualBox\", \"VBox\" and \"VMWare\", with \"Lenovo\", however a user could provide any text entry. * **Reverse Turing Test (RTT):** This script will imitate end user interaction, which is well-recognised as a key malware evasion technique [4, 20, 26, 29]. This is in part due to the ability to measure the reaction and input speeds, allowing malware to remain inactive or benign when the speeds are believed to be too fast, indicating a machine user rather than human user [4, 29]. As default the script will move the mouse around the screen either using a randomised array or preset positions. Unlike Cuckoo, the script will interpolate between points to provide realistic movement. The script will also vary the mouse speed whilst moving, and will randomise a sleep period at each point between 0.6 to 1.5 s, so as to provide some variation in motion to avoid a consistent appearance. Using the MORRIGU configuration, automated keyboard entry and mouse movement patterns can be further customised. Furthermore, the script will also open various applications on the system, and receive inputs from the keyboard (e.g., typing in notepad), so as to simulate further user interactions. As with mouse movements, keyboard entry also utilises randomised sleep patterns. As these dynamic modifications are independent, there are 32 possible configurations that can be tested by our system using default configurations (31 permutations ranging from 1 to 5 of the possible methods being set as true, plus the state of \"no change\"). Each method can either be deployed using default or user-defined parameters, and so naturally there exist many more possible combinations of how a user may test different anti-evasion methods. As an example, for testing against Registry Edits, a user may want to check how the testing environment performs when only the value \"VirtualBox\" is replaced with \"Microsoft\", or when the values \"VirtualBox\" and \"VBox\" are both replaced. Clearly testing all possible combinations for text replacement would be unfeasible, and is considered out of scope for this paper, although our approach makes it easier to test a given set of text replacement terms for investigation.