{"id":5586,"date":"2018-11-22T01:10:07","date_gmt":"2018-11-22T01:10:07","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5586"},"modified":"2018-11-22T01:10:07","modified_gmt":"2018-11-22T01:10:07","slug":"using-start-time-of-the-existing-guest-os-processes-as-a-possible-anti-trick","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/11\/22\/using-start-time-of-the-existing-guest-os-processes-as-a-possible-anti-trick\/","title":{"rendered":"Using Start Time of the existing guest OS processes as a possible Anti-* trick"},"content":{"rendered":"<p>When you run the WMI command:<\/p>\n<pre>wmic process get name, creationdate<\/pre>\n<p>you get a list of process names, and their creation dates.<\/p>\n<p>When I was testing it on my VM I realized that the results expose my VM as a sandbox. Since I saved the VM snapshot a while ago, the creation dates of many running processes were really old. Only a few processes had today&#8217;s date.<\/p>\n<p>So, if you see any process (or a cluster of processes) that is older than&#8230; say&#8230; 6-12 months, it is highly possible that the sample is executed inside a sandbox. While the uptimes are much longer now than in the past, systems that run processes for more than a year are suspicious; after all, patching affects all the systems and if there was no restart within last year it&#8217;s at least unusual&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When you run the WMI command: wmic process get name, creationdate you get a list of process names, and their creation dates. When I was testing it on my VM I realized that the results expose my VM as a &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/11\/22\/using-start-time-of-the-existing-guest-os-processes-as-a-possible-anti-trick\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5586"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5586"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5586\/revisions"}],"predecessor-version":[{"id":5587,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5586\/revisions\/5587"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}