It's not just registry values that reveal lots of information about the virtualization tools—Windows-managed information, which is accessible using PowerShell, can also be used, as shown in the following screenshot:
Figure 18: The PowerShell command to detect VMWare
This information can also be accessed through a WMI query, such as the following:
SELECT * FROM Win32_ComputerSystem WHERE Manufacturer LIKE "%VMware%" AND Model LIKE "%VMware Virtual Platform%"
For Microsoft Hyper-V, it would be as follows:
SELECT * FROM Win32_ComputerSystem WHERE Manufacturer LIKE "%Microsoft Corporation%" AND Model LIKE "%Virtual Machine%"
These techniques make it harder to hide the fact that this malware is running inside virtualization software and not on a real machine.
