Windows 10: SNDBOX: AI-Powered Online Automated Malware Analysis Platform

hello10 · Dec 6, 2018

"Looking for an automated malware analysis software? Something like a 1-click solution that doesn't require any installation or configuration…a platform that can scale up your research time… technology that can provide data-driven explanations… well, your search is over!"
Source: SNDBOX: AI-Powered Online Automated Malware Analysis Platform

:)

95Viper · Dec 6, 2018

Smarter malware... Less technical coding

How about malware that will peek at what might be monitoring for it, then hide or wait a few minutes run a portion of itself.
Wait, now run another portion. Oh, wait, and run some more.
Bam your infected!

Or, how about some malware that hides in your mouse routines, then waits for you to click a button or move the mouse, so it can run hidden in the mouse message routines.

Even better, how 'bout the malware that will recognize it is running in a VM or being searched for and stops itself from running; hide and waits until the the way is clear.

And, unless your A/V or whatever method you use is aware of this type of threat... you are infected.

Now a days, it doesn't take a technical genius to make it happen.

It is all explained in this article by the Symantec Security Response team, here -->Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems
And, a couple of quotes from the page:

For a long time, malware has been able to detect the environment it is running in and hide itself from automated threat analysis systems. The list below is the measures malware takes avoid being detected by dynamic analyzer systems:
Checks a certain registry entry and stops if it detects that it is running in a virtual environment.
Checks video and mouse drivers and stops if it detects that it is running in a virtual environment.
Enumerates the system service list and stops if it detects that it is running in a virtual environment.
Executes special assembler code and stops if it detects that it is running in a virtual environment.
Checks a certain communication port and stops if it detects that it is running in a virtual environment.
Checks a certain process name and stops if it detects that it is being monitored.

If malware stops itself when it detects that it is running in a virtual environment, it may trick an automated threat analysis system into thinking that it is a clean program. It is also able to stop itself if it discovers a certain process name and detects that someone is monitoring it. So malware may not only fool automated threat analysis systems, but also a corporate system administrator who is searching for computers compromised by malware
Click to expand...

In the past, malware authors used very difficult techniques to detect virtual environments. As such, they may have needed specialized skills, such as assembler code writing skills, knowledge of virtual machines, and knowledge of CPUs and memory management.

However, the techniques described in this blog are not technical and hence malware authors these days do not need technical skills to hide their creations from automated threat analysis systems. Furthermore, they are always researching and testing new ideas in order to fool automated threat analysis systems.
Click to expand...

Keep your guard up and compute safely.*Smile

Brink · Dec 6, 2018

AI Platform for Windows Developers

At Microsoft, we’re making huge investments in AI and Machine Learning across the company. AI capabilities in Office 365 help subscribers with productivity at work, intelligent features in the Photos app for Windows 10 make it easier for people to create videos and search through massive photo collections, and Windows Hello uses AI to recognize your face and get you quickly logged in to your Windows devices. We also use AI to answer your questions when using Bing Search and Cortana, to enable advertisers build deeper connections with customers, and to help security professionals safeguard businesses against modern threats. Microsoft Research continues to drive the state of the art with speech recognition, machine reading and comprehension, computer vision. We’ve scaled AI to tiny devices, and even built AI that can draw!

“Intel’s Movidius VPU technology will deliver increasingly sophisticated AI experiences for the hundreds of millions of Microsoft users worldwide,” said Intel’s Remi El-Ouazzane, Vice President and General Manager of Movidius.

With the next major update to Windows 10, we begin to deliver the advances that have been built into our apps and services as part of the Windows 10 platform. Every developer that builds apps on Windows 10 will be able to use AI to deliver more powerful and engaging experiences.

“AI acceleration on Window 10 PCs is the latest evidence of how artificial intelligence is becoming ubiquitous in our everyday lives,” said Ian Buck, vice president and general manager, Accelerated Computing, at NVIDIA. “NVIDIA is delighted to be partnering with Microsoft to enhance the PC experience for users worldwide.”

The AI platform in Windows 10 enables developers to use pre-trained machine learning models in their Apps on Windows devices. This offers developers a number of benefits:

Low latency, real-time results. Windows can perform AI evaluation tasks using the local processing capabilities of the PC, enabling real-time analysis of large local data such as images and video. Results can be delivered quickly and efficiently for use in performance intensive workloads like game engines, or background tasks such as indexing for search.

Reduced operational costs. Together with Microsoft’s Cloud AI platform, developers can build affordable, end-to-end AI solutions that combine training models in Azure with deployment to Windows devices for evaluation. Significant savings can be realized by reducing or eliminating costs associated with bandwidth due to ingestion of large data sets, such as camera footage or sensor telemetry. Complex workloads can be processed in real-time on the edge, with minimal sample data sent to the cloud for improved training on observations.

Flexibility. Developers can choose to perform AI tasks on device or in the cloud based on what their customers & scenarios need. AI processing can happen on the device if it becomes disconnected, or in scenarios where data cannot be sent to the cloud due to cost, size, policy or customer preference.

“We’re excited to be collaborating with Microsoft on the Windows ML platform, and helping developers accelerate on-device AI performance on Windows laptops with the Snapdragon 835 AI Engine.” Gary Brotman, Director of Product Management – AI and Machine Learning, Qualcomm Technologies, Inc.

Our ML model evaluation is tuned for efficiency across the diverse silicon that runs Windows. By using instruction set optimizations on modern CPUs, hardware acceleration on GPUs that support DirectX 12, and a driver model for purpose-built AI processors in the future, we deliver performance and efficiency on the broadest range of form factors. With the update, developers can use the AI platform across the Windows device family, including IoT edge devices, HoloLens, 2-in-1s and desktop PCs, workstations, servers and in data centers.

“We’re excited to work with Microsoft on Windows ML as a part of taking advantage of the high-performance capabilities of AMD CPUs and GPUs to bring AI acceleration to Windows 10 PCs.” – Andre Zdravkovic, CVP Software, AMD

Windows supports ONNX, an industry standard format for ML models that is driven by Microsoft, Facebook, and Amazon Web Services, and supported by Windows IHVs including NVIDIA, Intel, Qualcomm and AMD. Data scientists can train and deliver ONNX models for use by Windows developers using Azure Machine Learning Workbench, and coming soon, the Azure Custom Vision Service will also support creating ONNX models for Windows.

We’ve also invested in delivering a great development experience for AI developers on Windows. Starting with Visual Studio Preview 15.7, adding an ONNX file to a UWP project will automatically generate a model interfaces in your project. For prior versions of Visual Studio, developers can use the MLGen tool to generate the code interface and then manually add it to their projects. This capability will be coming soon to Visual Studio tools for AI as well.

For consumers, this is just the beginning! You’ll see more intelligence in every day experiences on Windows devices. Developers can build AI powered apps that help you inspire and communicate in 3d, keep track of tasks and commitments more easily, and listen to music from playlists made just right for you.

You can learn more about our AI journey at Windows Developer Day on March 7, and at //build 2018.
Click to expand...

Source: AI Platform for Windows Developers - Windows Developer Blog

Cliff S · Dec 6, 2018

Super Secretive Malware Wipes Hard Drive to Prevent Analysis

Researchers have uncovered new malware that takes extraordinary measures to evade detection and analysis, including deleting all hard drive data and rendering a computer inoperable.

Rombertik, as the malware has been dubbed by researchers from Cisco Systems' Talos Group, is a complex piece of software that indiscriminately collects everything a user does on the Web, presumably to obtain login credentials and other sensitive data. It gets installed when people click on attachments included in malicious e-mails. Talos researchers reverse engineered the software and found that behind the scenes Rombertik takes a variety of steps to evade analysis. It contains multiple levels of obfuscation and anti-analysis functions that make it hard for outsiders to peer into its inner workings. And in cases that main yfoye.exe component detects the malware is under the microscope of a security researcher or rival malware writer, Rombertik will self-destruct, taking along with it the contents of a victim's hard drive.
Click to expand...

Read more.
Source: Ars Technica.

Windows 10: SNDBOX: AI-Powered Online Automated Malware Analysis Platform

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

SNDBOX: AI-Powered Online Automated Malware Analysis Platform

SNDBOX: AI-Powered Online Automated Malware Analysis Platform - Similar Threads - SNDBOX Powered Online

Power Automate joins Copilot

Power Automate joins Copilot

What is 'Power Automate Desktop'

Malware analysis

File submit failed for malware analysis

Submission for malware analysis

Windows 11 - Power Automate

IRM issues with malware analysis submissions.

AI Platform for Windows Developers