#include <iostream>

using namespace std;

void smsw()
{
	unsigned int reax = 0;

	__asm
	{
		mov eax, 0xCCCCCCCC
		smsw eax
		mov DWORD PTR[reax], eax
	}

	if ((((reax >> 24) & 0xFF) == 0xcc) && (((reax >> 16) & 0xFF) == 0xcc))
	{
	    cout << "VM detected!" << endl;
	}
}

int main()
{
    smsw();
    cout << "Hello world!" << endl;
    return 0;
}

rule:
  meta:
    name: execute anti-VM instructions
    namespace: anti-analysis/anti-vm/vm-detection
    author: moritz.raabe@fireeye.com
    scope: basic block
    att&ck:
      - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]
    mbc:
      - Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing [B0009.029]
    examples:
      - Practical Malware Analysis Lab 17-03.exe_:0x401A80
  features:
    - or:
      - mnemonic: sdit
      - mnemonic: sgdt
      - mnemonic: sldt
      - mnemonic: smsw
      - mnemonic: str
      - mnemonic: in
      - mnemonic: cpuid
      - mnemonic: vpcext