TrymeLocker Anti-Sandbox VM Detection via Registry and Process Enumeration (T1497.001)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•1

Detects sandbox evasion behavior where a process enumerates virtual machine-specific registry keys (e.g., VirtualBox, VMware) or attempts to access known virtualization service processes. This pattern is characteristic of malware attempting to identify if it is running in an analysis environment to alter its behavior.