Slightly related, I remember reading once of malware that uses a virtual machine running TinyXP[0] to obfuscate itself from the host OS. The footprint of TinyXP is tiny compared to the latest versions of Windows and runs on very little RAM, and gets past reverse engineering ploys which aim to unravel what the malware does.