0:00 So, a couple months ago, back in March of 2025, this writeup was released by the Ito Cyber and Intelligence Incorporation in their researcher blog titled Hack the Sandbox, unveiling the truth behind disappearing artifacts. And in this writeup, they discuss a recent malware investigation where the National Police Agency and the National Center of Incident Readiness and Strategy for Cyber Security had previously released a security advisory way back in January regarding an advanced persistent threat attack campaign targeting organizations in Japan by the name Mirrorface. This threat actor, Mirrorface, actually uses Windows Sandbox and Visual Studio Code to carry out their attack. This writeup specifically focuses on the Windows
0:45 Sandbox attack surface and how it was used, abused, and leveraged as part of their trade craft. So, in this video, I want to showcase Windows Sandbox. I want to play with it. I want to see it in action. I want to get a little bit curious and creative as to what could we do with it with the backdrop, a little bit of background context and that this has been used in real attacks by advanced persistent threats, apt threat actors. And maybe this could be worthwhile for you for your own job. If you are a redteamer, penetration tester, or anyone doing offensive security, emulating cyber crime, well, it's worth knowing what they have up their sleeve so we could learn a little bit more. So, first a super quick crash course. If you aren't familiar with Windows Sandbox, it
1:31 is a virtual machine. At the end of the day, it's a virtual environment isolated from the host computer or your Windows operating system. So, you as a user could test files or experiment with what could be malware. You could test things in a safe isolated environment. Now, this is mostly only available on modern computers, Windows 10 and Windows 11. Windows 11 I think specifically they have a little bit more features and it requires you know virtualization enabled allowed it needs to be accessible set on on the BIOS. So a lot of other things that you might need to meet for the criteria to run this but if it is available it's worth playing with. Now the Windows Sandbox feature is disabled by default. So, if you wanted to turn it on, you can use the graphical user
2:16 interface by simply searching for Windows features on the start menu and then scrolling down to go find the Windows Sandbox. I do have it enabled. I've turned it on already. But that's the simple click easy button to be able to make sure it's set for you. If you click it to be enabled, it will end up searching for the required files, doing what it needs to to turn that feature on, and then asking you to reboot. That is super important to note. This does require a full reboot, restart of the computer for all the changes to be taken in effect and for Windows Sandbox to be available on that computer. So keep that in mind if you do end up using this or building it out for your red teaming or penetration techniques. Hey, maybe that's part of the tradecraftraft that you'll build in to oh, some implant, some payload, something that you might put together. And I know that graphical
3:02 user interface isn't the best way to get things staged, especially if you're trying to automate a payload here. So, don't forget, of course, all those Windows features could easily be turned on via the command line with PowerShell or Old School CMD. The command disism, disism.exe, you'll want to enable the feature and then with the feature name containers disposable client VM. If you were to script or try to programmatically stage this, maybe you could separate other commands to shut down the computer following just immediately to hey, make sure we will restart with a time of zero so that it forces the reboot. You can of course apply it with slashno restart, but if you do, it won't prompt you for a restart. If you were to remove that, it'll prompt you, do you want to restart? And of course, this can all be
3:48 done in pure PowerShell with enable- Windows optional feature. And again, that name containers disposable client VM. Once you have the Windows Sandbox feature enabled and you've restarted your computer, you should be able to simply search for Windows Sandbox in the start menu and then click it to get something going. This will download and install updates for the very first time it runs, but it's quick and easy. And then it'll just get you into a dynamic, ephemeral, off-the-cuff virtual machine to run Windows inside of Windows using all of their Microsoft HyperV hypervisor. You'll see the logo pop up once it starts, and then it'll just throw you in to a Windows sandbox and a full-blown virtual machine that you can interact and work with. Granted, it is a very limited virtual machine. It doesn't
4:34 have all of the bells and whistles and Windows internals, but enough to be able to click around and still experiment. We can open up the command prompt and hey, try to run different commands. But you'll notice our user here is the W DAG utility account. I might get that acronym wrong off the top of my head. I think that's Windows Defender Application Guard or something along those lines. Uh, but take a look. That is the only user really set here in this environment. So, here's a neat thing. Going back to that writeup, they're discussing the malware that that AP group Mirrorface had used. Mirrorface, apparently a subgroup of AP10, was using Lilim Rat. apparently a customized version of the open-source Lilith rat
5:20 and that had in its code an actual check to validate and determine do we have the WDAG utility account user folder created in the usual C back slash users back slash username location on the file system. If that folder doesn't exist, it'll terminate malware. It'll bail out and it won't actually continue infecting the host. So, it is purposebuilt. It's specifically intended to run only within the sandbox. And I know that sounds a little counterintuitive, right? Hey, malware normally wants to bail out when it's in a sandbox. But this actually gives that adversary a really unique advantage. Here's the thing. If I get back to our Windows sandbox host, we can
6:06 full screen this again. Let me try to look for our antivirus, like Windows Defender. Uh, can I look for any virus or security work? Here we go. I see Windows security settings. Let's try and take a look. If I were to open Windows security, it's trying to look for Windows Defender, but it doesn't exist. Windows Defender and your antivirus is not present in the Windows sandbox. The whole intent is to be able to run malware and see what it does, right? So this actually has a real unique capability. Actions taking place in the sandbox are basically invisible. So the thread actor ends up infecting the target host turning on Windows Sandbox
6:52 and rebooting the operating system. Maybe you add a little bit of persistence say oh on reboot start and work with Windows Sandbox with a given configuration file that we'll chat about in just a sec. and then run malware, communicate with C2 servers, do whatever you want because you're under the radar from antivirus. The article discusses that just a little bit, talks about the default user that we just touched on and how Windows Defender is not there. But then it discusses the configuration files, how you could actually define what will the Windows sandbox look like as you're running it. And I mean that to say, oh, is networking enabled? has it actually mapped hosts or directories or locations on the file system to be available shared in both on your host
7:39 computer and within the sandbox. Now, I don't know if you're thinking like I'm thinking, but I wonder could that be used and abused? You could even specify specific commands like things to run, execute, invoke, detonate as malware just as it starts. Turns out the AP threat actor did exactly that. Mirrorface ended up staging three different files, a batch file, an archiver, and an archive file. They slap that on the host machine once they've gained initial access. They've compromised, they've got on the box some way or another, fishing, I don't know, whatever. You can fill in the gaps for that initial exploitation. Their malware gets to run undetected and they get to use communication over tour. So they're going to be using the onion router to
8:25 reach out to their C2 or command and control server because inside of you know what's realistically a virtual machine in the Windows sandbox communication outbound like network connectivity to external resources is going to look like it's coming from your host and that IP address of the host machine. So they get even more clever by funneling out extra coms over to but let's dive into some of the configuration that we can do and really start to see this in action. I think you might already have a wondering question. Well, hey, uh, is it really just going to be pretty egregious? Aren't folks just going to see the Windows sandbox up on their screen and up on their computer? Well, it can be made a little bit more stealthy. And when you combine that with the use of tour and communications with C2 and the fact that
9:12 it can work with files on the host machine and there's no logging or any visibility inside the sandbox and no antivirus. There are no rules. But let's play with it in just a little bit. Before we do, please let me take just a quick moment to tell you about the sponsor of today's video, Plex Track. You know how tedious pentest reporting can be. hours of copying and pasting, organizing data from multiple sources, formatting findings. It's exhausting. And the worst part, every minute spent reporting is a minute you're not hacking. There is a better way. Meet Plex Track. With Plex Track, you can analyze your attack service. Aggregate all pentest and vulnerability scan data in one place. Use contextbased scoring
9:58 to prioritize risk. Leverage artificial intelligence to slash reporting time. Lean on collaborative Google Doc like features for faster quality assurance reviews. And use out-of-the-box integrations with ticketing systems like Jira to send high impact findings for remediation. So, what does this all mean for you? Well, you can cut pentest reporting time by 75%. Collaborate seamlessly with teams and stakeholders. See your findings actually get addressed fast and show measurable risk reduction. Charles Snder, director of cyber security at CI said Plexra is foundational for our ongoing security and risk management. Plexra isn't just another tool. It's the difference between drowning in reports and actually
10:46 having time to hack. Use my link below to learn more and book your own personalized demo. Spend less time reporting and more time hacking. Huge thanks to Plexra for sponsoring this video. All right, now let me show you some of those other features of Windows Sandbox. And you might have noticed these three dots and ellipsus over the top right part of the window menu bar. Looks like we could actually toggle this to full screen. So you can interact with it just whatever resolution you might like. Bring that down. It is nice. It can resize and rescale however you kind of drag the windows. So, at least, you know, nice little VM functionality there. But the more interesting things are the fact that it can share the clipboard. Hey, what you copy or paste maybe on your host and inside of the sandbox. I'm curious, and I have not tested this. I don't know. I'd love to
11:32 get your opinion and thoughts in the comments. Part of me wonders if we could build something that would sort of monitor or listen in snoop and easedrop on your clipboard to steal and collect and possibly exfiltrate all that that's living in the sandbox but still monitoring and being able to see those changes as you make it on the host. And if you're wondering, okay, how do we get that in the background again without this big window and interface open? We'll touch on that super soon. But other wondering thoughts with audio input and video input, I'm not sure. I'm not positive if that could be something to ooh sneaky turn on the microphone or video. I I I'm not sure. I don't know. But the other cool thing is the share folder functionality. Let me click on that. And this opens up a Windows Explorer sort of file picker dialogue
12:17 box. And I could choose any location on my actual host machine where I might want to map that to and share it with the actual sandbox and virtual machine. So I'll try to share my desktop here and I can go ahead and share that folder. Now you'll see it'll appear as an icon on my desktop within the sandbox. And I could modify or do any changes I might like here. In fact, what I'll do just to kind of showcase this is I'll open up a terminal. I'll move into the desktop that I have here. And I'll also move into the new desktop that is the representation of my host computer. So just as an example, let me echo like hello into please subscribe.ext and you should see this appear both on the sandbox and on my
13:03 host please subscribe.ext. I can open this up on my host and obviously that is the host not the sandbox. But what's to stop us from just like genuinely sharing the entire file system? Let me go bring the C drive as the location that I want to actually save or share really. Okay, we'll go ahead and hit select folder. Now, I would think this would share this on the desktop, but I don't see it created. However, it's not impossible to do because if you remember, the Windows sandbox can be set up with a configuration file or awsb file. That's just an XMLbased configuration file that defines a lot of the settings. Remember, we could supply the host folder and sandbox folder where we want to map or share a location to. And let me please
13:49 say, as usual, this is not a new or absolutely novel technique by any means. There's research, there are articles, there are writeups out and about that have been out for years. This is a blog that was released in December of 2020, so just about 5 years ago. Uh, this is put together by Lloyd. And again, I'll include a link in the video description for his writeup as well as the other Ito researcher blog. and he's covering how you could use the WSB file to stage what you'd like for Windows Sandbox and do anything that might not be caught by antivirus or EDR even on the host being XML. That's just plain text. You could obuscate that. You could do whatever clever shenanigans you'd like with that PowerShell or CMD syntax. So Lloyd covers the same thing that we have
14:34 turning this feature of Windows Sandbox on with the enable Windows feature. He checks for defender with the getmp computer status command lit in PowerShell and he sees that defender is not available. And then he's discussing how you could specify awsb file to run a command. He includes an example where you're literally mapping the C col backslash the entire root drive into the sandbox. Now you can get pretty clever with that because well think that could potentially mean uh ransomware opportunities. You could carve out Chrome cookies or web browser cache data. At least in my cursory testing, I was not able to pull the SAM or system or like registry hive key dumps thing that would help for gaining and extracting password hashes. And I wasn't
15:20 able to end up creating any volume shadow copies. But he includes a full example again if you wanted to oh pull down stage something from a C2 server or external location just using bits admin like a simple lol bin living off the land binary again Windows defender won't even be looking and this whole technique of using a virtual machine has been used by maze and ragnar locker threat actors and ransomware gangs oftentimes they've used thirdparty tools though they've used VMware or virtual box but using Windows Sandbox bypasses the requirements for software to be installed and if it's available on that modern Windows 11, you can just turn it on. So, just to see this in action, I want to copy the WSB sample that the original article we were looking at offered. Back on my host, I can at least
16:06 open Sublime Text with the please subscribe document. But now, let me actually paste all this in as an example test.WSB file. Test.wsb. We double check to make sure we save that as all files in case it does weird stuff with our file extension again. And if you wanted to, you could set the syntax to XML as that is what this is, right? But let's say the host folder, we wanted just the C drive. And we can go put this on our desktop with whatever like host folder here, right? Read only determines whether or not we have right access to the shared drive, shared folder here. And if you're putting your hacker hat on doing some shady shenanigans, you probably want write access. But just as a command to test, we could invoke like car map. I haven't seen Notepad available or calc
16:52 or other things because it's a limited virtual machine, but you could still work with the file system. So, as an example, let's just see that in action. Of course, that has the icon for test.wsb to invoke Windows Sandbox. Let me double click. Let it run. Now, without doing anything, this will automatically run our command. In which case, car map, the character map tool will be opened. You can see that it is. And our host folder is accessible there. That gives us everything on the C drive of our host. Yep, that is my machine. Looking at the users here, there's John. Just to be clear, in case I haven't said this already, you do of course need admin privileges to enable and turn on Windows Sandbox, but I keep alluding to the fact that oh, we don't have to have this big window in manual interactive
17:39 rendition of Windows Sandbox. So, let's see finally how we can run this in the background. There is more to the story here because look, while the article was discussing all the other settings that you could provide in theWSB file and even covers some of the forensics like how we might be able to track down data on the host that indicates some of the virtual machines or containers that are left behind that have some files present. But ultimately, let's get to the functionality that could really up the ante here. In the most recent release or some recent updates to Windows Sandbox, they added all the capability for clipboard, audio and video, and sharing folders. But they also include a command line utility. You can use
18:25 WSB.exe to manage and work with all the Windows Sandbox instances. They showcase the little dialogue box or menu that we could click into. But if we were to use the command wsb.exe, exe. We could actually work with this all without displaying the sandbox. So, back on my host, let me open up a terminal real quick. We could run the WSB command and take a look. Windows sandbox command line interface. With that, we have simple subcomands like start to start an instance. List the ids or a GID for a running instance. We can even execute commands like from a distance say okay now spawn whatever I want. Of course, you can share a folder. Of course, you could end up stopping an instance or connect to it and actually prompt the
19:12 interactive interface or just get the local IP address. The writeup covers some of this, but take a look. When you use the start command, you can actually pass in a configuration as a string. So, that bigwsb file doesn't have to be a potential artifact. you can just give it as an argument or a parameter for the WSB command line interface. So, let me take all the contents of our WSB file and let me remove all of the new line so I can easily copy and paste this entire syntax and let's just test for funsies. Let's run a different command so we can validate and see, okay, that's new. I'm going to guess if I express is present there. Not sure. So, we don't know if
19:58 that'll work, but at the very least, we can copy the syntax. And then let's completely remove the test.wb file because I don't want that as an artifact. I want to use just the commands with WSB to start a new instance. If we use tac h, we could see all the other options. We could supply the configuration with tax C. And then we just paste that all in. Now, if I hit enter, you can see it'll spin it up and give us a new ID value, but it won't actually start the window. Again, this is now running in the background. So, you don't get to see the Windows sandbox start. It's hidden from us. Now, because we have this ID, we could go ahead and connect to it with that WSB connect command. Let's specify the ID and then
20:44 paste that in. Now, we could see it's spinning up. And is I express going to run for us? Was that actually included there or did it error? Again, that was a complete guess. Hey, it worked. Okay, cool. I'm glad I had the right guess. But of course, our host still mounted. We have that as a shared folder. You could do whatever damage you wanted to do with that. So imagine you had malware that would work sort of in and out of the Windows sandbox either on the host or working and operating in the sandbox for file system changes or operations to fly under the radar and not be monitored by antivirus or EDR. Let's use the opportunity though to see the exec command in action. If I move these to the side, you can have a little bit better visibility. Play with all the other options, things that we could do
21:30 with the WSB command. But we would need to provide the ID, which we can paste in the command that we want to run. Let's use carmap.exe as an example. Again, you can even specify the working directory with -ashd or you can use run as to say do we use this and execute this as the existing login or the wag utility account or system level privileges. You can of course use PS exec or whatever you want to interactively get system maybe in the sandbox or hey we could use mimicats we could use cobalt strike we could use whatever the heck we wanted because AV is not listening and say we were to run this as system fire it up problem is it running as system isn't going to display it but it's still
22:16 happening like if I open up the task manager always worthwhile to do we should be able to see in the details section yeah there's car map running toggle here to details. There it is. carmap.exe running as system. Say we made that interactive though, we could do it with the existing login. And I think that'll pop. That should display visually. Yeah. Okay, cool. You might have saw it just pop up on the uh menu there, the bottom start bar. With that, now that we've opened the task manager inside of the sandbox, I would still be curious, what does the task manager look like on our host? What other artifacts or are there any telltale signs that we could still track this down even if a lot of the activity in the sandbox is sort of in its own vacuum? Well, let's
23:01 open up task manager locally. You might be able to see a couple elements here. Windows Sandbox remote session, Windows Sandbox server, and the article continues on a little bit more as to how we could monitor or investigate some activity within Windows Sandbox or at least kind of track this. Obviously, theWSB files are an artifact we could look for. If we're looking for any operational logs, sandbox processes like I just mentioned, or even things in memory, you could still track this down. Windows Sandbox.exe will be present in system 32 once you have it enabled installed. Same thing with Windows Sandbox client.exe and cmroxyd haven't seen before. This runs when it executes WSB files and at normal startup along with some of the others.
23:46 So, these are good indicators or things that are tactical and technical to track. Of course, they use Mimi Cats as an example. We could do the very same, but you get the gist. When it can track it down in memory, though, that's pretty cool. Not sure if you'll have the capability to pull memory from endpoints on host, whatever you're doing, but it is something that you could catch. There are more here in the MFT, user journal, pre-fresh registry, etc. Uh, but I think I will have to leave this as a link in the video description so you all get a chance to look through it and learn a little bit more. To note at the very beginning of the article, they do include a PDF I believe slides for a talk where they were offering this and delivering this for hack the sandbox. And big shout out to the researchers and folks that really put this all together.
24:31 I do want to make sure they get credit. credit where credit is due, but this might be a faster way for you to get an idea as to everything that it covers and a little bit more digestible than, you know, the wall of text of an article. Again, we'll link this in the video description. And let me harp on it one more time. Enabling Windows Sandbox like this requires admin privileges, but think about it. Hey, if you're targeting, maybe you are a target and it's your laptop. Oftentimes, you are a local admin on your own personal device. for business devices obviously look principle of lease privilege don't need admin access there but people need to know about it so they can still keep an eye out for it make sure you can monitor or at least understand what attack surface this offers I think it's really neat honestly I think it's fascinating
25:16 in that look this is a capability because maybe you intentionally as malware want to be running in the sandbox so you are not going to be flagged by antivirus even while these sandbox is running with the WSB tool, you can add another shared folder. So, let me take a look at that one super quick. The syntax should be pretty simple. It's really uh replicating what we'd see in the WSB or XML configuration files. We'll specify the ID as usual. So, tact ID, we'll paste in that GID tac for a host path. Let's say our Windows system 32 directory. And in the sandbox path, let's just put that in like a c backslash sensitive. You can use tac w
26:02 here. Note that to allow right access. By default, that is false, but could be handy for us to play with. Let's add that. Once it's done, we can connect. And actually, before we do, let's see that IP address functionality. Of course, this will be a local IP because it is the virtual machine working on your host. But let's connect to it to see that share in action. And just as we would expect, nothing has changed the last time we got to see this, but our host is still present. Making this a bit bigger so you can see. And back in the root of our sandbox, we do have the sensitive folder which maps everything on our host from C Windows System 32. Calc should be in here. Yeah. Or reliable. How about notepad? Can we fire that one up? Yeah. Okay, it's back.
26:47 That's funny because Notepad on its own is not something that exists within the sandbox. But once we are all done, let's WSB stop with that ID. And to see that in action, we can put these side by side. No tricks up my sleeve. Obviously, that will just terminate the sandbox. So, think about that. Think about I don't know. I I just think this is a neat one. I think there's a certain amount of like creativity that you might be able to do while you just turn on this functionality with PowerShell or CMD script with a little bit of persistence. Oh, an auto run that'll drop something into the sandbox or stage it, prepare it with the configuration with this WSB command to move in and out of maybe dynamic shares that you use or accessing
27:33 the clipboard or video and audio. And you essentially can use this Windows sandbox as a C2 or a malware delivery opportunity without a V in the way. So, I hope that is a worthy tool for your toolkit for all you penetration testers, red teamers, and ethical hackers out there. Obviously, we've seen this in action from advanced persistent threats, AP threat actors, and adversaries, but look, you got to know the offense to have a good defense. Thanks so much for watching. I hope you enjoyed this video. Please do all those YouTube algorithm things like, comment, subscribe, and do give some love to our sponsors. Link below in the video description. With that, I'll see you in the next
