Malware & Hackers Evade Antivirus with Windows Sandbox

The video demonstrates how Windows Sandbox, a security feature in Windows 10/11, has been weaponized by the Mirrorface APT group to bypass antivirus detection 0:00.

Key Takeaways:
• Windows Sandbox is an isolated virtual environment for safely testing files, but Mirrorface malware specifically checks for the WDAG utility account to ensure it only runs within this protected space 1:26
• The sandbox lacks Windows Defender and antivirus protection, making it an ideal environment for malware to operate undetected 5:03
• Attackers can configure Windows Sandbox with WSB files to map host directories, execute commands on startup, and use it as a C2 platform 6:28
• Using WSB.exe command-line tool, attackers can run the sandbox in the background without displaying any visible windows to the user 7:59

Understanding these attack techniques is crucial for defenders to detect and prevent sandbox-based evasion tactics in modern Windows environments.

Sources:

• 0:00 Introduction to Mirrorface APT using Windows Sandbox
• 1:26 Windows Sandbox overview and WDAG utility account
• 5:03 Lack of antivirus protection in sandbox
• 6:28 WSB configuration files and capabilities
• 7:59 WSB.exe command-line background execution