Think Inside the Box: How APTs Abuse Windows Sandbox for EDR Evasion

Introduction

In the cat-and-mouse game of cybersecurity, defenders have long relied on sandboxing to isolate and analyze suspicious files. However, in a fascinating reversal, advanced persistent threat (APT) groups have begun using these very tools to hide from the defenders. This blog post explores the research presented by Hiroaki Hara of Trend Micro at Black Hat Asia, detailing how the APT group Earth Kasha (part of the APT10 umbrella) successfully abused Windows Sandbox in real-world targeted attacks to deploy stealthy backdoors while remaining invisible to Endpoint Detection and Response (EDR) solutions.

Background: The "Magic Cloak" of Virtualization

Windows Sandbox, introduced in 2018, is a lightweight virtualization feature designed for the safe execution of untrusted applications. It provides a disposable, isolated environment that starts in seconds. While built for security, it inherently possesses a characteristic that is highly attractive to malware authors: isolation.

Most host-based security products (EPP and EDR) operate at the kernel or user level of the host operating system. Because Windows Sandbox uses hypervisor-based virtualization, the processes running inside the sandbox are often invisible to the security agents installed on the host. For an adversary, the sandbox becomes a "magic cloak," allowing them to execute malicious code in a space where the host's EDR cannot see or intervene.

Technical Deep Dive: The Earth Kasha Attack Chain

Understanding the Vulnerability/Technique

The attack discovered by Trend Micro targets organizations in East Asia using a multi-stage infection process. The initial entry is achieved via spear-phishing, but the true innovation occurs during the deployment of the final payload, NOOPDOOR.

Step-by-Step Exploitation

1. Initial Compromise: The victim executes a dropper called Roaming Mouse from a spear-phishing email, which installs the ANEL backdoor.
2. Sandbox Preparation: Once the attacker confirms the target's value, they drop three components onto the host: a configuration file (.wsb), a password-protected WinRAR archive, and a PEM file (which is actually an encoded executable).
3. Hiding the UI: To prevent the victim from seeing the sandbox window, the attacker creates a Scheduled Task to run WindowsSandbox.exe under the SYSTEM context. Because the system account does not share a session with the active user, the sandbox window remains hidden.
4. Configuring the Sandbox: The .wsb file is meticulously crafted to:
   • Enable networking (<Networking>Default</Networking>).
   • Map the host's user directory to the sandbox with read-write permissions (<ReadOnly>false</ReadOnly>).
   • Execute a script upon startup (<LogonCommand>).
5. Payload Deployment: Inside the sandbox, the LogonCommand triggers a batch file that uses certutil to decode the PEM file into a WinRAR executable. This tool then extracts the NOOPDOOR backdoor from the encrypted archive and executes it.
6. Traffic Obfuscation: The adversary often uses the Tor network from within the sandbox to mask the command-and-control (C2) traffic.

The New Threat: WSB.exe

In Windows 11 24H2, Microsoft introduced wsb.exe, a command-line tool that makes this process even easier for attackers. It supports inline configurations via the --config flag, enabling fully fileless execution of sandbox settings and the ability to hide the UI without needing the SYSTEM account workaround.

Detection & Defense Strategies

Detecting sandbox abuse requires looking for specific environmental anomalies rather than just signatures of the malware itself.

Detection Points:

• Sigma Rules: Monitor for WindowsSandbox.exe or wsb.exe being executed by the SYSTEM account or with suspicious command-line arguments like LogonCommand.
• Memory Scanning: While the sandbox is isolated, its memory is mapped to specific host processes: VMM.exe on Windows 10 and VMM-sandbox.exe on Windows 11. Security teams should ensure their EDR is configured to scan these specific worker processes, as the malicious code (like Mimikatz or NOOPDOOR) will be visible there.

Prevention:

• Group Policy: Admins can use GPOs to restrict Windows Sandbox capabilities, such as disabling folder mapping and network access if the feature is required for business but needs hardening.
• Privilege Management: Monitoring the creation of scheduled tasks by suspicious processes can preempt the sandbox from being launched under the SYSTEM account.

Conclusion & Key Takeaways

The abuse of Windows Sandbox by Earth Kasha marks a significant shift in APT tactics toward utilizing built-in virtualization for defense evasion. As Microsoft continues to integrate lightweight containers and sandboxes into the OS, we can expect more adversaries to "think inside the box."

Key Takeaways:

• Isolation works both ways: what protects you can also hide your enemies.
• Standard EDR monitoring often stops at the hypervisor boundary.
• Memory scanning of hypervisor worker processes is a critical, yet often overlooked, detection vector.

For researchers and defenders, the message is clear: monitor the usage of virtualization tools in your environment as closely as you monitor any other high-privilege application.