Sandbox Detection/Evasion (Windows) cheatsheet

BOOL DirectoryExists(TCHAR* szPath)
{
    DWORD dwAttrib = GetFileAttributes(szPath);
    return (dwAttrib != INVALID_FILE_ATTRIBUTES) && (dwAttrib & FILE_ATTRIBUTE_DIRECTORY);
}

BOOL check_for_qemu()
{
    TCHAR szProgramFile[MAX_PATH];
    TCHAR szPath[MAX_PATH] = _T("");
    TCHAR szTarget[MAX_PATH] = _T("C:\\Program Files\\QEMU\\");
    if (IsWoW64())
        ExpandEnvironmentStrings(_T("%ProgramW6432%"), szProgramFile, ARRAYSIZE(szProgramFile));
    else
        SHGetSpecialFolderPath(NULL, szProgramFile, CSIDL_PROGRAM_FILES, FALSE);
    PathCombine(szPath, szProgramFile, szTarget);
    return is_DirectoryExists(szPath);
}

# This function is exactly the same as DirectoryExists. 
BOOL FileExists(TCHAR* szPath)
{
    DWORD dwAttrib = GetFileAttributes(szPath);
    return (dwAttrib != INVALID_FILE_ATTRIBUTES) && !(dwAttrib & FILE_ATTRIBUTE_DIRECTORY);
}

VOID Check_For_Files()
{
    // List of file paths (relative to %WINDIR%) to check for VM / sandbox artifacts
    TCHAR* szPaths[] = {
        _T("system32\\drivers\\prleth.sys"),
        _T("system32\\drivers\\vmhgfs.sys"),
        _T("system32\\drivers\\csagent.sys")
    };
    
    // Calculate number of paths in szPaths
    WORD dwlength = sizeof(szPaths) / sizeof(szPaths[0]);

    // Resolve the Windows directory (e.g., C:\Windows)
    TCHAR szWinDir[MAX_PATH] = _T("");
    TCHAR szPath[MAX_PATH] = _T("");
    GetWindowsDirectory(szWinDir, MAX_PATH);
    
   // Iterate over each relative path and check for file existence
    for (int i = 0; i < dwlength; i++)
    {
        // Build full path: %WINDIR%\relative_path
        PathCombine(szPath, szWinDir, szPaths[i]);

        std::cout << "Checking file " << szPath << ": ";

    //Conditions if result is true or not
    if (FileExists(szPath))
        std::cout << "TRUE\n";
    else
        std::cout << "FALSE\n";
    }
}

//Get current System Time
	auto start = high_resolution_clock::now();
    //Sleep 2 Seconds
	std:Sleep(2000);
    // Get Current System Time
	auto stop = high_resolution_clock::now();
    //Check the difference
	auto duration = duration_cast<milliseconds>(stop - start);
    //translate into a number
	unsigned int dwDuration = duration.count();
	//check to see if the duration was actually less than our expected 2 seconds
    cout << dwDuration;
	if (dwDuration < 2000)
		return 0;

int TickSleepCheck() {
	DWORD tick1;

	tick1 = GetTickCount();
	Sleep(1000);
    
	if ((GetTickCount() - tick1) > 980) 
		return FALSE;
	else 
		return TRUE;
}

static bool GetServerTime(ULONGLONG& outUnixSeconds)
{
    // User-Agent is visible in telemetry update with a common UA
    LPCWSTR ua = L"Mozilla/5.0 (Windows NT 10.0; Win64; x64)";

    //open the session
    HINTERNET hSession = WinHttpOpen(ua, WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
    if (!hSession) return false;

    //connect to Google
    HINTERNET hConnect = WinHttpConnect(hSession, L"google.com", INTERNET_DEFAULT_HTTPS_PORT, 0);
    if (!hConnect) 
    { 
        WinHttpCloseHandle(hSession); 
        return false; 
    }

    //Make the Request
    HINTERNET hReq = WinHttpOpenRequest(hConnect, L"HEAD", L"/", NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE);
    if (!hReq) 
    { 
        WinHttpCloseHandle(hConnect); 
        WinHttpCloseHandle(hSession); 
        return false; 
    }

    bool ok = false;

    //Send it
    if (WinHttpSendRequest(hReq, 0, 0, 0, 0, 0, 0) && WinHttpReceiveResponse(hReq, NULL))
    {
        WCHAR dateHdr[128] = {0};
        DWORD size = sizeof(dateHdr);

        //Make sure we got a response
        if (WinHttpQueryHeaders(hReq, WINHTTP_QUERY_DATE, WINHTTP_HEADER_NAME_BY_INDEX, dateHdr, &size, WINHTTP_NO_HEADER_INDEX))
        {
            SYSTEMTIME st = {0};
            //translate the time header into a system time structure
            if (InternetTimeToSystemTimeW(dateHdr, &st, 0))
            {
                FILETIME ft = {0};
                //translate system time to file time which is a 64bit value
                SystemTimeToFileTime(&st, &ft);

                // Convert FILETIME (100-ns since 1601) -> Unix seconds (since 1970)
                ULONGLONG t = ((ULONGLONG)ft.dwHighDateTime << 32) | ft.dwLowDateTime;
                // seconds between 1601 and 1970
                const ULONGLONG EPOCH_DIFF = 11644473600ULL; 
                outUnixSeconds = (t / 10000000ULL) - EPOCH_DIFF;

                ok = true;
            }
        }
    }

    WinHttpCloseHandle(hReq);
    WinHttpCloseHandle(hConnect);
    WinHttpCloseHandle(hSession);
    return ok;
}

bool SleepSkipCheck(DWORD sleepMs, DWORD toleranceMs)
{
    ULONGLONG t1 = 0, t2 = 0;
    if (!GetServerDateSeconds(t1)) return false;

    Sleep(sleepMs);

    if (!GetServerDateSeconds(t2)) return false;

    ULONGLONG deltaMs = (t2 - t1) * 1000ULL;

    // Expect delta ~= sleepMs, but allow for HTTP Date granularity + latency jitter
    // Example: sleep 5000ms, tolerance 1500ms
    if (deltaMs + toleranceMs < sleepMs) {
        // “too small” -> time rushing / stubbed response / accelerated env signal
        return true;
    }

    return false;
}

// Just checking for status returned
if (NtDelayExecution(FALSE, (PLARGE_INTEGER)0) != STATUS_ACCESS_VIOLATION)
    {
        cout << "hooked process";
        return 0;
    }

// Check to see if hooked process continue with sleep or provided false data on sleep

//  First create the unaligned value
__declspec(align(4)) BYTE aligned_bytes[sizeof(LARGE_INTEGER) * 2];
DWORD tick_start, time_elapsed_ms;
DWORD Timeout = 10000; 
PLARGE_INTEGER DelayInterval = (PLARGE_INTEGER)(aligned_bytes + 1); 
//Create a variable to store the error
NTSTATUS status;

// conduct the sleep
DelayInterval->QuadPart = Timeout * (-10000LL);

//getting tick count
tick_start = GetTickCount();

//status SHOULD fail due to unlaignment
status = NtDelayExecution(FALSE, DelayInterval);

//Do the math on the ticks
time_elapsed_ms = GetTickCount() - tick_start;

// Since the sleep was dependant on a malformed delay, we should expect an error status and no delay
// If that is not the case then we know that the function was hooked and skipped and we are in a sandbox
if (time_elapsed_ms > 500 || status != STATUS_DATATYPE_MISALIGNMENT )
{
    cout << "hooked process";
    return 0;
}

bool IsItPrime(ULONGLONG n) {
	if (n <= 1)
		return false;
	if (n <= 3)
		return true;
	if (n % 2 == 0 || n % 3 == 0)
		return false;
	for (ULONGLONG i = 5; i * i <= n; i = i + 6)
		if (n % i == 0 || n % (i + 2) == 0)
			return false;
	return true;
}

//calling the IsItPrime Function
	IsItPrime(9223372036854775807);

int mouse_active() {
	POINT position1, position2;
	GetCursorPos(&position1);
    std:Sleep(5000);
	GetCursorPos(&position2);

	if ((position1.x == position2.x) && (position1.y == position2.y))
		// No mouse activity during the sleep.
		return TRUE;
	else 
		return FALSE;
}

#define BTN_INSTALL 1001

    HWND hWnd = CreateWindow(
        TEXT("Button"),         // class "button"
        TEXT("Install"),        // caption is “Install” 
        NULL,                   // style flags are not required, the control is invisible
        1, 1, 1, 1,             // the control is created of 1x1 pixel size
        hParentWnd,             // parent window
        NULL,                   // no menu
        NULL,                   // a handle to the instance of the module to be associated with the window
        NULL);                  // pointer to custom value is not required

bool g_ButtonClicked = false;

//Window procedure
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
    switch (msg)
    {
    case WM_COMMAND:
        if (LOWORD(wParam) == BTN_INSTALL)
        {
            g_ButtonClicked = true;
            // we know for sure no one could have clicked this button so we just gonna quit
            return 0;
        }
        break;
    }
    return DefWindowProc(hwnd, msg, wParam, lParam);
}

int main()
{
    // window creation / button creation here

    // Message loop with timeout
    DWORD timeoutMs = 5000;
    DWORD start = GetTickCount();
    MSG msg;

    while ((GetTickCount() - start) < timeoutMs)
    {
        while (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE))
        {
            TranslateMessage(&msg);
            DispatchMessage(&msg);

            if (g_ButtonClicked)
                return 0;
        }
        Sleep(10);
    }

    printf("No interaction detected, continuing...\n");
    return 0;
}