inside it we find encrypted drive images like thispic.twitter.com/oEc70TdkH4
Show this thread
I have not seen the following content mentioned before and verified with 5 people - enabled secure boot/launch/tpm 2.0/vbs seems to be requirement. Do you have a file like this deployed on your pc? Lets take a closer look:pic.twitter.com/vY1vzciEfZ
-
-
-
This appears to be files for a vm - the base filesystem for os and the specialization in each file. We can mount it by double clicking
Show this thread -
Content is registry hives and a filesystem - and a container definition file.pic.twitter.com/ClA2WSBOoD
Show this thread -
Some files are wcifs reparse points that redirect to another file on another drive . Other are real and unique to this exact containerpic.twitter.com/lppLODmG7Z
Show this thread -
by tailing the usrjrnl we can see if there is any activity currently, in this case there is nothing- but other times there is activity.pic.twitter.com/nJRGHOR1ZC
Show this thread -
I use this tool alot: https://github.com/BurntSushi/ripgrep/releases/download/13.0.0/ripgrep-13.0.0-x86_64-pc-windows-msvc.zip … with it we can easily print out all real files content if text
Show this thread -
the command rg . reveal lots of interesting stuff going on: like telemetry, our old friend defender, additional tasks.... i would rather not speculate too much about it as I may be biased, but please take a look :) There is multiply hidden containers like that getting deployed
Show this thread
End of conversation
New conversation -
-
-
Looks like those used in WDAG & Sandbox. I have talk about it at POC 2018: https://www.powerofcommunity.net/poc2018/yunhai.pdf … and Alex Ilgayev has wrote a blog with updates and more detail this year:https://research.checkpoint.com/2021/playing-in-the-windows-sandbox/ …
-
they are all based on the same wdac image - but its not the sandbox , nor wdac as they do place them self normally in the container folder- this is not them. These also appear without installing either. there is one vm though that runs like windows 10 16.000
End of conversation
New conversation -
-
-
Great findings
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.