The Sandbox That Fights Back: Introducing Adaptive Detonation
Published on: 03.11.2026
From passive execution to agents that reason, intervene, and run again.
Introduction
Malware can run in a sandbox / dynamic malware analysis system without revealing its main behavior. A sample may detect the analysis environment and exit, sleep or stop because it needs a particular date, keyboard layout, or command-line argument.
Sandbox evasion has long driven efforts to make analysis environments harder to recognize. Hypervisor-based inspection and bare-metal execution help, as do hybrid code analysis and richer interaction. Joe Security’s existing analysis technologies cover these areas, but a realistic environment cannot satisfy every condition a sample might check.
Today, we are proud to introduce Adaptive Detonation. It uses AI agents to examine why a sample stopped and prepare a change to the sample, its launch conditions, or its environment. The sandbox then runs the sample again to see whether the change reveals more behavior. Adaptive Detonation is available as a part of Joe Sandbox AI.
How Adaptive Detonation works
Adaptive Detonation works through four steps:
- Run and observe. Execute the sample in Joe Sandbox Cloud and collect its behavior, process activity, memory artifacts, and other analysis results.
- Identify what stopped it. An agent examines the evidence and relevant code to determine whether execution was blocked by an evasion check, a missing prerequisite, or a failure.
- Intervene. Prepare a targeted change to the sample, its launch conditions, or its environment.
- Run again and compare. Analyze the sample under the changed conditions in Joe Sandbox Cloud and check whether it progressed.
The agent’s options
The agent chooses an action based on what prevented the sample from progressing:
- Patch the sample. Change a specific check, such as a timing comparison or a branch that rejects firmware data, so execution can continue.
- Run preparation code. Create required files, directories, or registry values, or set up other operating-system state before the sample starts.
- Adjust the execution environment. Set a required date or locale, or install a missing software dependency.
- Supply launch arguments. Recover and provide a required parameter or installer property.
- Address interaction requirements. Handle a startup condition such as a confirmation dialog. Where appropriate, a patch can let execution follow the existing approval path.
The change must address the cause of the failure. For example, bypassing a check on decoded data will not help if the sample still lacks the data needed to decode its payload correctly.
The proposed change is a hypothesis. The follow-up analysis tests whether it helped.
Understanding why execution stopped
For analysts, Adaptive Detonation also helps explain why a sample did not progress. The Joe Sandbox analysis report includes the agent’s findings: what blocked execution, the runtime and code evidence, its recommended action, alternative explanations, and any remaining uncertainty. Analysts can use this explanation to assess the agent’s reasoning and decide what to investigate next, even when it cannot prepare an intervention.
In analysis 1995710, for example, the agent traces the startup checks and identifies the Chinese-keyboard requirement as the blocker:
Two short excerpts from the agent’s explanation in the initial report.
Adaptive Detonation in action
We have been running Adaptive Detonation in Joe Sandbox Cloud Basic for over two months. Here are eleven of the most interesting cases, covering deliberate evasions and missing prerequisites that prevented further execution. The follow-up runs revealed information-stealer and RAT configurations, additional payloads, and behavior absent from the initial analyses. Each example includes both reports and shows how the detection score changed on a 0-100 scale.
Examples at a glance:
- Keyboard allowlist
- Public-IP country check (RU / US)
- Missing command-line argument
- Expired execution date
- SMBIOS firmware check
- RDTSC timing check
- Missing decoding file
- A difficult message-box confirmation
- A long loop that delays execution
- Measuring time outside the machine
- A missing Python dependency
A keyboard allowlist that stops startup
The blocker: The sample requires an installed Chinese keyboard layout. If that requirement is not met, it ends before initializing its embedded endpoint.
The agent’s action: The agent patches the keyboard check so execution can continue. It leaves the earlier resource checks in place.
What changed: In the second run, the sample queries the network configuration through ipconfig and writes registry Run-key entries for autostart. Neither behavior appeared in the initial run.
Initial analysis · After the agent’s intervention
A country check rejects Russia and the United States
The evasion: The VBScript sample looks up the country associated with its public IP address and exits if the result is RU or US. Both requests in the first run return US. The script instance that reaches this check stops before downloading the payload.
The agent’s action: The agent traces the exit to the country check and prepares a minimal patch that disables its exit statement. Other checks remain unchanged.
What changed: The second run downloads and launches katyusha.exe, adds Windows Defender exclusions, and changes DNS resolver settings. The detection score rises from 76 to 100.
Initial analysis · After the agent’s intervention
One missing argument hides an information stealer
The blocker: An MSI package aborts because a required installer property is missing, so its bundled executable never launches. The evidence establishes a launch requirement.
The agent’s action: The agent inspects the installation conditions and supplies the missing S1=1 property, leaving the package unchanged.
What changed: The second run launches the bundled executable, records browser-related activity, and yields a Vidar configuration.
Initial analysis · After the agent’s intervention
A sample whose execution window has expired
The blocker: A protected .NET assembly allows execution only within a limited window around September 16, 2026. The analysis takes place outside that window, causing an exception during initialization.
The agent’s action: The agent prepares code that sets the analysis machine’s date inside the accepted window in Joe Sandbox Cloud before launching the unchanged sample.
What changed: The second run reaches additional stages, launches copies named Edge.exe, and invokes scheduled-task creation for logon persistence. It also exposes a Quasar RAT configuration.
Initial analysis · After the agent’s intervention
Firmware evidence triggers a deliberate exit
The evasion: The sample checks SMBIOS firmware data for virtualization indicators. A matching marker brings its rejection score to the exit threshold, stopping execution before the next payload stage.
The agent’s action: The agent finds the comparison that triggers the exit and patches that branch. A separate combined-score check remains intact.
What changed: In the second run, the sample launches headless browser processes, injects into memory, and accesses browser-extension and cryptocurrency-wallet locations.
Initial analysis · After the agent’s intervention
CPU timing becomes a barrier to analysis
The evasion: The sample uses CPU timestamp measurements, including RDTSC, to check execution timing. Its early consistency test rejects the analysis environment before later processing begins.
The agent’s action: The agent prepares a small patch to bypass the timing check reached in the first run. Other startup checks remain in place.
What changed: The second run exposes an Overlord RAT configuration in memory, including its configured command-and-control endpoint. The recovered configuration provides threat intelligence, although it does not establish that every configured capability ran.
Initial analysis · After the agent’s intervention
A missing file holds the decoding key
The blocker: The sample uses the first byte of a local data file to decode protected content. When the file is missing, it uses a fallback value that produces invalid content, then runs diagnostics and exits.
The agent’s action: The agent recovers the required byte value and creates the missing data file so the original decoding routine can work correctly.
What changed: In the second run, the sample copies and renames itself as sqhost.exe, launches firewall-rule commands, and starts watchdog processes.
Initial analysis · After the agent’s intervention
A message box that holds execution hostage
The blocker: The sample displays a confusing modal warning reading “CANCEL THE RUN TO PREVENT MALWARE FROM EXECUTING”.
Due to its guardrails an AI agent controlling the interface might follow the warning and click Cancel, stopping the behavior it was meant to analyze. Adaptive Detonation examines the confirmation logic in the code to determine how execution can continue.
The agent’s action: The agent patches the confirmation logic so execution can continue without a message-box response.
What changed: The second run launches additional payloads and reveals process injection, Windows Defender exclusions, and commands to stop the Windows Event Log service. The detection score rises from 3 to 100.
Initial analysis · After the agent’s intervention
A long loop consumes the analysis window
The blocker: A JavaScript sample repeatedly prepends values to a growing array, performing nearly 900,000 iterations before reaching its next stage. The process stays busy until the analysis window ends. The loop delays the later code without rejecting the environment.
The agent’s action: The agent finds that the accumulated array is not used afterward. It prepares a small patch that skips the loop while preserving the final value needed by the following decoder.
What changed: The second run reaches command-shell and PowerShell execution, WMI process creation, and outbound connections to external servers. The detection score increases from 56 to 96.
Initial analysis · After the agent’s intervention
Measuring time outside the machine
The evasion: A staged DLL compares its host executable’s last-write timestamp with the Date header from an HTTPS server. A file less than a day old triggers a 20-minute delay, timed using further responses from that server.
The agent’s action: The agent identifies the file-age check and advances the analysis machine’s clock by two days before the next run in Joe Sandbox Cloud. The newly written executable then has a timestamp later than the remote time. This selects an existing branch that skips the delay, without changing the sample binary.
Advance the guest clock by two days to avoid the loader's fresh-file execution delay.
What changed: The second run gets past the delay and attempts to retrieve content through two IPFS gateways. The detection score rises from 72 to 80.
Initial analysis · After the agent’s intervention
A missing Python installation hides the next stage
The blocker: A PowerShell script downloads its next stage but cannot find a usable Python interpreter. It tries to install Python, but the expected package manager is also unavailable. The downloaded stage never launches.
The agent’s action: The agent installs Python in a location the script already searches. The sample and its launch arguments stay unchanged.
What changed: The second run launches the downloaded stage through pythonw.exe and records further behavior, including WMI disk queries. The detection score rises from 60 to 80.
After Python is installed, the second run shows PowerShell launching the downloaded stage through pythonw.exe. Report excerpt.
Initial analysis · After the agent’s intervention
Other evasions we encountered
Beyond the examples above, Adaptive Detonation has identified additional evasions and execution blockers in Joe Sandbox Cloud:
- Rejecting synthetic interaction. An installer checks whether mouse and keyboard events were injected. It rejects an automated click on Next instead of advancing to the bundled payload.
- Requiring more CPU cores. A sample skips its payload when fewer than three logical processors are available.
- Requiring a specific domain. A sample compares the computer’s DNS-domain identity with an embedded value. If they differ, it enters an endless loop of ten-second sleeps before reaching its payload.
- Combining timezone and language checks. A downloaded stage accepts selected timezones or a Chinese UI language. Otherwise, it exits with status zero, making the rejection look like normal completion.
- Comparing firmware identities. A sample deliberately crashes if its normalized system-manufacturer and BIOS-vendor strings are identical. It compares the two values rather than searching for a familiar VM name.
- Looking for an ACPI power button. A loader requires the PNP0C0C registry key and displays a virtualization-rejection dialog when it is absent. Our controlled rerun passed this check after the agent created the key, but did not establish final-payload execution.
- Cross-checking timing behavior. One sample compares a sleeping worker with a separate wait operation and rejects an unexpected completion order. Another rejects the variability of repeated QueryPerformanceCounter measurements.
Limitations
Adaptive Detonation makes evasion harder, but it can still fail. Much depends on the analysis budget: how much reasoning, computation, and time the agent can spend on a sample.
Code virtualizers and heavily obfuscated control flow can make a check expensive to understand. Several checks in sequence may require more reasoning than the available budget allows. Malware authors can use this cost to their advantage.
Cryptography can impose a different kind of cost. A correctly constructed time-lock puzzle requires substantial sequential computation to recover its key. If the payload needs that key for decryption, changing a branch or moving the system clock cannot replace the computation. This is the distinction between elapsed time and required work described in time-lock puzzle research.
Some obstacles may remain regardless of the budget, such as a missing server-held secret or an unavailable remote service. A patch or environment change may also affect the sample’s behavior, so analysts need to interpret the original and modified runs together.
Conclusion
Adaptive Detonation adds AI agents to dynamic analysis in Joe Sandbox Cloud. They examine the results of a run, identify what prevented further execution, and prepare changes to the sample or its execution conditions. The next analysis shows whether those changes exposed more behavior.
The eleven examples found over two months cover keyboard and geographic restrictions, local and remote timing checks, firmware checks, confirmation dialogs, and missing prerequisites. Follow-up runs recovered malware configurations and recorded payloads and activity absent from the initial analyses. The additional evasions described above show further checks the agents have identified.
Adaptive Detonation changes the game for sandbox evasion. Malware authors now face AI agents that can investigate their checks, patch the sample, and adapt its execution environment. Stopping the first run may no longer be enough: the check itself can be analyzed and bypassed before the next run.
For security teams and SOCs investigating evasive malware, Adaptive Detonation should be a must-have capability. It helps expose behavior that an initial run may miss, giving analysts more evidence for triage, detection engineering, and incident response. As malware authors continue to add evasion checks, teams need analysis that can investigate and get past them.
To try Joe Sandbox, register for Joe Sandbox Cloud Basic. You can also contact Joe Security for a demonstration and to discuss how Adaptive Detonation could help with your malware analysis.