An Analysis of Weaponized Malware using Powershell.

DTG1

Death to Gnomes!!!
Member
VIP
Local time
9:39 PM
Posts
128
Location
SE MI
Thread starter

My Computer

System One

  • Operating System
    Win10
    Computer type
    PC/Desktop
    Manufacturer/Model
    ME
    CPU
    AMD FX-9370
    Motherboard
    ASUS SABERTOOTH 990FX R2.0 +SB950
    Memory
    G.Skill Sniper 16gb DDR3 2400
    Graphics Card(s)
    Msi GTX1080 Gaming X
    Sound Card
    onboard (realtek?) -- SPKRS:Logitech Z623 200w 2.1
    Monitor(s) Displays
    2x Dell S2440L (16:9) 1 Nixeus NX-EDG27S
    Hard Drives
    C:\Samsung Evo (500GB)
    D:\Samsung Evo (1TB)
    F:\Seagate (2TB)
    PSU
    Corsair HX1000i
    Case
    Phanteks Enthoo Primo w/9 140mm fans
    Cooling
    CM Nepton 280L(CPU) (4 fan P/P)
    Keyboard
    Logitech 910s Orion Spark
    Mouse
    Logitech G604 LightSpeed
    Internet Speed
    faster than dialup
    Browser
    Waterfox
    Antivirus
    none
    Other Info
    potato image lighted > http://i.imgur.com/gYkHqxU.jpg

FreeBooter

Active Member
Member
VIP
Local time
4:39 AM
Posts
237
Location
Turkey
You mean double-click to activate the malware.
 

My Computer

System One

  • Operating System
    Windows 10 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Gigabyte Technology Co., Ltd.
    CPU
    QuadCore Intel Core i5-6600
    Motherboard
    Gigabyte GA-Z170M-D3H
    Memory
    Corsair Vengeance LPX CMK8GX4M1A2666C16
    Graphics Card(s)
    Sapphire Radeon R9 380
    Sound Card
    Realtek ALC892
    Monitor(s) Displays
    Samsung SyncMaster U28E590
    Hard Drives
    Sata SSD
    Internet Speed
    25Mbps
    Browser
    Firefox
    Antivirus
    Windows Defender

DTG1

Death to Gnomes!!!
Member
VIP
Local time
9:39 PM
Posts
128
Location
SE MI
Thread starter

My Computer

System One

  • Operating System
    Win10
    Computer type
    PC/Desktop
    Manufacturer/Model
    ME
    CPU
    AMD FX-9370
    Motherboard
    ASUS SABERTOOTH 990FX R2.0 +SB950
    Memory
    G.Skill Sniper 16gb DDR3 2400
    Graphics Card(s)
    Msi GTX1080 Gaming X
    Sound Card
    onboard (realtek?) -- SPKRS:Logitech Z623 200w 2.1
    Monitor(s) Displays
    2x Dell S2440L (16:9) 1 Nixeus NX-EDG27S
    Hard Drives
    C:\Samsung Evo (500GB)
    D:\Samsung Evo (1TB)
    F:\Seagate (2TB)
    PSU
    Corsair HX1000i
    Case
    Phanteks Enthoo Primo w/9 140mm fans
    Cooling
    CM Nepton 280L(CPU) (4 fan P/P)
    Keyboard
    Logitech 910s Orion Spark
    Mouse
    Logitech G604 LightSpeed
    Internet Speed
    faster than dialup
    Browser
    Waterfox
    Antivirus
    none
    Other Info
    potato image lighted > http://i.imgur.com/gYkHqxU.jpg

FreeBooter

Active Member
Member
VIP
Local time
4:39 AM
Posts
237
Location
Turkey
yea depending on your click settings, whatever it takes to launch that .bat file.
Yes but Windows OS needs to be setup for single click to work.
 

My Computer

System One

  • Operating System
    Windows 10 Pro
    Computer type
    PC/Desktop
    Manufacturer/Model
    Gigabyte Technology Co., Ltd.
    CPU
    QuadCore Intel Core i5-6600
    Motherboard
    Gigabyte GA-Z170M-D3H
    Memory
    Corsair Vengeance LPX CMK8GX4M1A2666C16
    Graphics Card(s)
    Sapphire Radeon R9 380
    Sound Card
    Realtek ALC892
    Monitor(s) Displays
    Samsung SyncMaster U28E590
    Hard Drives
    Sata SSD
    Internet Speed
    25Mbps
    Browser
    Firefox
    Antivirus
    Windows Defender

johngalt

Well-known member
WQ Insider
Member
VIP
Local time
9:39 PM
Posts
471
Location
3rd Rock
And it can easily be done so. Simple change one setting in Folder options.

I was about top read that article this evening anyway lol. It popped up in my Google feed....

It was in Win7, I think , that I thought I'd be 'smart' and edit the reg entries for various script file types (and .reg filetype as well), making Edit the default action versus Open, and assigning the edit function to notepad.

Until someone pointed out to me that calling scripts from CLI would not edit them but still run them normally, even if Open was not the default action.
 

My Computer

System One

  • Operating System
    Windows 10 Pro X64
    Computer type
    PC/Desktop
    Manufacturer/Model
    The Beast Model A (homebrew)
    CPU
    AMD Ryzen 9 3950X
    Motherboard
    MSI MEG X570 GODLIKE
    Memory
    4 * Corsair Vengeance 32 GB 3600 MHz
    Graphics Card(s)
    eVGA GeForce GTX 970 SSC ACX 2.0 (04G-P4-3979-KB)
    Sound Card
    Realtek® ALC1220 Codec
    Monitor(s) Displays
    2 * Lenovo LT2323pwA Widescreeen @ 1920*1080
    Hard Drives
    3x Sabrent Rocket PCIe Gen4 NVMe M.2 1 TB SSD (SB-ROCKET-NVMe4-1TB)
    SanDisk Ultra SDSSDHII-960G-G25 960 GB SATA III SSD
    Crucial MX100 CT256MX100SSD1 256GB SATA III SSD
    2 * Seagate Barracuda 7200.12 ST31000528AS 1TB 7200 RPM (Old storage)
    PSU
    PC Power & Cooling’s Silencer Series 1050 Watt, 80 Plus Platinum
    Case
    Fractal Design Define 7 XL Dark ATX Full Tower Case
    Cooling
    NZXT KRAKEN Z73 73.11 CFM Liquid CPU Cooler + Air (3 * 140mm fans from case)
    Keyboard
    SteelSeries Apex Pro Wired Gaming Keyboard
    Mouse
    Logitech MX Master 3 Wireless Laser Mouse(shared)
    Internet Speed
    AT&T Lightspeed Gigabit duplex
    Browser
    Nightly|Chrome|Canary|Edge+ (Chromium) (in all 4 flavors)
    Antivirus
    Windows Defender + MB 4

DTG1

Death to Gnomes!!!
Member
VIP
Local time
9:39 PM
Posts
128
Location
SE MI
Thread starter

My Computer

System One

  • Operating System
    Win10
    Computer type
    PC/Desktop
    Manufacturer/Model
    ME
    CPU
    AMD FX-9370
    Motherboard
    ASUS SABERTOOTH 990FX R2.0 +SB950
    Memory
    G.Skill Sniper 16gb DDR3 2400
    Graphics Card(s)
    Msi GTX1080 Gaming X
    Sound Card
    onboard (realtek?) -- SPKRS:Logitech Z623 200w 2.1
    Monitor(s) Displays
    2x Dell S2440L (16:9) 1 Nixeus NX-EDG27S
    Hard Drives
    C:\Samsung Evo (500GB)
    D:\Samsung Evo (1TB)
    F:\Seagate (2TB)
    PSU
    Corsair HX1000i
    Case
    Phanteks Enthoo Primo w/9 140mm fans
    Cooling
    CM Nepton 280L(CPU) (4 fan P/P)
    Keyboard
    Logitech 910s Orion Spark
    Mouse
    Logitech G604 LightSpeed
    Internet Speed
    faster than dialup
    Browser
    Waterfox
    Antivirus
    none
    Other Info
    potato image lighted > http://i.imgur.com/gYkHqxU.jpg
Top