oraforsnacks - Fenris

content copied
content

Start
SystemRestore: On
CreateRestorePoint:
CloseProcesses:
Task: {C842C631-A7DA-4BCF-9832-8F7F2178DB02} - \InteractiveServices\PresentationFrameworkTask.CL-NCLS-1-5-21-1911753872-4082573132-1566520084-1001 -> No File <==== ATTENTION
S3 cpuz160; \??\C:\WINDOWS\temp\cpuz160\cpuz160_x64.sys (No File) <==== ATTENTION
Folder: C:\WINDOWS\system32\wsvcz
REG: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v DcomLaunch /s
CMD: Dir /b c:\*wsvcz* /s
HKU\S-1-5-21-1911753872-4082573132-1566520084-1001\...\StartupApproved\StartupFolder: => "Ground.lnk"
C:\Users\Victus\AppData\Local\Temp\{95fa803c-cbbc-4c66-a6f4-52b2224cf883}

Comment: This snippet removes all Windows Defender exclusions
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths
StartPowershell:
Try {
    $Paths=(Get-MpPreference).ExclusionPath
    $Extensions=(Get-MpPreference).ExclusionExtension
    $Processes=(Get-MpPreference).ExclusionProcess
    
    foreach ($Path in $Paths) { 
        Remove-MpPreference -ExclusionPath $Path -force -ErrorAction Stop
    }
    foreach ($Extension in $Extensions) { 
        Remove-MpPreference -ExclusionExtension $Extension -force -ErrorAction Stop
    }
    foreach ($Process in $Processes) { 
        Remove-MpPreference -ExclusionProcess $Process -force -ErrorAction Stop
    }
}
Catch {
    Write-Error "Error occurred while removing Windows Defender exclusions: $_"
}
EndPowershell:

CMD: type "C:\Users\Victus\Desktop\sfcdetails.txt"
CMD: type "C:\WINDOWS\system32\Tasks\PostponeDeviceSetupToast_S-1-5-21-1911753872-4082573132-1566520084-1001_7"
2026-06-11 21:05 - 2026-06-11 21:05 - 000004040 _____ C:\WINDOWS\system32\Tasks\PostponeDeviceSetupToast_S-1-5-21-1911753872-4082573132-1566520084-1001_7

C:\WINDOWS\Temp\*
C:\WINDOWS\SystemTemp\*
C:\Users\Victus\AppData\Local\Temp\*

StartPowerShell:
# This snippet downloads Emsisoft Emergency Kit (EEK) from the Emsisoft's official site, updates it, scans with it.
# Do note that the executable is 300MB and may take some time to download.
# ---
# This will scan for malware and PUP's in 1) system memory 2) important folders as documentation says
# It will scan in compressed archives, in mail archives, in NTFS alternate data streams and use cloud requests
# ---
# You can use argument "/delete" to delete found objects including references but this is permanent and irreversible.
# You can remove the "/quick" argument to do a full scan but that may take longer than what FRST can handle.
# You can use argument "/quarantine="[folder]"" to put found malware into quarantine, but I personally prefer first verifying the detections.
$downloadUrl = "https://dl.emsisoft.com/EmsisoftEmergencyKit.exe"
$systemDrive = $env:SystemDrive
$frstPath = "$systemDrive\FRST"
$savePath = "$frstPath\EEK.exe"
$extractPath = "$frstPath\EEK"
if (-not (Test-Path $frstPath)) {
    New-Item -Path $frstPath -ItemType Directory -Force | Out-Null
}
if (-not (Test-Path $extractPath)) {
    New-Item -Path $extractPath -ItemType Directory -Force | Out-Null
}
Invoke-WebRequest -Uri $downloadUrl -OutFile $savePath -UseBasicParsing
$proc = Start-Process -FilePath $savePath -ArgumentList "-s -d`"$extractPath`"" -PassThru
while (-not (Test-Path "$extractPath\bin64\a2cmd.exe")) { Start-Sleep -Milliseconds 1000 }
Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
if ([Environment]::Is64BitOperatingSystem) {
    $a2cmdPath = Join-Path $extractPath "bin64\a2cmd.exe"
} else {
    $a2cmdPath = Join-Path $extractPath "bin32\a2cmd.exe"
}
Start-Process -FilePath $a2cmdPath -ArgumentList "/update" -Wait -NoNewWindow
Start-Process -FilePath $a2cmdPath -ArgumentList "/malware /quick /m /t /pup /a /am /cloud=1 /la=`"$frstPath\EEK_scan.log`"" -Wait -NoNewWindow
Get-Content "$frstPath\EEK_scan.log"
exit
EndPowerShell:

StartPowershell:
# Replace /scanonly with /clean if you also want to delete items -- however, this will activate a trial license on the system, I do not recommend it
$hmpExe  = "$env:TEMP\HitmanPro_x64.exe"
$logFile = "$env:TEMP\HitmanPro_ScanLog.txt"
Invoke-WebRequest -Uri "https://dl.surfright.nl/HitmanPro_x64.exe" -OutFile $hmpExe -UseBasicParsing
$proc = Start-Process $hmpExe -ArgumentList "/ews","/scanonly","/noinstall","/log=`"$logFile`"","/logtype=txt" -Wait -PassThru
if (!(Test-Path $logFile)) { Write-Host "Scan failed (exit $($proc.ExitCode))"; exit 1 }
Get-Content $logFile -Encoding Unicode
EndPowershell:

CMD: sfc /scannow
CMD: findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >> "%userprofile%\desktop\sfcdetails.txt"
CMD: type "%userprofile%\desktop\sfcdetails.txt"
CMD: DISM /Online /Cleanup-Image /RestoreHealth

cmd: del %temp%\*.* /f /s /q
cmd: rd /s /q %temp%
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
Hosts:
RemoveProxy:
EmptyTemp:
End
Malware Log Analysis

content
