cheuk0620 - Fenris

content copied
content

Start::
CreateRestorePoint:
CloseProcesses:

HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
AlternateDataStreams: C:\Users\ngche\Downloads\esetonlinescanner (1).exe:MBAM.Zone.Identifier [157]
HKU\S-1-5-21-2331057209-136270744-4161921719-1001\...\Run: [MicrosoftEdgeAutoLaunch_F33D31B48FD4E5365E031583263D534C] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5403976 2026-10-01] (Microsoft Corporation -> Microsoft Corporation)
CHR HomePage: Default -> hxxp://sg.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ggbg_15_41&param1=1&param2=f%3D1%26b%3DChrome%26cc%3Dsg%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuzyyE0D0EzztDzz0AyC0B0A0EtBtCzzyDtN0D0Tzu0StCtAyBzytN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCyC0F0CyDzztCtBtGzzyD0E0DtGyEtBzztCtGzzyByDtCtG0FyByDtDtCtA0F0A0BzyyD0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyBtAtDyBtA0D0BtG0CyE0F0DtGyEtB0FzytGzytAzy0CtGtD0D0AtC0FyCtCyDzy0DyDzy2QtN0A0LzutDtN1B2Z1V1T1S1NzutCtDzzzz%26cr%3D701199658%26a%3Dwncy_ggbg_15_41%26os%3DWindows%2B7%2BHome%2BPremium

DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{79CFD708-44B6-4F76-9C16-B989F2D5D750}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2331057209-136270744-4161921719-1001\Products\807DFC976B4467F4C9619B982F5D7D05
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\AFAA82D0CE6CB9B4F9152139124A15E6

Unlock: C:\WINDOWS\Installer\7842db03.msi
StartPowerShell:
# This snippet uses Sysinternals Sigcheck to upload file on VirusTotal.
# Change the line containing the string "INSERTFILEPATHHERE" to the desired filepath
# ---
# It displays the following: entropy, file hashes, catalog name & signing chain, VirusTotal scan results and link to it.
# It is also able to traverse symbolic links and directory junctions.
# ---
# NOTE: If the file is not known prior, it gets uploaded to VirusTotal and the result will be available in a few minutes. 
#       You can search up the report by visiting the URL "https://www.virustotal.com/gui/file/<SHA256>"
$TempDir = [System.IO.Path]::GetTempPath()
$ZipPath = Join-Path $TempDir "SigcheckFRST.zip"
$ExtractPath = Join-Path $TempDir "SigcheckFRST"
Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Sigcheck.zip" -OutFile $ZipPath -UseBasicParsing
if (Test-Path $ExtractPath) { Remove-Item $ExtractPath -Recurse -Force }
Expand-Archive -Path $ZipPath -DestinationPath $ExtractPath -Force
$SigcheckExe = Join-Path $ExtractPath "sigcheck.exe"
if (Test-Path $SigcheckExe) {
    $psi = New-Object System.Diagnostics.ProcessStartInfo
    $psi.FileName = $SigcheckExe
    $psi.Arguments = '-accepteula -a -h -i -m -l -vt -vs -nobanner "C:\WINDOWS\Installer\7842db03.msi"'
    $psi.RedirectStandardOutput = $true
    $psi.StandardOutputEncoding = [System.Text.Encoding]::Unicode
    $psi.UseShellExecute = $false
    $psi.CreateNoWindow = $true
    $p = [System.Diagnostics.Process]::Start($psi)
    $output = $p.StandardOutput.ReadToEnd()
    $p.WaitForExit()
    Write-Output $output
} else {
    Write-Host "Error: Sigcheck does not exist"
}
Remove-Item $ZipPath -Force
EndPowerShell:

C:\WINDOWS\Installer\7842db03.msi

DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{81FBE49E-CFE9-44C3-BD74-9EAF39953649}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2331057209-136270744-4161921719-1001\Products\E94EBF189EFC3C44DB47E9FA93596394
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\E05AF9E4C8970034B8BF71971109840F

Unlock: C:\WINDOWS\Installer\7842db08.msi
C:\WINDOWS\Installer\7842db08.msi

C:\Users\ngche\AppData\Local\Microsoft\Windows\WebCache\VitalsArchive
C:\Users\ngche\AppData\Local\Microsoft\Windows\INetCache\VitalsArchive
C:\Users\ngche\AppData\Local\Microsoft\Windows\Caches\VitalsArchive
C:\Users\ngche\AppData\Local\Microsoft\Windows\Caches\MicrosoftSpatial\
C:\Users\ngche\AppData\Roaming\Microsoft\Windows\Libraries\MicrosoftSpatial\
C:\Users\ngche\AppData\Local\Microsoft\Windows\Notifications\MicrosoftSpatial\
C:\Users\ngche\AppData\Local\Microsoft\Windows\WebCache\MicrosoftSpatial\
C:\Users\ngche\AppData\Local\Microsoft\Windows\INetCache\MicrosoftSpatial\

EmptyTemp:
End::
Malware Log Analysis

content
