1
1
# Simulate fake processes of analysis sandbox/VM software that some malware will try to evade.
2
2
# This just spawns ping.exe with different names (wireshark.exe, vboxtray.exe, ...)
3
3
#
4
- #
5
- # *------------------------------------------------------------------------------------------------------------------*
6
- # | This is the updated version with no CPU load at all. I will also add some more fake processes in future updates. |
7
- # | Maintained by Phoenix1747, get updates and fixes on https://www.github.com/phoenix1747/fake-sandbox/ . |
8
- # *------------------------------------------------------------------------------------------------------------------*
4
+ # This is the updated version with no CPU load at all. I will also add some more fake processes in future updates.
5
+ # Maintained by Phoenix1747, get updates and fixes on https://www.github.com/phoenix1747/fake-sandbox/
9
6
#
10
- # Usage (CMD): Powershell.exe -executionpolicy remotesigned -File "C:\Full\Path\To\File\fake-sandbox .ps1" -action {start,stop}
7
+ # Usage (CMD): Powershell.exe -executionpolicy remotesigned -File "C:\Full\Path\To\File\fsp .ps1"
11
8
12
9
$action = read-host " What do you want to do? (start/stop)"
13
10
14
11
# Your processes come here:
15
- $fakeProcesses = @ (" WinDbg.exe" , " idaq.exe" , " wireshark.exe" , " vmacthlp.exe" , " VBoxService.exe" , " VBoxTray.exe" , " procmon.exe" , " ollydbg.exe" , " vmware-tray.exe" , " idag.exe" , " ImmunityDebugger.exe" )
12
+ $fakeProcesses = @ (' WinDbg.exe' , ' idaq.exe' , ' wireshark.exe' , ' vmacthlp.exe' , ' VBoxService.exe' , ' VBoxTray.exe' , ' procmon.exe' , ' ollydbg.exe' , ' vmware-tray.exe' , ' idag.exe' , ' ImmunityDebugger.exe' )
16
13
17
14
# If you type in "start" it will run this:
18
15
if ($action -ceq " start" ) {
@@ -31,7 +28,7 @@ if ($action -ceq "start") {
31
28
32
29
# Start infinite ping process (invalid ip) that pings every 3600000 ms (1 hour)
33
30
Start-Process " .\$proc " - WindowStyle Hidden - ArgumentList " -t -w 3600000 -4 1.1.1.1"
34
- write-host " [+] Process $proc spawned "
31
+ write-host " [+] Spawned $proc "
35
32
}
36
33
37
34
Set-Location $oldpwd
0 commit comments