Skip to content

Commit 2f3829c

Browse files
Small file changes
1 parent c4be35d commit 2f3829c

File tree

2 files changed

+6
-9
lines changed

2 files changed

+6
-9
lines changed

fsp.ps1

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,15 @@
11
# Simulate fake processes of analysis sandbox/VM software that some malware will try to evade.
22
# This just spawns ping.exe with different names (wireshark.exe, vboxtray.exe, ...)
33
#
4-
#
5-
# *------------------------------------------------------------------------------------------------------------------*
6-
# | This is the updated version with no CPU load at all. I will also add some more fake processes in future updates. |
7-
# | Maintained by Phoenix1747, get updates and fixes on https://www.github.com/phoenix1747/fake-sandbox/ . |
8-
# *------------------------------------------------------------------------------------------------------------------*
4+
# This is the updated version with no CPU load at all. I will also add some more fake processes in future updates.
5+
# Maintained by Phoenix1747, get updates and fixes on https://www.github.com/phoenix1747/fake-sandbox/
96
#
10-
# Usage (CMD): Powershell.exe -executionpolicy remotesigned -File "C:\Full\Path\To\File\fake-sandbox.ps1" -action {start,stop}
7+
# Usage (CMD): Powershell.exe -executionpolicy remotesigned -File "C:\Full\Path\To\File\fsp.ps1"
118

129
$action = read-host " What do you want to do? (start/stop)"
1310

1411
# Your processes come here:
15-
$fakeProcesses = @("WinDbg.exe","idaq.exe","wireshark.exe", "vmacthlp.exe", "VBoxService.exe", "VBoxTray.exe", "procmon.exe", "ollydbg.exe", "vmware-tray.exe", "idag.exe", "ImmunityDebugger.exe")
12+
$fakeProcesses = @('WinDbg.exe','idaq.exe','wireshark.exe','vmacthlp.exe','VBoxService.exe','VBoxTray.exe','procmon.exe','ollydbg.exe','vmware-tray.exe','idag.exe','ImmunityDebugger.exe')
1613

1714
# If you type in "start" it will run this:
1815
if ($action -ceq "start") {
@@ -31,7 +28,7 @@ if ($action -ceq "start") {
3128

3229
# Start infinite ping process (invalid ip) that pings every 3600000 ms (1 hour)
3330
Start-Process ".\$proc" -WindowStyle Hidden -ArgumentList "-t -w 3600000 -4 1.1.1.1"
34-
write-host "[+] Process $proc spawned"
31+
write-host "[+] Spawned $proc"
3532
}
3633

3734
Set-Location $oldpwd

installer/fsp-installer.bat

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ echo Set-Location $binloc
7878
echo foreach ($proc in $fakeProcesses^) {
7979
echo Copy-Item c:\windows\system32\ping.exe '$binloc\$proc'
8080
echo Start-Process '.\$proc' -WindowStyle Hidden -ArgumentList '-t -w 3600000 -4 1.1.1.1'
81-
echo write-host '[+] Process $proc spawned'
81+
echo write-host '[+] Spawned $proc'
8282
echo }
8383
echo Set-Location $oldpwd
8484
)>%appdata%\FakeSandboxProcesses\fsp.ps1

0 commit comments

Comments
 (0)