Kaynak: C:\Users\Medusa\Desktop\sann

(vmstealth DOSYA idi -> silindi)

Payload -> C:\ProgramData\vmstealth (whl: 3 dosya)

WHarden boot-gorevi kuruldu

===== 1/3 Registry cleanup =====

(guest_harden.log yazildi)

===== 2/3 Disk switch hazirlik (LSI SAS boot-start) =====

=== prep_switch 11:12:34 ===

boot-start OK LSI_SAS

boot-start OK storahci

boot-start OK stornvme

boot-start OK megasas

boot-start OK MegaSR

boot-start OK 3ware

boot-start OK amdsata

boot-start OK arcsas

boot-start OK HpSAMD

boot-start OK iaStorV

boot-start OK iaStorAV

boot-start OK nvraid

boot-start OK nvstor

boot-start OK vsmraid

boot-start OK atapi

boot-start OK intelide

boot-start OK pciide

boot-start OK vhdmp

boot-start OK SiSRaid2

boot-start OK SiSRaid4

boot-start OK uaspstor

boot-start OK mvumis

CDDB OK pci#ven_1000&dev_0054

CDDB OK pci#ven_1000&dev_0058

CDDB OK pci#ven_1000&dev_0056

CDDB OK pci#ven_1000&dev_0621

CDDB OK pci#ven_1000&dev_0622

>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.

===== 3/3 VmwareHardenedLoader =====

kaynak: C:\ProgramData\vmstealth\whl

Copy-Item : Cannot overwrite the item C:\ProgramData\vmstealth\whl\VmLoader.sys with itself.

At C:\ProgramData\vmstealth\install_whl.ps1:16 char:1

+ Copy-Item (Join-Path $cand "VmLoader.sys"),(Join-Path $cand "dyndata. ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : WriteError: (C:\ProgramData\...hl\VmLoader.sys:String) [Copy-Item], IOException

+ FullyQualifiedErrorId : CopyError,Microsoft.PowerShell.Commands.CopyItemCommand

################## OZET ##################

>>> LSI_SAS hazir (Start=0). Disk lsisas1068'e guvenle gecebilir.

##########################################

[!] 'imza: Valid' + 'servis: vmloader' + 'LSI_SAS hazir' gordun mu?

TAMAMSA: VM'i KAPAT (shutdown /s /t 0) ve bana 'kapattim' yaz.

Press any key to continue . . .