kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
1.89k stars 408 forks source link

win10_disabler.ps1 error #2278

Closed qux-bbb closed 3 weeks ago

qux-bbb commented 1 month ago

About accounts on capesandbox.com

This is open source and you are getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

Expected Behavior

win10_disabler.ps1 runs no error.

Current Behavior

The output shows it has 3 errors:

PS C:\Users\alice\Desktop> .\win10_disabler.ps1
Disabling Windows defender features...

DisableAntiSpyware : 1
PSPath             : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
PSParentPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
PSChildName        : Windows Defender
PSDrive            : HKLM
PSProvider         : Microsoft.PowerShell.Core\Registry

Set-MpPreference : 找不到接受实际参数“DisableAntiSpyware”的位置形式参数。
所在位置 C:\Users\alice\Desktop\win10_disabler.ps1:15 字符: 1
+ Set-MpPreference DisableAntiSpyware $true -ExclusionPath C:\ -Disable ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Set-MpPreference],ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Set-MpPreference

Disabling Firewall...
Disabling SmartScreen Filter...
Security_HKLM_only : 0
PSPath             : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
PSParentPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion
PSChildName        : Internet Settings
PSDrive            : HKLM
PSProvider         : Microsoft.PowerShell.Core\Registry

Property      : {}
PSPath        : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
PSParentPath  : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
PSChildName   : Zones
PSDrive       : HKLM
PSProvider    : Microsoft.PowerShell.Core\Registry
PSIsContainer : True
SubKeyCount   : 0
View          : Default
Handle        : Microsoft.Win32.SafeHandles.SafeRegistryHandle
ValueCount    : 0
Name          : HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones

Property      : {}
PSPath        : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
PSParentPath  : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
PSChildName   : 2
PSDrive       : HKLM
PSProvider    : Microsoft.PowerShell.Core\Registry
PSIsContainer : True
SubKeyCount   : 0
View          : Default
Handle        : Microsoft.Win32.SafeHandles.SafeRegistryHandle
ValueCount    : 0
Name          : HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2

2301         : 3
PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
PSChildName  : 2
PSDrive      : HKLM
PSProvider   : Microsoft.PowerShell.Core\Registry

Disabling browser auto update...
Microsoft Edge updater running... Killing it
Waiting for Microsoft Edge update to finish (60s Timeout)
Microsoft Edge updater running... waiting its finish...
Microsoft Edge updater finished.
Disabling telemetry via Group Policies
New-FolderForced : 无法将“New-FolderForced”项识别为 cmdlet、函数、脚本文件或可运行程序的名称。请检查名称的拼写,如果包括路径,请确保路径正确,然后再试一次。
所在位置 C:\Users\alice\Desktop\win10_disabler.ps1:53 字符: 1
+ New-FolderForced -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Dat ...
+ ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (New-FolderForced:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Block scheduled telemetry tasks
Actions            : {MSFT_TaskExecAction}
Author             : $(@%SystemRoot%\system32\compattelrunner.exe,-501)
Date               :
Description        : $(@%SystemRoot%\system32\compattelrunner.exe,-503)
Documentation      :
Principal          : MSFT_TaskPrincipal2
SecurityDescriptor : D:(A;;GA;;;BA)(A;;GA;;;SY)(A;;FRFX;;;LS)
Settings           : MSFT_TaskSettings3
Source             : $(@%SystemRoot%\system32\compattelrunner.exe,-501)
State              : Disabled
TaskName           : Microsoft Compatibility Appraiser
TaskPath           : \Microsoft\Windows\Application Experience\
Triggers           : {MSFT_TaskTimeTrigger, MSFT_TaskTrigger, MSFT_TaskTrigger}
URI                : \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
Version            : 1.0
PSComputerName     :

Actions            : {MSFT_TaskExecAction}
Author             : $(@%SystemRoot%\system32\invagent.dll,-701)
Date               :
Description        : $(@%SystemRoot%\system32\invagent.dll,-702)
Documentation      :
Principal          : MSFT_TaskPrincipal2
SecurityDescriptor : D:(A;;GA;;;BA)(A;;GA;;;SY)(A;;FRFX;;;LS)
Settings           : MSFT_TaskSettings3
Source             : $(@%SystemRoot%\system32\invagent.dll,-701)
State              : Disabled
TaskName           : ProgramDataUpdater
TaskPath           : \Microsoft\Windows\Application Experience\
Triggers           :
URI                : \Microsoft\Windows\Application Experience\ProgramDataUpdater
Version            : 1.0
PSComputerName     :

Actions            : {MSFT_TaskExecAction}
Author             : Microsoft Corporation
Date               :
Description        : 扫描启动项,并在启动项过多的情况下向用户发出通知。
Documentation      :
Principal          : MSFT_TaskPrincipal2
SecurityDescriptor : D:(A;OICI;FA;;;BA)(A;OICI;FA;;;LA)(A;OICI;FA;;;SY)(A;OICI;FRFX;;;AU)(A;;FRFX;;;LS)
Settings           : MSFT_TaskSettings3
Source             : Microsoft Corporation
State              : Disabled
TaskName           : StartupAppTask
TaskPath           : \Microsoft\Windows\Application Experience\
Triggers           :
URI                : \Microsoft\Windows\Application Experience\StartupAppTask
Version            : 1.0
PSComputerName     :

Actions            : {MSFT_TaskExecAction}
Author             : Microsoft Corporation
Date               :
Description        : Updates compatibility database
Documentation      :
Principal          : MSFT_TaskPrincipal2
SecurityDescriptor : D:(A;;GA;;;BA)(A;;GA;;;SY)(A;;FRFX;;;LS)
Settings           : MSFT_TaskSettings3
Source             : Microsoft Corporation
State              : Disabled
TaskName           : PcaPatchDbTask
TaskPath           : \Microsoft\Windows\Application Experience\
Triggers           : {MSFT_TaskTimeTrigger}
URI                : \Microsoft\Windows\Application Experience\PcaPatchDbTask
Version            : 1.0
PSComputerName     :

Remove WindowsApp to prevent MS StoreStartup
Remove-Item : 找不到路径“C:\Users\Default\AppData\Local\Microsoft\WindowsApp”,因为该路径不存在。
所在位置 C:\Users\alice\Desktop\win10_disabler.ps1:88 字符: 1
+ Remove-Item -path C:\Users\Default\AppData\Local\Microsoft\WindowsApp ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Users\Defaul...soft\WindowsApp:String) [Remove-Item], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand

Failure Information (for bugs)

Please help provide information about the failure if this is a bug. If it is not a bug, please remove the rest of this template.

Steps to Reproduce

Run win10_disabler.ps1 in Windows 10 21H2

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions. Operating system version, bitness, installed software versions, test sample details/hash/binary (if applicable).

Question Answer
OS version Windows 10 21H2
doomedraven commented 3 weeks ago

i guess we can close this then?

qux-bbb commented 3 weeks ago

Yeah, fixed in this pr https://github.com/kevoreilly/CAPEv2/pull/2289