Fake IE, Notepad and more

Scams
1

Hi!

I wrote some fake MS programs for fun:

-Internet Explorer

-Notepad

-Syskey

I also made program to add your own entries to Event Viewer

--------------Features------------
Internet Explorer:
-Breaks most websites layout
-Has couple "ads" that just moves to random location when closed
-Replaces images with "NSFW Ads"

Notepad:
-Crashes when you try to access menus
-Scrambles text when you press enter
-Replaces vowels if you try copypasting text

Syskey:
-Asks to confirm 45 times when updating key
-Asks to confirm 45 times when trying to cancel
-Asks to use different key when confirmation completes

System Event Creator:
-Can add entries to Application and System -logs with specified text

Requires .NET Framework 4.5 or newer

Download:
https://mega.nz/#!DAd3XIYY!ukp2O6Pka_80qLEihgcrxVgaUxLNvnffunfUuzY5iTU

VirusTotal:
https://www.virustotal.com/#/file/7018369d40e03af1f6fdcbd8a6e85594025818decb98ab7decb4a30823097419/detection
(SentinelOne flags individual files for some reason...)

Screenshots:
http://imgur.com/a/mCcGH

2

[[1,28],[30,32]]

3

Where do you put them?

4

@FOXYCallum1#11714 Replace the actual programs with them

5

@Flame#11757 In system32?

6

Yes

7

Sorry for late reply!

Yes replace them in System32.

Also it can be bit tricky as Windows doesn’t like you messing with its system files. If you can’t replace them, you’ll need to take ownership for those files via cmd with following command:

“takeown /f {FILENAME_HERE}.”

Then adjust privileges through “Property” window.

Also note that Windows might revert your changes on next startup. (Take snapshot of your VM after changes)

8

@shamppaaa#11683 The fake syskey made the scammer lose his marbles…

9

@shamppaaa#11912That CMD code doesn’t do anything, unless im doing it wrong. What exactly do i put in it?

10

@FOXYCallum1#11934

So if you are replacing notepad for example, use

“takeown /f C:\Windows\System32\notepad.exe”


11

@shamppaaa#12014 Yeah, i still cant. Still says i don’t have privileges

12

@FOXYCallum1#12033

First make sure you run cmd as admin.

Then run takeown.

After that right-click the file, go to Properties → Security. From there click Edit, select Administrators (or something like that, can’t check it now…) and check the checkbox that says something like Full Permissions. Click apply.

Now you should be able to proceed.