Posts

Malware

Emotet malware botnet is back

The Emotet malware botnet is back and running one again almost ten months after an international law enforcement operation took its command-and-control servers earlier this year in January.

  • Once described as the “world’s most dangerous malware,” Emotet worked by sending massive waves of email spam to users all over the world in order to infect them with its malware strain.
  • Once infected these systems would allow the Emotet gang to download and install additional payloads4.
  • On Monday (15.11.2021), several researchers spotted indicators that Emotet has returned.

Over the weekend, security researcher from Cyber[.]wtf spotted that another malware botnet named TrickBot was helping the Emotet gang get back on its feet by installing the Emotet malware on systems that had been previously infected with TrickBot.
According to the researchers, they used to call this Operation ReachAround back when Emotet was dropped by TrickBot in the past.
According to the Abuse.ch, a member of the team tracked Emotet in the past, shows the gap in Emotet’s dormant period between January and November 2021, while the group rolled out new command and control servers (see Figure).

According to tracking teams, the Emotet gang is not sending out any new email spam but relying on the TrickBot gang to help them create an initial footprint of their new botnet incarnation before ramping up spam operations again.

“It doesn’t seem too large at this time, and we are not seeing active distribution yet,” the white-hat research group said. It remains to be seen if Emotet’s comeback will succeed.
Additionally, Abuse.ch group added that blocking the tracked command-and-control servers is strongly advised.

The updated list can be found at:

References:

Browsers

Chrome can now hide the padlock

As of the latest beta today it seems that Google Chrome has the option to no longer display the padlock that shows if a website is is actually SSL encrypted. Even though I like the little indicator, with everything going on, less is more, so less clutter is better in my opinion.

Here is how to hide indicator in the latest beta:

  1. Type “chrome://flags” in the address bar and press the enter key
  2. Search for “security indicators”
  3. Where the “Omnibox Updated connection security indicators” flag is displayed, click the pulldown menu that displays “Default” and select “Enabled”
  4. Restart the browser

Chrome will now notify you when a site is insecure.

Microsoft Server

Update or Install missing drivers on Windows Server Core 2016/2019 for free

Install Drive Easy Free from:
https://www.drivereasy.com/download-free-version/

Start DriverEasy from

“C:\Program Files\Easeware\DriverEasy\DriverEasy.exe”

Scan the machine and pick the driver you need from the list and download it.

In the command prompt, cd to folder:

c:\users\<username here>\Appdata\Roaming\Easeware\DriverEasy\Drivers\

To find the driver you just downloaded, type:
dir *.inf /s/b
CD to that directory and type:
pnputil -i -a *.inf

Note: DriverEasy will crash after ever single download as it does not have a GUI to fall back on, so, unless you want to spend a lot of time restarting DriverEasy, only bother with the drivers you really need. I usually only bother with storage and network drivers.
Also, if you happen to have core installed on a laptop with integrated hardware like webcams, etc. these drivers will have issues installing as the underlying infrastructure is missing

Hyper-V

Windows 2000 on Hyper-V

Sometimes it’s necessary to install an old Operating System, but you really cannot (or don’t want to) get the old hardware out, even if it would still work.
I was in such a position that I had to install Windows 2000 Server. After locating the installation media, I decided it was a good idea to get it running on the 2019 Hyper-V cluster. This actually can be done, but there are a few hoops to jump through:

– The base VM must be setup with a legacy network card.
– Also the vCPU must be set to legacy mode for this VM.
– The Windows 2000 installation media must have SP4 slipstreamed.
If SP4 is not slipstreamed into the installation media, setup will not even properly start, but will Blue Screen with:

STOP: 0x0000001E (…) KMODE_EXCEPTION_NOT_HANDLED on the driver acpi.sys

If you don’t have the original installation media with SP4 installed, you can download SP4 from WinWorldPC and slipstream yourself as explained here.

Creating the VM

This part is pretty much the standard process. I’ve named my VM: Windows 2000 Adv En, Generation 1 VM type, Startup Memory of 3072MB and make sure Dynamic Memory is turned off. Also leave the network card as Not Connected. (We’ll connect the NIC in a later stage)
Note: I’ve put the RAM to 3GB as Windows 2000 is a 32bit operating system and is not capable of addressing much more without some PAE trickery)

Create a new virtual hard disk. For Windows 2000 you don’t really need a lot, so I gave it 20GB. A lot more than it needs, but it doesn’t really matter. A fixed size seems to be the fastest for the installation, as the formatting of the disk during setup seems faster. Make sure you create a VHD and not a VHDX. The OS intermittently Blue Screens after the installation of the storage drivers when a VHDX is used.

Next remove the SCSI controller. Windows 2000 does not support the SCSI controller and will Blue Screen with:

STOP: 0xC0000263 {Driver Entry Point Not Found} The \SystemRoot\system32\DRIVERS\storvsc.sys device driver could not locate the entry point ZwQueryFullAttributesFile in driver ntoskrnl.exe.

On the install options tick the box to install an operating system from a bootable CD/DVD-ROM, select Image File and browse to where the Windows 2000 iso is stored and click finish.

Enable legacy settings

The following step is to enable the vCPU legacy compatibility for Windows 2000. So open up Powershell in administrator mode and enter:

Set-VMProcessor <VM Name Here> -CompatibilityForOlderOperatingSystemsEnabled $true

So in my case I type:

Set-VMProcessor “Windows 2000 Adv En” -CompatibilityForOlderOperatingSystemsEnabled $true
(Notice the quotes. These are needed if you have spaces in your VM name)

If you need network access, you need to setup a legacy network adapter. In the Hyper-V manager select Settings for your VM and select Network Adapter. Click the Remove button. Now click on Add Hardware and add a Legacy Network Adapter. The NIC will stay disconnected if you don’t specifically connected to the virtual switch in the settings of the Legacy Network Adapter. If you have any further network configuration, like named vLANs, you can set these there.
Note: Since Windows 2000 (and this goes for Windows NT3.51, NT4 and 2003 as well) has not had any security patches for years and these were not known for a robust security to begin with, be very careful connecting a legacy VM like this one to the internet. Take extra steps to protect your network in these times of ransomware and other malicious software.

From here you can follow the normal setup process for Windows 2000 and this should succeed. During the setup of the operating system, the mouse is not going to be available. You will not be able to immediately add the server to a domain during setup either. The reason for this is that Server 2019 does not offer Windows 2000 compatible integration services. These will have to be installed manually after setup completes.
The latest installable integration services that will install most drivers on Windows 2000 are the vmguest.iso is for Windows Server 2008R2 (Linked below), but the 2008 version will work. Unfortunately Microsoft no longer officially hosts these on their webpage.

Various versions of the VM Guest tools:
Hyper-V2008-vmguest.iso
Hyper-V2008R2-vmguest.iso
Hyper-V2012R2-vmguest.iso

Product Keys for Windows 2000 (Taken from WinWorldPC):

Pro: RBDC9-VTRC8-D7972-J97JY-PRVMG
Server: H6TWQ-TQQM8-HXJYG-D69F7-R84VM
Advanced Server: WY6PG-M2YPT-KGT4H-CPY6T-GRDCY

Abandonware

LeMenu 3.1 (1988) – Installation on Dosbox

As the name suggests, LeMenu is a menu making package that includes a directory manager. Menus and sub-menus can be created, you can run Batch-files from the menu directly as if these were normal programs and even a basic activity log is kept. The menu itself supports up to 4 different levels and can hold 26 items each, an item for each letter of the alphabet, which gives the possibility of setting up more menu items than the largest collection of software running within Dosbox that I’ve ever seen.

Since it’s obviously MS-Dos based and can run batch files from the menu directly, makes it perfect for launching games and other applications from within Dosbox.

LeMenu needs to be installed on a hard disk, but this does not necessarily have to be the boot disk. Since it doesn’t need a lot of space, I’m using a standard 256MB disk image. Though LeMenu could easily be run from a 10MB or even 5MB disk, I like a little more space to install other software on. It really is moot as hard disk images can just as easily be mounted through the use of batch files and keeping programs and games on their own hard disks does make it easier to backup or make changes.

The installation on Dosbox: (I’m using the path c:\temp on my local hard disk for these steps)

  1. Create or download a hard disk image for Le Menu. You can download pre-made images from this link
  2. Download the floppy-disk installation image for Le Menu and copy it to your install folder.
    1. Optional: Download MS-Dos version 3.31 floppy disk to later add optional MS-Dos functionality. If you’re going to be using Le Menu for the launching of games and applications only, you do not need this
  3. To make sure you always have the Le Menu drive attached to Dosbox, modify the dosbox.conf file and add the following to the bottom

    @imgmount f C:\temp\lemenu\lemenu.img
    @path=z:\;f:\lemenu;f:\;f:\games;
    @f:
    @cd lemenu
    @le menu

    Note: Depending on your host operating system, the location of the dosbox.conf file varies. If you’re unsure of where to find it, please check this article
  4. Start your Dosbox emulator. You can ignore the message that it’s unable to change to lemenu. It’s not installed yet
  5. Go to the F-drive by typing f: and press enter. We need to copy the file command.com from the z:\ drive which is automatically mounted when Dosbox is started by typing: f:\copy z:\command.com and press enter
  6. To connect the Le Menu install disk (and optionally the MS-Dos 3.31 disk), enter the following: (Assuming you’re using the c:\temp location) imgmount a c:\temp\install\LMflop.img c:\temp\install\dos3-1.img -t floppy
    You should get the message:
    Drive A is mounted as c:\temp\install\LMflop.img
  7. Go to the A-drive and start the installation by typing a:\install and press enter

The first screen tells you that you have to complete the installation (DUH!), but on the second screen you can change colours and the way LeMenu looks by pressing the C key. If you think the colours look fine, just press enter or the F1-key if you modified any.
The third screen is fairly important for the installation. The first line You can type in whatever you want. It will be displayed on the main screen and is only changeable by reinstalling Le Menu.
The second and third lines are the locations where you want Le Menu installed and where Dos boots from. Since we mounted the Le Menu drive as disk F, we will put the letter F in both the boxes.
The rest of the lines are optional.

After everything is entered, press the F1-key to save and continue. The installation will now copy the Le Menu files to the F-Drive. If you want to install the MS-Dos extras, switch floppy images with the CTRL-F4 keys when the install program asks for the optional floppies. If you choose not to, just continue the installation. When the installation is successful, reboot Dosbox by pressing the CTRL-ALT-Home buttons simultaneously.

Le Menu should now start when you start Dosbox and the result should look something like this:

LeMenu 3.1 by Bartel Software
Abandonware

Windows ME on Dosbox ECE, even on Raspberry Pi4b

If you search the web you’ll find a lot statements that the installation of Windows Millennium or Windows ME on Dosbox is just not possible, that it will not work, that it will not even complete setup, no matter what.
I wouldn’t be writing this if I hadn’t found differently. Nowadays it is indeed possible to run Windows ME on Dosbox and, even though it’s not supported, it is fairly stable. At least more stable than I expected and a lot more stable than Windows 98SE on the same environment.

Now the question is “Why? Why would anyone want to install an OS that was (and still is) considered the second most horrible operating system ever released by Microsoft? (The first most hated is Windows Vista) The answer to that is simple: Because people said it could not be done while there is no logical reason for this not to work. Also I never developed a bias against it as I didn’t use it at the time. I had a dual-boot Windows 98SE/Windows 2000 workstation and before I finally got around installing ME, Windows XP was launched.

Anyway, below a quick and dirty video of Dune 2000 on Windows Millennium running on a Raspberry Pi4b with Dosbian 1.5 install. One of these days I’ll modify this post with a how-to installing Windows ME on Dosbox.

Microsoft Windows 10

Synology Drive App for Windows 10 does not connect

When trying to connect, the app displays a message:

Connection fail. Check your network settings and try again.

The solution to this is that next to port 5000 and 5001, the port 6690 also has to be opened to the Synology NAS. If this port is not opened, the Windows app will fail.

The Android and iOS apps will work with just port 5000 (or 5001 if SSL is selected and the certificate is valid).

Microsoft Generic

Force Remove Host from SCVMM 2019

Open Powershell with administrative credentials:

PS C:\> $Credential = Get-Credential
PS C:\> $VMHost = Get-SCVMHost -ComputerName “<Hostname of Server here>”
PS C:\> Remove-SCVMHost -VMHost $VMHost -Credential $Credential

The Get-Credential cmd-let will open a prompt in which you have to supply credentials with the rights to remove the host. In the second line you specify the server. This doesn’t have to be the FQDN, the Netbios name will do.
The last line actually removes the server. This may take a few minutes, depending if the server responds or not. If the server does not respond, Powershell waits for a time-out.