Demonstrate what could happen after a fake Microsoft call

Question

In Germany, people are getting phone calls like this:

Hi, my name is XYZ, I'm from Microsoft.

We're receiving many errors and problem reports from your PC. I'm now here to help you fixing those problems.

Are you in front of the PC? Please open the URL XYZ in your browser. Download the repair tool and run it.

Click "Yes" on that dialog.

The "Yes" action will confirm the UAC dialog asking for administrator credentials, so the PC is basically lost and the software could do anything.

There is a local initiative called "elderly people in the Internet" and I'd like to enable the trainer (an elderly person himself) to demonstrate the participants what could happen in such a case (live demo).

So I am now looking for an open source (!) software that

• installs with a yellow UAC warning (unsigned)
• is not visible in the list of installed programs
• may be visible in the Task Manager process list and may be killed from there
• is able to uninstall completely
• runs from Windows 7 through Windows 10

Scare features:

• expose the file system to a defined remote host (list files, show content is not required)
• provides a key logger (may be limited)
• opens a remote desktop / VNC connection (view only)

The trainer will only use it in the classroom and will ensure that everybody uninstalls it when the class is over. But anyway, I'd appreciate if the software comes with some security considerations, e.g.

• software works only if the PC has a IP address of a specific subnet (e.g. 192.168.217.0/24) and was applied via DHCP
• software works only for a maximum of 4 hours and then uninstalls itself

Cost: ~50 €/ 60 USD are ok. Should be a perpetual license and required for the trainer only.

Answer 1

I think you can get most of the way to what you want by customizing the UltraVNC Single Click program: http://www.uvnc.com/docs/uvnc-sc/76-how-to-setup-and-configure-a-custom-ultravnc-sc.html

• Runs without being listed in installed programs
• Shows up in process list
• Can be easily uninstalled
• Open source
• Runs from Win7 - Win10 (I believe)

Creating an unsigned executable might be harder, but I think this should be possible.

You can configure the UltraVNC SC installer to connect over the Internet to a central server (which your presenter will have to set up) and then have the presenter connect to the same server. This will broker a connection between the two.

Once the victim has connected then they have VNC for free, which means that showing the file system is trivial, and the presenter can threaten to delete files or whatnot. It won't come with a keylogger built in, but with a VNC connection the presenter could then download and install other software.

You could lock down the server to which the victims connect, but I do not know how to restrict connections from the client computer.

Given that many of the scam artists are using TeamViewer as their primary means of access anyways, I think this could be an effective solution (although it does make VNC look bad).