· 9 years ago · May 20, 2017, 12:42 PM
1# Ransomware Escalation Prevention Script
2# v1.0
3# Compatibility: Windows 10
4# Author: Martijn Kamminga
5# 499 Lines written by Martijn Kamminga
6# www.isee2it.nl
7# contact: martijn@isee2it.nl
8# You can modify this script, but do not alter commment sections.
9
10# Add variables for checking if D drive is present, if not skipping (causes duplicate code)
11# Advise: Use different folder path's (but keep them on top of the root e.g. most preferebaply C:\!Check, C:\.Check, C:\1.Check or C:\A.Check etc) and alter the contentfile value here and the file's to be checked
12# Tips are welcome if someone know's which files are touched first upon ransomware infection. My guess is the first folder/file in the root directory of non Windows System and Application Directory's. Which explains the C:\!Check folder advise.
13
14# Additional notes in case of compatabillity scripting required:
15
16# Working on Windows PowerShell 3.0 + versions
17# Disable-NetAdapter
18# New-Item -type File/Directory
19
20# Working on Windows PowerShell 5.0 + versions
21# Add-Content -NoNewLine (The -NoNewLine parameter is only available in powershell 5.0 +)
22
23##:checkransomware.vbs
24## (vbs call .bat will prevent powershell from popping up, interfering your work, loose focus on app.)
25##(call the bat file)
26## Begin code:
27# CreateObject("Wscript.Shell").Run "C:\Windows\checkransomware.bat", 0, True
28#
29## End code:
30## Add an extra line (blank) after above command in the .vbs file, or the wscript will stay in the process list
31## if executed every 5 minutes, per 5 minutes, there will be an addtional task causing to get out of memory exception for other applications.
32
33##:checkransomware.bat
34## Begin code: Call powershell in
35# PowerShell.exe -ExecutionPolicy Bypass -windowstyle hidden -File C:\Windows\checkransomware.ps1
36#
37## Again, add an extra (blank) line as stated above for no execption out of memory error.
38
39## After creating the powershell script:
40## Prep Script scheduled task 5 minute (builtin users, highest privilege, terminate task when it is not ending as requested)
41
42## Powershell file:
43##:checkransomware.ps1
44
45# BEGIN Configuration
46
47# Disconnect all networkshares
48$disconnectsessions = "yes"
49
50# Remove Drive Letter D/E in case of check file being altered?
51# Be carefull when you have applications like dropbox / google drive installed. It might wants to delete it from the cloud.
52$removedriveletterD = "no"
53$removedriveletterE = "no"
54
55#Shutdown ALL networkadapters in case of check file being altered?
56$disableallnetworkadapters = "yes"
57
58# System shutdown if ransomware have been detected?
59# Type "shutdown -a" in run or cmd to cancel
60$shutdownsystemiffileisaltered = "no"
61
62# Stop Dropbox for business if running (safety for not deleting cloud files and needing restore with Dropbox)
63$killdropbox = "yes"
64
65# Contact information
66$helpdesk = ""
67$ITDepartment = "Your IT Department (Martijn Kamminga)"
68$system = $env:computername
69$user = $env:username
70
71# Mail Settings
72# Above user $env:username must comply with the e-mailaddress prefix name of your domain in order to send mail.
73$usermail = "$user@domain.nl"
74$ITNotify = "@domain.nl"
75$fromemail = "@domain.nl"
76$Subject = "Ransomware Detected bij '$user': Bel Martijn Kamminga: "
77
78# Internal SMTP Server
79$internalsmtpserver = "yes"
80$server = "127.0.0.1" #enter your own SMTP server DNS name / IP address here
81
82# External SMTP Server Google Mail with App Password
83$externalsmtpserver = "no"
84# config
85$emailSmtpServer = "smtp.gmail.com"
86$emailSmtpServerPort = "587"
87$emailSmtpUser = "@domain.nl"
88# The pass can be an app password of google mail.
89$emailSmtpPass = ""
90$HTMLmessage = New-Object System.Net.Mail.MailMessage
91$HTMLmessage.From = "$emailSmtpUser"
92$HTMLmessage.To.Add( "$ITNotify" )
93$HTMLmessage.To.Add( "$usermail" )
94$HTMLmessage.Subject = "$Subject"
95$HTMLmessage.IsBodyHtml = "True"
96#$HTMLmessage.Priority = [System.Net.Mail.MailPriority]::Normal
97$HTMLmessage.Priority = [System.Net.Mail.MailPriority]::High
98#Powershell Send
99$SMTPClient = New-Object System.Net.Mail.SmtpClient( $emailSmtpServer , $emailSmtpServerPort )
100$SMTPClient.EnableSsl = $true
101$SMTPClient.Credentials = New-Object System.Net.NetworkCredential( $emailSmtpUser , $emailSmtpPass );
102
103# Alter these path's and content value for all three folders and files!
104$createosdir = "C:\!Check"
105$createuserdir = "C:\Users\$env:username\!Check"
106$createdatadir = "D:\!Check"
107$createfile = "ThisFileDetectsMalware.txt"
108$seperator = "\"
109$dataos = $createosdir + $seperator + $createfile
110$userdirectory = $createuserdir + $seperator + $createfile
111$datadrive = $createdatadir + $seperator + $createfile
112$createlogdir = ($env:allusersprofile + "\Logs\")
113$logfile = "AntiRansomwareDetectionSet.txt"
114$logpath = $createlogdir + $logfile
115$logcontent = "The Ransomware Detection is set by your System Administrator"
116# Adjust following value but keep the content the same in the files to be checked.
117$contentfile = "If This File is altered or deleted, your computer will shut down immediatly to prevent ransomware attacks!"
118
119# END CONFIGURATION
120
121# Do not alter below
122
123# Run Once Only
124If ((!(Test-Path $dataos)) -and (!(Test-Path $logpath))){
125 New-Item $createosdir -type Directory
126 New-Item $dataos -type File
127 Add-Content $dataos "$contentfile" -NoNewline
128}
129If ((!(Test-Path $userdirectory)) -and (!(Test-Path $logpath))) {
130 New-Item $createuserdir -type Directory
131 New-Item $userdirectory -type File
132 Add-Content $userdirectory "$contentfile" -NoNewline
133}
134If (!(Test-Path D:)) {
135 Write-Host skipping, no D drive
136}
137Else
138{
139 If ((!(Test-Path $datadrive)) -and (!(Test-Path $logpath)))
140 {
141 New-Item $createdatadir -type Directory
142 New-Item $datadrive -type File
143 Add-Content $datadrive "$contentfile" -NoNewline
144 }
145}
146If (!(Test-Path $logpath)) {
147 New-Item $createlogdir -type Directory
148 New-Item $logpath -type File
149 Add-Content $logpath "$logcontent" -NoNewline
150}
151# End Run Once Only
152
153$occured = date
154$textos = Get-Content $dataos -Raw
155$textuser = Get-Content $userdirectory -Raw
156$textdata = Get-Content $datadrive -Raw
157
158If ((Test-Path $dataos))
159{
160 # File Exists
161 Write-Host "File is present"
162 $FileOSExists = "Initial Run File OS Directory does Exists!"
163}
164
165If ((Test-Path $userdirectory))
166{
167 # File Exists
168 Write-Host "File is present"
169 $FileUserHomeExists = "Initial Run File User Home Directory does Exists!"
170}
171If ((Test-Path $datadrive))
172{
173 Write-Host "File is present"
174 $FileUserDataExists = "Initial Run File Data Drive Directory does Exists!"
175}
176
177If (!(Test-Path D:)) {
178 Write-Host "Data D Partition not present, skipping"
179
180 If ((!($textos -eq "$contentfile")) -or (!($textuser -eq "$contentfile")))
181 {
182 Write-Host "Ransomware Detected! Take Action NOW"
183$HTMLHeader = @"
184<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">
185<html><head><title>My Systems Report</title>
186<style type="text/css">
187<!--
188body {
189font-family: Verdana, Geneva, Arial, Helvetica, sans-serif;
190}
191
192 #report { width: 835px; }
193
194 table{
195 border-collapse: collapse;
196 border: none;
197 font: 10pt Verdana, Geneva, Arial, Helvetica, sans-serif;
198 color: black;
199 margin-bottom: 10px;
200}
201
202 table#important {
203 width: 100%;
204 color: red;
205 background-color: #f1f1c1;
206}
207
208 table td{
209 font-size: 12px;
210 padding-left: 0px;
211 padding-right: 20px;
212 text-align: left;
213}
214
215 table th {
216 font-size: 12px;
217 font-weight: bold;
218 padding-left: 0px;
219 padding-right: 20px;
220 text-align: left;
221}
222
223h2{ clear: both; font-size: 130%; }
224
225h3{
226 clear: both;
227 font-size: 115%;
228 margin-left: 20px;
229 margin-top: 30px;
230}
231
232p{ margin-left: 20px; font-size: 12px; }
233
234table.list{ float: left; }
235
236 table.list td:nth-child(1){
237 font-weight: bold;
238 border-right: 1px grey solid;
239 text-align: right;
240}
241
242table.list td:nth-child(2){ padding-left: 7px; }
243table tr:nth-child(even) td:nth-child(even){ background: #CCCCCC; }
244table tr:nth-child(odd) td:nth-child(odd){ background: #F2F2F2; }
245table tr:nth-child(even) td:nth-child(odd){ background: #DDDDDD; }
246table tr:nth-child(odd) td:nth-child(even){ background: #E5E5E5; }
247div.column { width: 320px; float: left; }
248div.first{ padding-right: 20px; border-right: 1px grey solid; }
249div.second{ margin-left: 30px; }
250table{ margin-left: 20px; }
251-->
252</style>
253</head>
254<body>
255
256"@
257
258if ($textos -eq "$contentfile") {$ransomwareosdir = "The OS Directory is safe."}
259if (!($textos -eq "$contentfile")) {$ransomwareosdir = "Ransomware is detected on OS Disk"}
260if ($textuser -eq "$contentfile") {$ransomwareuserdir = "The User Directory is safe."}
261if (!($textuser -eq "$contentfile")) {$ransomwareuserdir = "Ransomware is detected on User Directory"}
262if ($textdata -eq "$contentfile") {$ransomwaredatadir = "The Data Disk is safe."}
263if (!($textdata -eq "$contentfile")) {$ransomwaredatadir = "Ransomware is detected on Data Disk"}
264
265$RansomwareDetection = $RansomwareDetection | ConvertTo-Html -Fragment
266
267# Create HTML Report for the current System being looped through
268 $CurrentSystemHTML = @"
269 <hr noshade size=3 width="100%">
270 <div id="report">
271 <table id="important">
272 <p><h2>Bel Martijn Kamminga op: 0641459474 of 108 / 125<br>
273 Your system will shutdown within 1 minute</h2></p>
274 <p><h2>Ransomware alert on system: $system !</h2></p>
275 <h3>Possible Ransomware Detected! System: $system User: $user on Timestamp: $occured</h3>
276 </table>
277
278 <table class="normal">$RansomwareDetection</table>
279 <p>Ransomware could be active on your computer or either you have deleted an ICT Folder or altered it's content</p>
280 <br>
281 <p>$FileOSExists</p>
282 <p>$FileUserHomeExists</p>
283 <p>$FileUserDataExists</p>
284 <br>
285 <p>$user on $system reports $ransomwareosdir</p>
286 <p>$user on $system reports $ransomwareuserdir</p>
287 <p>$user on $system reports $ransomwaredatadir</p>
288 <br>
289 <p>Contact your system administrator immediatly!</p>
290 <br>
291 <p>Call $helpdesk for support and explain you have been infected or that you have made a mistake by deleting ICT Folders</p>
292 <br>
293 <br>
294 <p>Kind regards,</p>
295 <p>$ITDepartment</p>
296 </table>
297"@
298 # Add the current System HTML Report into the final HTML Report body
299 $HTMLMiddle += $CurrentSystemHTML
300
301# Assemble the closing HTML for our report.
302$HTMLEnd = @"
303</div>
304</body>
305</html>
306"@
307
308# Assemble the final report from all our HTML sections
309# Internal mailserver body e-mail format
310$HTMLmessageEmail = $HTMLHeader + $HTMLMiddle + $HTMLEnd
311
312# Email our report out via internal smtp server.
313If ($internalsmtpserver -eq "yes") {
314send-mailmessage -from $fromemail -to $usermail, $ITNotify -subject $Subject -BodyAsHTML -body $HTMLmessageEmail -priority High -smtpServer $server
315}
316If ($externalsmtpserver -eq "yes") {
317$HTMLmessage.Body = $HTMLmessage
318try{
319 $SMTPClient.Send($HTMLmessage)
320}
321catch{
322Write-Host "Failed to send E-Mail: $_" -ForegroundColor Red
323}
324}
325
326# Safety measures
327# Kill Dropbox for Business in case running
328If ($killdropbox -eq "yes") {
329Stop-Process -processname Dropbox
330}
331# Disconnect Networkshares
332If ($disconnectsessions -eq "yes") {
333net use * /delete /yes
334}
335# Disable all networkadapters when the check file is altered
336If ($disableallnetworkadapters -eq "yes") {
337Disable-NetAdapter -Name *
338}
339# Shutdown the system when the check file is altered
340If ($shutdownsystemiffileisaltered -eq "yes") {
341shutdown /f /s /t 60
342}
343}
344}
345else {
346If ((!($textos -eq "$contentfile")) -or (!($textuser -eq "$contentfile")) -or (!($textdata -eq "$contentfile")))
347 {
348 Write-Host "Ransomware Detected! Take Action NOW"
349$HTMLHeader = @"
350<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">
351<html><head><title>My Systems Report</title>
352<style type="text/css">
353<!--
354body {
355font-family: Verdana, Geneva, Arial, Helvetica, sans-serif;
356}
357
358 #report { width: 835px; }
359
360 table{
361 border-collapse: collapse;
362 border: none;
363 font: 10pt Verdana, Geneva, Arial, Helvetica, sans-serif;
364 color: black;
365 margin-bottom: 10px;
366}
367
368 table#important {
369 width: 100%;
370 color: red;
371 background-color: #f1f1c1;
372}
373
374 table td{
375 font-size: 12px;
376 padding-left: 0px;
377 padding-right: 20px;
378 text-align: left;
379}
380
381 table th {
382 font-size: 12px;
383 font-weight: bold;
384 padding-left: 0px;
385 padding-right: 20px;
386 text-align: left;
387}
388
389h2{ clear: both; font-size: 130%; }
390
391h3{
392 clear: both;
393 font-size: 115%;
394 margin-left: 20px;
395 margin-top: 30px;
396}
397
398p{ margin-left: 20px; font-size: 12px; }
399
400table.list{ float: left; }
401
402 table.list td:nth-child(1){
403 font-weight: bold;
404 border-right: 1px grey solid;
405 text-align: right;
406}
407
408table.list td:nth-child(2){ padding-left: 7px; }
409table tr:nth-child(even) td:nth-child(even){ background: #CCCCCC; }
410table tr:nth-child(odd) td:nth-child(odd){ background: #F2F2F2; }
411table tr:nth-child(even) td:nth-child(odd){ background: #DDDDDD; }
412table tr:nth-child(odd) td:nth-child(even){ background: #E5E5E5; }
413div.column { width: 320px; float: left; }
414div.first{ padding-right: 20px; border-right: 1px grey solid; }
415div.second{ margin-left: 30px; }
416table{ margin-left: 20px; }
417-->
418</style>
419</head>
420<body>
421
422"@
423
424if ($textos -eq "$contentfile") {$ransomwareosdir = "The OS Directory is safe."}
425if (!($textos -eq "$contentfile")) {$ransomwareosdir = "Ransomware is detected on OS Disk"}
426if ($textuser -eq "$contentfile") {$ransomwareuserdir = "The User Directory is safe."}
427if (!($textuser -eq "$contentfile")) {$ransomwareuserdir = "Ransomware is detected on User Directory"}
428if ($textdata -eq "$contentfile") {$ransomwaredatadir = "The Data Disk is safe."}
429if (!($textdata -eq "$contentfile")) {$ransomwaredatadir = "Ransomware is detected on Data Disk"}
430
431$RansomwareDetection = $RansomwareDetection | ConvertTo-Html -Fragment
432
433# Create HTML Report for the current System being looped through
434 $CurrentSystemHTML = @"
435 <hr noshade size=3 width="100%">
436 <div id="report">
437 <table id="important">
438 <p><h2>Bel Martijn Kamminga op: 0641459474 of 108 / 125<br>
439 Your system will shutdown within 1 minute</h2></p>
440 <p><h2>Ransomware alert on system: $system !</h2></p>
441 <h3>Possible Ransomware Detected! System: $system User: $user on Timestamp: $occured</h3>
442 </table>
443
444 <table class="normal">$RansomwareDetection</table>
445 <p>Ransomware could be active on your computer or either you have deleted an ICT Folder or altered it's content</p>
446 <br>
447 <p>$FileOSExists</p>
448 <p>$FileUserHomeExists</p>
449 <p>$FileUserDataExists</p>
450 <br>
451 <p>$user on $system reports $ransomwareosdir</p>
452 <p>$user on $system reports $ransomwareuserdir</p>
453 <p>$user on $system reports $ransomwaredatadir</p>
454 <br>
455 <p>Contact your system administrator immediatly!</p>
456 <br>
457 <p>Call $helpdesk for support and explain you have been infected or that you have made a mistake by deleting ICT Folders</p>
458 <br>
459 <br>
460 <p>Kind regards,</p>
461 <p>$ITDepartment</p>
462 </table>
463"@
464 # Add the current System HTML Report into the final HTML Report body
465 $HTMLMiddle += $CurrentSystemHTML
466
467# Assemble the closing HTML for our report.
468$HTMLEnd = @"
469</div>
470</body>
471</html>
472"@
473
474# Assemble the final report from all our HTML sections
475
476# Internal mailserver body e-mail format
477$HTMLmessageEmail = $HTMLHeader + $HTMLMiddle + $HTMLEnd
478# Gmail Application body e-mail format: powershell send mail variable
479$HTMLmessage.Body = $HTMLmessageEmail
480
481# Email our report out via internal smtp server.
482If ($internalsmtpserver -eq "yes") {
483send-mailmessage -from $fromemail -to $usermail, $ITNotify -subject $Subject -BodyAsHTML -body $HTMLmessageEmail -priority High -smtpServer $server
484}
485# Email our report out via external smtp server.
486
487If ($externalsmtpserver -eq "yes") {
488try{
489$SMTPClient.Send($HTMLmessage )
490}
491catch{
492Write-Host "Failed to send E-Mail: $_" -ForegroundColor Red
493}
494}
495# Safety measures
496# Kill Dropbox for Business in case running
497If ($killdropbox -eq "yes") {
498Stop-Process -processname Dropbox
499}
500# Disconnect Networkshares
501If ($disconnectsessions -eq "yes") {
502net use * /delete /yes
503}
504# Remove Driveletter D so files / backups cannot be altered.
505If (((Test-Path D:)) -and (($removedriveletterD -eq "yes")))
506{
507 Get-Volume -Drive D | Get-Partition | Remove-PartitionAccessPath -accesspath "D:\"
508}
509If (((Test-Path E:)) -and (($removedriveletterE -eq "yes")))
510{
511 Get-Volume -Drive E | Get-Partition | Remove-PartitionAccessPath -accesspath "E:\"
512}
513
514# Disable all networkadapters when the check file is altered
515If ($disableallnetworkadapters -eq "yes") {
516Disable-NetAdapter -Name *
517}
518# Shutdown the system when the check file is altered
519If ($shutdownsystemiffileisaltered -eq "yes") {
520shutdown /f /s /t 60
521}
522}
523}