Detect Crypto-X (Ransomware)

Checks various registry entries for indicators of a Crypto infection. Also, generates a “honeypot” document, If the document becomes encrypted the script will alarm as well.. Able to report with $CryptoAudit$, $CryptoYES$.
Acknowledgments: Many thanks to MarcR, MattK from Kaseya Community for inspiration as posted on http://community.kaseya.com/resources/m/knowexch/86518.aspx#pi5230=2
This script is provided “AS-IS”. Please make sure that you test this script in a controlled environment before deploying to a production environment. Please let us know if you run into any problems.
This script is considered derivative work and is free to download.
<?xml version="1.0" encoding="utf-8"?>
<ScExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="Detect CryptoLocker" treePres="3" id="1203517767" folderId="439644914092333" treeFullPath="_VA Scripts.Malware.Ransomware">
    <Body description="Script Name: Detetct Cryptolocker&#xA;Script Desc: Checks various registry entries for indicators of a Crypto infection. Also, generates a &quot;honeypot&quot; document, If the document becomes encrypted the script will alarm as well.. Able to report with $CryptoAudit$, $CryptoYES$.&#xA;Date: 11/17/2014&#xA;Company: VirtualAdministrator&#xA;Author: Kyle&#xA;Acknowledgments: Many thanks to MarcR, MattK from Kaseya Community for inspiration as posted on http://community.kaseya.com/resources/m/knowexch/86518.aspx#pi5230=2&#xA;&#xA;This script is supplied &quot;AS-IS&quot;">
      <If description="">
        <Condition name="UserIsLoggedIn">
          <Parameter xsi:type="StringParameter" name="UserName" value="" />
        </Condition>
        <Then>
          <Statement name="GetVariable" continueOnFail="false">
            <Parameter xsi:type="EnumParameter" name="VariableType" value="ConstantValue" />
            <Parameter xsi:type="StringParameter" name="SourceContent" value="youremail@yourdomain.com" />
            <Parameter xsi:type="StringParameter" name="VariableName" value="AdminEmail" />
          </Statement>
          <If description="Check for CryptoLocker_0388 Registry key">
            <Condition name="TestRegistryKey">
              <Parameter xsi:type="StringParameter" name="Path" value="HKEY_CURRENT_USER\Software\CryptoLocker_0388" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="System is infected with CryptoLocker  $CryptoYES$ $CryptoAudit$" />
              </Statement>
              <Statement description="Export Encrypted Files List, Upload to KServer (Agent Procedures &gt; File Transfer &gt; Get File)" name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="regedit.exe /e c:\temp\CryptolockerEncryptedFiles_0388.reg HKEY_CURRENT_USER\Software\CryptoLocker_0388\Files" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
              </Statement>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="C:\Temp\CryptoLockerEncryptedFiles_0388.reg" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="CryptoLocker\CryptoLockerEncryptedFiles_0388.reg" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement description="Log Detection in System Log, Unmap All Network Drives" name="Create Event Log Entry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="Cryptolocker_0388 Detected.  Network Drives Unmapped." />
                <Parameter xsi:type="EnumParameter" name="Parameter2" value="Error" />
                <Parameter xsi:type="EnumParameter" name="Parameter3" value="System" />
              </Statement>
              <Statement name="SendEmail" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="To" value="#AdminEmail#" />
                <Parameter xsi:type="StringParameter" name="Subject" value="Cryptolocker_0388 infection - #vAgentConfiguration.Machine_GroupID#" />
                <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#vAgentConfiguration.Machine_GroupID# is infected with Cryptolocker.  Network Drives have been un-mapped  Please contact the POC to resolve.&#xA;&#xA;Agent Procedure - &quot;Detect Cryptolocker&quot;" />
              </Statement>
            </Then>
          </If>
          <If description="Check for CryptoLocker Registry key">
            <Condition name="TestRegistryKey">
              <Parameter xsi:type="StringParameter" name="Path" value="HKEY_CURRENT_USER\Software\CryptoLocker" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="System is infected with CryptoLocker $CryptoYES$ $CryptoAudit$" />
              </Statement>
              <Statement description="Export Encrypted Files List, Upload to KServer (Agent Procedures &gt; File Transfer &gt; Get File)" name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="regedit.exe /e c:\temp\CryptolockerEncryptedFiles.reg HKEY_CURRENT_USER\Software\CryptoLocker\Files" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
              </Statement>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="C:\Temp\CryptoLockerEncryptedFiles.reg" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="CryptoLocker\CryptoLockerEncryptedFiles.reg" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteSendAlert" />
              </Statement>
              <Statement description="Log Detection in System Log, Unmap All Network Drives" name="Create Event Log Entry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="Cryptolocker Detected.  Network Drives Unmapped." />
                <Parameter xsi:type="EnumParameter" name="Parameter2" value="Error" />
                <Parameter xsi:type="EnumParameter" name="Parameter3" value="System" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="net use * /d /Y" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
              </Statement>
              <Statement name="SendEmail" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="To" value="#AdminEmail#" />
                <Parameter xsi:type="StringParameter" name="Subject" value="Cryptolocker infection - #vAgentConfiguration.Machine_GroupID#" />
                <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#vAgentConfiguration.Machine_GroupID# is infected with Cryptolocker.  Network drives have been unmapped.  Please contact the POC to resolve.&#xA;&#xA;Agent Procedure - &quot;Detect Cryptolocker&quot;" />
              </Statement>
            </Then>
          </If>
          <Statement description="Check for CryptoWall file" name="GetURL" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="URL" value="http://mymsp.com/va/files/downloads/Kyle/VBS/cryptocheck.vbs" />
            <Parameter xsi:type="StringParameter" name="ResponseFileName" value="#vAgentconfiguration.AgentTempDir#\script.vbs" />
            <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="Command" value="cscript.exe /nologo #vAgentconfiguration.AgentTempDir#\script.vbs &gt;&gt; #vAgentconfiguration.AgentTempDir#\scriptlog.txt" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="GetVariable" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
            <Parameter xsi:type="StringParameter" name="SourceContent" value="#vAgentconfiguration.AgentTempDir#\scriptlog.txt" />
            <Parameter xsi:type="StringParameter" name="VariableName" value="scriptLog" />
          </Statement>
          <If description="">
            <Condition name="CheckVariable">
              <Parameter xsi:type="StringParameter" name="VariableName" value="#scriptLog#" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="BeginsWith" />
              <Parameter xsi:type="StringParameter" name="Value" value="Detected" />
            </Condition>
            <Then>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="System is infected with CryptoWall $CryptoYES$ $CryptoAudit$" />
              </Statement>
              <Statement description="Log Detection in System Log, Unmap All Network Drives" name="Create Event Log Entry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="CryptoWall Detected.  Network Drives Unmapped." />
                <Parameter xsi:type="EnumParameter" name="Parameter2" value="Error" />
                <Parameter xsi:type="EnumParameter" name="Parameter3" value="System" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="net use * /d /Y" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
              </Statement>
              <Statement name="SendEmail" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="To" value="#AdminEmail#" />
                <Parameter xsi:type="StringParameter" name="Subject" value="CryptoWall infection - #vAgentConfiguration.Machine_GroupID#" />
                <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#vAgentConfiguration.Machine_GroupID# is infected with CryptoWall.  Network drives have been unmapped.  Please contact the POC to resolve.&#xA;&#xA;Agent Procedure - &quot;Detect Cryptolocker&quot;" />
              </Statement>
            </Then>
          </If>
          <Statement description="check for Crypto using a Honeypot&#xD;&#xA;check registry for location of documents directory" name="GetVariable" continueOnFail="true">
            <Parameter xsi:type="EnumParameter" name="VariableType" value="RegistryValue" />
            <Parameter xsi:type="StringParameter" name="SourceContent" value="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal" />
            <Parameter xsi:type="StringParameter" name="VariableName" value="Global:personal" />
          </Statement>
          <If description="Test to see if HoneyPot file is there">
            <Condition name="CheckVariable">
              <Parameter xsi:type="StringParameter" name="VariableName" value="#Global:personal#" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="X" />
            </Condition>
            <Then>
              <If description="">
                <Condition name="TestFile">
                  <Parameter xsi:type="StringParameter" name="Path" value="#Global:personal#\Cryptonite.doc" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="NotExists" />
                  <Parameter xsi:type="StringParameter" name="Value" value="" />
                </Condition>
                <Then>
                  <Statement description="File not found, so create HoneyPot file." name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
                    <Parameter xsi:type="StringParameter" name="Command" value="echo &quot;Please do not delete this file.  It is here as a honeypot to monitor if you are infected with any Ransomware malware.  Contact your IT Company if you have any questions&quot; &gt;&gt; #Global:personal#\Cryptonite.doc" />
                    <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                    <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="No honeypot file was found. Generating a new honeypot file. $CryptoAudit" />
                  </Statement>
                </Then>
                <Else>
                  <Statement description="File found, grabbing content" name="GetVariable" continueOnFail="false" osType="Windows">
                    <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
                    <Parameter xsi:type="StringParameter" name="SourceContent" value="#Global:personal#\Cryptonite.doc" />
                    <Parameter xsi:type="StringParameter" name="VariableName" value="Global:honeypotVAR" />
                  </Statement>
                  <If description="Check content to see if it has been encrypted">
                    <Condition name="CheckVariable">
                      <Parameter xsi:type="StringParameter" name="VariableName" value="#Global:honeypotVAR#" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="DoesNotContain" />
                      <Parameter xsi:type="StringParameter" name="Value" value="honeypot" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="System is infected with CryptoX (Ransomware) $CryptoYES$ $CryptoAudit$" />
                      </Statement>
                      <Statement description="Log Detection in System Log, Unmap All Network Drives" name="Create Event Log Entry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Parameter1" value="Honeypot file found. CryptoX Detected.  Network Drives Unmapped." />
                        <Parameter xsi:type="EnumParameter" name="Parameter2" value="Error" />
                        <Parameter xsi:type="EnumParameter" name="Parameter3" value="System" />
                      </Statement>
                      <Statement name="ExecuteShellCommand" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Command" value="net use * /d /Y" />
                        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
                      </Statement>
                      <Statement name="SendEmail" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="To" value="#AdminEmail#" />
                        <Parameter xsi:type="StringParameter" name="Subject" value="CryptoX (Ransomware) infection on - #vAgentConfiguration.Machine_GroupID#" />
                        <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#vAgentConfiguration.Machine_GroupID# is infected with CryptoX (Ransomware).  HoneyPot failure.   Network drives have been unmapped.  Please contact the POC to resolve.&#xA;&#xA;Agent Procedure - &quot;Detect Cryptolocker&quot;" />
                      </Statement>
                    </Then>
                  </If>
                </Else>
              </If>
            </Then>
            <Else>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="Cannot open registry location. System could be infected with CryptoX (Ransomware) $CryptoYES$ $CryptoAudit$" />
              </Statement>
              <Statement description="Log Detection in System Log, Unmap All Network Drives" name="Create Event Log Entry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Parameter1" value="Cannot access personal registry location. CryptoX Detected.  Network Drives Unmapped." />
                <Parameter xsi:type="EnumParameter" name="Parameter2" value="Error" />
                <Parameter xsi:type="EnumParameter" name="Parameter3" value="System" />
              </Statement>
              <Statement name="ExecuteShellCommand" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Command" value="net use * /d /Y" />
                <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="User" />
                <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
              </Statement>
              <Statement name="SendEmail" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="To" value="#AdminEmail#" />
                <Parameter xsi:type="StringParameter" name="Subject" value="CryptoX (Ransomware) possible infection on - #vAgentConfiguration.Machine_GroupID#" />
                <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#vAgentConfiguration.Machine_GroupID# is infected with CryptoX (Ransomware).  Registry key missing.   Network drives have been unmapped.  Please contact the POC to resolve.&#xA;&#xA;Agent Procedure - &quot;Detect Cryptolocker&quot;" />
              </Statement>
            </Else>
          </If>
        </Then>
        <Else>
          <Statement description="Reschedule Detect Crypto for 60 min - No user logged in" name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Detect CryptoX - User must be logged in to test - Rescheduling to run again in 60 Min" />
          </Statement>
          <Statement name="ExecuteScript" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="ScriptID" value="286935087" />
            <Parameter xsi:type="StringParameter" name="ScriptName" value="Detect CyrptoLocker" />
            <Parameter xsi:type="StringParameter" name="TimeDelay" value="60" />
            <Parameter xsi:type="EnumParameter" name="TimeUnit" value="Minutes" />
          </Statement>
        </Else>
      </If>
    </Body>
  </Procedure>
</ScExport>
Detect Crypto-X (Ransomware)

How to Download Scripts

Login Here

Search

Get In Touch!

Additional Resources

About Us
