PowerShell: Detect files infected/encrypted by virus

So the other day we got hit by a virus at work – well actually it was the 2nd time in four months we got hit by this particular type of virus.

The virus arrived in the form of an email with an attached ZIP file. The mail itself claimed to be a Fax Report and the ZIP file contained an SCR file. The virus was not detected by our virus scanners, nor by our mail scanning … and unfortunately the SCR file was opened by one of our users.

The virus was one of those CryptoWall/RansomWare type vira that starts encrypting files on the fileshares and place DECRYPT_INSTRUCTION txt and html files in the folders, explaining how you can buy a decrypt tool to get your files back. Needless to say we did not go down that route.

By looking at the ownership of one of the encrypted files we found the user who had set the virus free, and where able to stop it from encrypting further files. But now the problem remained to determine the encrypted files.

Fortunately all encrypted files from one invokation of the virus share the same header, so with a couple of samples it is possible to determine a header to check for. But how do you get a HexHeader from a file? PowerShell to the rescue (once again).

function Get-FileHexHeader
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$True,
        ValueFromPipeline=$True,
        ValueFromPipelineByPropertyName=$True,
        HelpMessage='FileInfo object you want to get header from')]
        [System.IO.FileInfo[]]$Files,
        [Parameter(HelpMessage='Number of bytes to read from file')]
        [int]$Bytes=10
    )
    Begin {}
    Process {
        $Files | ForEach-Object {
            if ($HeaderHexString) { Remove-Variable HeaderHexString }
            Get-Content -Path $_.FullName -TotalCount $Bytes -Encoding Byte -ErrorAction SilentlyContinue | %{
                if ( ( '{0:X}' -f $_ ).Length -eq 1 ) {
                    $HeaderHexString += '0{0:X}' -f $_
                }
                else {
                    $HeaderHexString += '{0:X}' -f $_
                }
            }
            $HeaderHexString
        }
    }
    End {}
}

With the above function you can do things such as …

Get-ChildItem <FilePath> | Get-FileHexHeader

… which will show the HexHeader of files within a path. You can adjust the amount of bytes you want to read from each file – it defaults to 10 bytes. The first time we got hit by this virus we found the first 13 bytes to be identical on all infected files. This time round it was the first 16 bytes.

Lets say you find that “FEDE700C7B7623130001000000” is the header of all infected/encrypted files. That would allow you to check for infected files like this …

Get-ChildItem <FilePath> -Recurse | Where { ($_ | Get-FileHexHeader -Bytes 13) -eq 'FEDE700C7B7623130001000000' }

… or if you have more than one header to check for (perhaps several users opened an attachment) you could check for it like this (just ensure all headers are the same lenght)

$Signatures = @(
    '23545950452053797374656D2E',
    '504B03040A0000000000A56433',
    'FEDE700C7B7623130001000000'
)
Get-ChildItem <FilePath> -Recurse | Where { $Signatures -contains ($_ | Get-FileHexHeader -Bytes 13) }

Now while this does not recover your files it will help you identify the files you need to restore from backup.

Should you find a way to actually recover your files please post it in the comments