diff --git a/Other/EmoCrash.ps1 b/Other/EmoCrash.ps1 new file mode 100644 index 00000000..1cf71287 --- /dev/null +++ b/Other/EmoCrash.ps1 @@ -0,0 +1,49 @@ +#TLP:GREEN - NOT FOR PUBLIC DISTRIBUTION, TOPIC IS NOT TO BE MENTIONED NOR PUBLISHED ABOUT IN ANY PUBLIC METHODS. +#Thanks to @cryptolaemus +https://twitter.com/Cryptolaemus1 and the various contributors of the Emotet Task Force/Working Group +#Emotet Innoculation Script [Quinnoculation] +# *** Must be run as Admin **** +# Purpose: Emotet V5 Loader generates a value in SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ that it uses as an infection marker. +# This value is set to the Victim's Volume Serial ID, and contains the dropped filename of V5's new filename generation algorithm. +# Emotet looks for this key at startup. If it doesn't exist, it recreates it. If it does exist, Emotet reads that key into a buffer after decrypting it. There are not proper protections in place for the buffer. +# This script overwrites that key with a new key that overflows the buffer, crashing the malware. It also generates an eventID. +# Authors: James Quinn, Binary Defense +# Grabs the VolumeSerialNumbers and sets a registry key in Explorer with type= REG_BINARY and a value too large for Emotet to handle, overwriting the destination buffer, +#Which crashes emotet. +#UPDATE 2021 DEC 16TH. LOWERED TO TLP:WHITE + +function GenerateData{ +[byte[]]$string +for ($i = 1;$i -lt 0x340;$i++){ +$hexNumber = $i % 10 + +$string += [byte[]]$hexNumber +} +$string += [byte[]](0x51,0x75,0x69,0x6e,0x6e,0x75,0x6e,0x69,0x7a,0x65,0x64) +return $string +} +if (([IntPtr]::Size) -eq 8){ +$Akey = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer" +$key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\" +} +else{ +$Akey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\" +$key = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\" + +} + +$volumeSerialNumbers = Get-WmiObject Win32_logicaldisk | select-object -ExpandProperty volumeserialnumber +foreach ($x in $volumeSerialNumbers){ + + + +Remove-ItemProperty -Path $AKey -Name $x +Remove-ItemProperty -Path $key -Name $x + +$data = GenerateData +# Write-Output $data +New-ItemProperty -Path $AKey -Name $x -Value ([byte[]]($data)) -PropertyType Binary +New-ItemProperty -Path $key -Name $x -Value ([byte[]]($data)) -PropertyType Binary + + +} \ No newline at end of file