kill_emotet.ps1

#Disable Admin Shares to prevent emotet's spread, uncomment to enable
#REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /V "AutoShareWks" /T "REG_DWORD" /D "0" /F | Out-Null #No Admin Shares
#restart-service Lanmanserver -Force
# Set Virustotal variable to true to check virustotal, on large engagements disable this as virustotal limits api per ip.
$virustotal = "false"
#Detect numeric services used in recent emotet compaigns
$emotetservices = Get-Service "[0-9][0-9]*"
#Detect services created within Appdata and other suspicious locations, feel free to turn on, on your own risk, this is risky
#$otherservices = Get-WmiObject win32_service | Where {$_.PathName -match "windirect|syswow64" -and $_.PathName -notmatch"Defender|sysmon|SilkService|perfhost|Lenovo|dell|print" }
# Put emotet process paths in here, you can also add descriptions etc
#$emotetprocesses = get-process | Where {$_.Path -match "Appdata\windirect" -and $_.Path -notmatch"Defender|sysmon|SilkService|perfhost|adobe|flash|rpcnet" -and $_.Company -notmatch "Microsoft|Lenovo|Dell|Vmware|Windows" }
#Custom Identifiers and checks
$emo =  Get-ChildItem -Path "C:\windows\sysWOW64" *.exe -Recurse -Force -EA SilentlyContinue| Where-Object {$_.creationtime -ge (get-date).AddDays(-7) -and $_.VersionInfo.FileVersion -eq "1.0.0.1" -or $_.VersionInfo.FileVersion -contains "Trump" -or $_.VersionInfo.FileDescription -contains "Trump" -or $_.VersionInfo.FileVersion -eq "1, 0, 0, 1" } | Where-object {$_.Name -notlike 'Taskmgr.exe'}
$emo2 =  Get-ChildItem -Path C:\Users\*\AppData\Roaming\windirect\*.exe -Recurse -Force -EA SilentlyContinue

#Add Known Registry Names Here
$regmatches = @(
    'bcdboot' #emotet
)
#Add Malware MD5's Here
$md5matches = @(
    '005037d2093d135af59375ef0cbaeeb1', #emotet
	'35cf29fe15988d8e0796f8a5e5600f58', #emotet
    '4da6b0b7bc92a893dccf07ee90df3e47',
    '25d62950259e0ba8ad444217ec2d6e1f',
    'da6aa359a2d368470ecdfd5475e998b4',
    '4A066A36C03B5C85EFCF1AC216F1BB15',
    '0011E0A113E19C9F0E735F318D4B5D67',
	'FDBA94D56138A02E67824427F1E1BD2A',
	'9481E66C4D59DC44738601F9C6887602'
)
#Add Known Malware process names here
$processmatches = @(
    'emotet', #emotet
	'trickbot' #emotet
)

$description = @(
    'TODO' #emotet
)

$version = @(
    '1.0.0.1' #emotet
)
# Autoruns AutoKiller
if(!(Test-Path -Path "$env:Temp\autorunsc64.exe" )){
	Write-Host "[+] Autorunsc64 is missing, Downloading from Sysinternals..."
	Invoke-WebRequest -Uri "https://live.sysinternals.com/autorunsc64.exe" -OutFile $env:Temp\autorunsc64.exe
}
Write-Host "[+] Starting Autorun Malware Checks..."
.$env:Temp\autorunsc64.exe -accepteula -vt -h -a l -user * -nobanner -c > $env:Temp\autoruns.csv
$autoruns = Import-CSV $env:Temp\autoruns.csv
$badruns = $autoruns |Where {$_."Image Path" -in $processmatches -or $_.MD5 -in $md5matches}
foreach ($autorun in $badruns){
	$reg = $autorun."Entry Location"
	$entry = $autorun."Entry"
	$path = $autorun."Image Path"
	Write-Host "[+] Removing Registry Persistence Key: " $entry "within" $reg
	get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
	Remove-ItemProperty "registry::$reg" -Name "$entry" -Verbose -Force -Confirm:$false -ErrorAction SilentlyContinue
	#uncomment if you'd like to remove the file.
	Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
}
# Auto-Runs Auto Virustotal Killer
# Detection Threshold is set a 5 vt detections, be careful with this.
if($virustotal -eq "true" ){
	Write-Host "[+] Starting VirusTotal Autorun Checks..."
	.$env:Temp\autorunsc64.exe -accepteula -vt -h -a l -user * -nobanner -c > $env:Temp\autoruns.csv
	$autoruns = Import-CSV $env:Temp\autoruns.csv
	$vt = $autoruns | Where-object {$_."VT Detection" -notmatch '0\|' -and $_."VT Detection" -ne '' -and $_."VT Detection" -ne "Unknown" -and $_."VT Detection" -gt 5 }
	foreach ($autorun in $vt){
		$reg = $autorun."Entry Location"
		$entry = $autorun."Entry"
		$path = $autorun."Image Path"
		Write-Host "[+] Removing Registry Persistence Key: " $entry "within" $reg
		get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
		Remove-ItemProperty "registry::$reg" -Name "$entry" -Verbose -Force -Confirm:$false -ErrorAction SilentlyContinue
		#uncomment if you'd like to remove the file.
		#Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
	}
}

# Autorun Service VT check and Cleanup
# Detection Threshold is set a 7 vt detections, be careful with this.
if($virustotal -eq "true"){
	Write-Host "[+] Starting VirusTotal Service Checks..."
	.$env:Temp\autorunsc64.exe -accepteula -vt -h -a s -nobanner -c > $env:Temp\autoruns_services.csv
	$autoruns = Import-CSV $env:Temp\autoruns_services.csv
	$vt = $autoruns | Where-object {$_."VT Detection" -notmatch '0\|' -and $_."VT Detection" -ne '' -and $_."VT Detection" -ne "Unknown" -and $_."VT Detection" -gt 7 }
	foreach ($autorun in $vt){
		$entry = $autorun."Entry"
		$path = $autorun."Image Path"
		Write-Host "[+] Removing Services: " $entry "within" $reg
		get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
		Write-Host "[+] Stopping Malware Service:" $entry
		sc.exe stop $entry
		Write-Host "[+] Disabling Malware Service:" $entry
		#sc.exe delete $entry
		sc.exe disable $entry
		#Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
		Write-Host "[+] Completed VT Service Checks..."
	}
}	


# Autorun Service check and Cleanup
# Detection Threshold is set a 7 vt detections, be careful with this.
Write-Host "[+] Starting Service Checks..."
.$env:Temp\autorunsc64.exe -accepteula -h -a s -nobanner -c > $env:Temp\autoruns_services.csv
$autoruns = Import-CSV $env:Temp\autoruns_services.csv
$badruns = $autoruns |Where {$_."Image Path" -in $processmatches -or $_.MD5 -in $md5matches -or ($_.Version -in $version -and $_.Description -in $description)}
foreach ($autorun in $badruns){
	$entry = $autorun."Entry"
	$path = $autorun."Image Path"
	Write-Host "[+] Removing Services: " $entry "within" $reg
	get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Stopping Malware Service:" $entry
	sc.exe stop $entry
	Write-Host "[+] Disabling Malware Service:" $entry
	sc.exe delete $entry
	Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Completed VT Service Checks..."
}
# Autorun Scheduled Task check and Cleanup
# Add -vt to the autoruns command line arguements to run virus total checks, only on small engagements
Write-Host "[+] Starting Scheduled Task Checks..."
.$env:Temp\autorunsc64.exe -accepteula -h -a t -nobanner -c > $env:Temp\autoruns_tasks.csv
$autoruns = Import-CSV $env:Temp\autoruns_tasks.csv
$autoruntasks = $autoruns |Where {$_."Image Path" -in $processmatches -or $_.MD5 -in $md5matches}
# uncomment below and comment above to enable VT Checks
#$autoruntasks = $autoruns | Where-object {$_."VT Detection" -notmatch '0\|' -and $_."VT Detection" -ne '' -and $_."VT Detection" -ne "Unknown" -and $_."VT Detection" -gt 7 }
foreach ($autorun in $autoruntasks){
	$entry = $autorun."Entry"
	$path = $autorun."Image Path"
	Write-Host "[+] Stopping Malware Task:" $entry
	get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
	Stop-ScheduledTask -TaskName "$path"	
	Write-Host "[+] Removing Scheduled Task: " $entry "within" $reg
	Unregister-ScheduledTask -TaskName "$entry"
	Write-Host "[+] Removing Malware Executable:" $entry
	Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
}
Write-Host "[+] Completed Scheduled Task Checks..."

# Autorun VT Scheduled Task check and Cleanup
# Add -vt to the autoruns command line arguements to run virus total checks, only on small engagements
if($virustotal -eq "true" ){
	Write-Host "[+] Starting VirusTotal Scheduled Task Checks..."
	.$env:Temp\autorunsc64.exe -accepteula -h -vt -a t -nobanner -c > $env:Temp\autoruns_tasks.csv
	$autoruns = Import-CSV $env:Temp\autoruns_tasks.csv
	$autoruntasks = $autoruns | Where-object {$_."VT Detection" -notmatch '0\|' -and $_."VT Detection" -ne '' -and $_."VT Detection" -ne "Unknown" -and $_."VT Detection" -gt 5 }
	foreach ($autorun in $autoruntasks){
		$entry = $autorun."Entry"
		$path = $autorun."Image Path"
		Write-Host "[+] Stopping Malware Task:" $entry
		get-process |Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
		Stop-ScheduledTask -TaskName "$path"	
		Write-Host "[+] Removing Scheduled Task: " $entry
		Unregister-ScheduledTask -TaskName "$entry"
		Write-Host "[+] Removing Malware Executable:" $entry
		Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
		Write-Host "[+] Completed VT Scheduled Task Checks..."
	}
}
Write-Host "[+] Starting Emotet Services Checks..."
foreach($svc in $emotetservices) {
	Write-Host "[+] Stopping Emotet Service:" $svc.Name
	sc.exe stop $svc.Name
	Write-Host "[+] Deleting Emotet Service:" $svc.Name
	sc.exe delete $svc.Name
	Write-Host "[+] Deleting Service Executable:" $svc.PathName
	Remove-Item $svc.PathName -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
}
	
#foreach($svc in $otherservices) {
#	Write-Host "[+] Stopping Other Service:" $svc.Name
#	sc.exe stop $svc.Name
#	Write-Host "[+] Deleting Other Service:" $svc.Name
#	sc.exe delete $svc.Name
#	Write-Host "[+] Deleting Other Service Executable:" $svc.PathName
#	Remove-Item $svc.PathName -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
#}
Write-Host "[+] Starting Emotet Process Checks..."
#dangerous, disabled for now
#foreach($proc in $emotetprocesses) {
#	Write-Host "[+] Killing Process:" $proc.Name
#	Stop-Process -Name $proc.Name -Force -Verbose -ErrorAction SilentlyContinue
#	Write-Host "[+] Deleting Emotet Executable:" $svc.PathName
#	Remove-Item $proc.Path -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
#}
Write-Host "[+] Starting Emotet SysWow64 Checks..."
foreach($proc in $emo) {
	$path = $emo.FullName
	$svc = 	Get-WmiObject win32_service | Where {$_.PathName -eq "$path" }
	Write-Host "[+] Killing Process:"
	get-process | Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Deleting Emotet Executable:" $path
	Remove-Item $path -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Stopping Other Service:" $proc.Name
	sc.exe stop $svc.Name
	Write-Host "[+] Deleting Other Service:" $proc.Name
	sc.exe delete $svc.Name
}

Write-Host "[+] Starting Emotet User\Appdata Checks..."
foreach($proc in $emo2) {
	$path = $emo.FullName
	$svc = 	Get-WmiObject win32_service | Where {$_.PathName -eq "$path" }
	Write-Host "[+] Killing Process:"
	get-process | Where {$_.Path -eq "$path"} | Stop-Process -Force -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Deleting Emotet Executable:" $path
	Remove-Item "$path" -Force -Confirm:$false -Verbose -ErrorAction SilentlyContinue
	Write-Host "[+] Stopping Other Service:" $proc.Name
	sc.exe stop $svc.Name
	Write-Host "[+] Deleting Other Service:" $proc.Name
	sc.exe delete $svc.Name
}
Write-Host "[+] Starting Emotet Registry Hive Checks..."
$PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
$ProfileList = gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} | 
    Select  @{name="SID";expression={$_.PSChildName}}, 
            @{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}}, 
            @{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}}
 
$LoadedHives = gci Registry::HKEY_USERS | ? {$_.PSChildname -match $PatternSID} | Select @{name="SID";expression={$_.PSChildName}}
$UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select @{name="SID";expression={$_.InputObject}}, UserHive, Username

Foreach ($item in $ProfileList) {
    IF ($item.SID -in $UnloadedHives.SID) {
        reg load HKU\$($Item.SID) $($Item.UserHive) | Out-Null
    }
	Write-Host "[+] Searching Account Registry:"
    "{0}" -f $($item.Username) | Write-Output
	foreach ($v in $regmatches) {
		$value = (Get-item registry::HKEY_USERS\$($Item.SID)\software\microsoft\windows\currentversion\run).getvalue | ? { $_ -match $v }
		if ($value -ne $null) {
			Write-Output "[+] Found Emotet registry value: $value"
			Write-Output "[+] Removing Emotet registry value: $value"
			Remove-ItemProperty registry::HKEY_USERS\$($Item.SID)\Software\Microsoft\Windows\CurrentVersion\Run -Name $value -Verbose -Force -Confirm:$false
			Remove-ItemProperty registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run -Name $value -Verbose -Force -Confirm:$false
			}
		}
	}
    IF ($item.SID -in $UnloadedHives.SID) {
        [gc]::Collect()
        reg unload HKU\$($Item.SID) | Out-Null
    }