#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Files renamed with an unfamiliar extension and a ransom note
    Fix   : Assess what is recoverable before touching anything
    Source: https://jbtecwiz.com/support/win-sec-ransomware

    Run as     : A clean machine
    Expect     : 2-8 hours
    Risk       : high
    Reversible : NO -- read the undo note below before running

    WHEN THIS IS THE RIGHT FIX
    Encryption has finished. Resist the urge to start deleting and
    reinstalling.

    HOW TO UNDO IT
    Not applicable. Keep the forensic copies until the incident is formally
    closed.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 6"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Files renamed with an unfamiliar extension and a ransom note' -ForegroundColor White
Write-Host '  Assess what is recoverable before touching anything' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: high   NOT REVERSIBLE   2-8 hours' -ForegroundColor Yellow
Write-Host ''
Show-Prose 'Undo: Not applicable. Keep the forensic copies until the incident is formally closed.' 'Yellow'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Preserve a copy of the ransom note and a sample encrypted file. Identification services can sometimes name the family, and a few have public decryptors.' -Manual

Invoke-Step -Number 2 -Do 'Check whether shadow copies survived -- most families delete them, but not all succeed.' -Command {
    vssadmin list shadows
    Get-CimInstance Win32_ShadowCopy | Format-Table InstallDate,VolumeName,DeviceObject
}

Invoke-Step -Number 3 -Do 'Check the backups from a machine that was never connected to the affected network, and verify a restore actually works before wiping anything.' -Manual

Invoke-Step -Number 4 -Do 'Assume credentials are compromised. Every account that had access to the affected machines needs its password reset, and the domain KRBTGT account should be reset twice with the recommended interval between.' -Manual

Invoke-Step -Number 5 -Do 'Rebuild affected machines from clean media rather than cleaning them. A machine that has been encrypted was fully compromised first, and removing the payload does not remove the access that delivered it.' -Why 'This is the part that gets skipped under time pressure, and it is why so many organisations are hit a second time within weeks by the same intruder using the same access.' -Manual

Invoke-Step -Number 6 -Do 'In the UK, report it to Action Fraud and, if personal data is involved, consider the ICO notification requirement -- 72 hours from becoming aware.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'Restored data opens correctly, rebuilt machines are on clean media, and credentials have been rotated.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-sec-ransomware' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Not applicable. Keep the forensic copies until the incident is formally closed.' 'DarkGray'
Write-Rule