CODEWITHSUNDEEP
powershell
gzgodz
gzgodz

Reputation: 7

Getting a specific process id from a powershell output

Hi I'm new to powershell scripting and I would like to retrieve a specific process id based on the file's hash. However I can only get either a table with the hash value or a table with the id,process name and path

$ps = Get-Process | Select-Object -Property Id,ProcessName,Path

$hashlist = Get-FileHash(Get-Process|Select-Object -ExpandProperty Path) -Algorithm MD5

Is it possible for me to merge the two tables together so that I can get a view of Id,ProcessName and Hash using the path to link them together?

Upvotes: 0

Views: 2007

Answers (1)

user6811411
user6811411

Reputation:

EDIT: totally different approach due to new information from comment

I don't think it is so easy to identify malware with a file MD5 hash. Modern AntiVirusSoftware uses heuristics to overcome the problem of mean malware which includes random data and also obfuscates it's origin.

## Q:\Test\2018\11\11\SO_53247430.ps1

# random hex string replace with your malware signature
$MalwareMD5Hash = 'D52C11B7E076FCE593288439ABA0F6D4' 

Get-Process | Where-Object Path | Select-Object ID,Path | Group-Object Path | ForEach-Object {
   if ($MalwareMD5Hash -eq (Get-FileHash $_.Name -Alg MD5).Hash){ 
       ##iterate group to kill all processes matching
       ForEach ($PID in $_.Group.ID){
         Stop-Process -ID $PID -Force -WhatIF
       }
   }
   $_.Name | Remove-Item -Force -WhatIf # to delete the physical file.
}

As I suggested in my comment:

$HashList = [ordered]@{}
Get-Process |Where-Object Path | Select-Object Path |Sort-Object Path -Unique | ForEach-Object {
  $HashList[$_.Path]=(Get-FileHash $_.Path -Alg MD5).Hash
  ## or the reverse, the hash as key and the path as value
  # $HashList[(Get-FileHash $_.Path -Alg MD5).Hash]=$_.Path
}
$Hashlist | Format-List

Shorted sample output

Name  : C:\Program Files\Mozilla Firefox\firefox.exe
Value : BFE829AB5A4B729EE4565700FC8853DA

Name  : C:\WINDOWS\Explorer.EXE
Value : E4A81EDDFF8B844D85C8B45354E4144E

Name  : C:\WINDOWS\system32\conhost.exe
Value : EA777DEEA782E8B4D7C7C33BBF8A4496

Name  : C:\WINDOWS\system32\DllHost.exe
Value : 2528137C6745C4EADD87817A1909677E

> $hashlist['C:\WINDOWS\Explorer.EXE']
E4A81EDDFF8B844D85C8B45354E4144E

Or with the reversed list

> $hashlist['E4A81EDDFF8B844D85C8B45354E4144E']
C:\WINDOWS\Explorer.EXE

Upvotes: 1

Related Questions