Investigating Ransomware Attack Artifacts

# CRITICAL: Do NOT restart systems. Preserve memory first if possible.
# Encryption keys may still be in memory.

# Capture memory from running systems
# Windows: DumpIt.exe (generates memory.raw)
# Linux: sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

# Collect ransom note
cp /mnt/evidence/Users/*/Desktop/README*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/DECRYPT*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/HOW_TO*.txt /cases/case-2024-001/ransomware/ransom_notes/
find /mnt/evidence/ -name "*.hta" -o -name "*DECRYPT*" -o -name "*RANSOM*" -o -name "*README*" \
   2>/dev/null | head -20 > /cases/case-2024-001/ransomware/note_locations.txt

# Collect sample encrypted files (for identification)
find /mnt/evidence/Users/ -name "*.encrypted" -o -name "*.locked" -o -name "*.crypted" \
   -o -name "*.crypt" -o -name "*.enc" | head -10 > /cases/case-2024-001/ransomware/encrypted_samples.txt

# Copy sample encrypted files
mkdir -p /cases/case-2024-001/ransomware/samples/
head -5 /cases/case-2024-001/ransomware/encrypted_samples.txt | while read f; do
    cp "$f" /cases/case-2024-001/ransomware/samples/
done

# Identify ransomware variant using file extension and ransom note
python3 << 'PYEOF'
import os, hashlib, json

ransomware_indicators = {
    '.lockbit': 'LockBit',
    '.blackcat': 'BlackCat/ALPHV',
    '.royal': 'Royal',
    '.akira': 'Akira',
    '.clop': 'Cl0p',
    '.conti': 'Conti',
    '.ryuk': 'Ryuk',
    '.revil': 'REvil/Sodinokibi',
    '.maze': 'Maze',
    '.phobos': 'Phobos',
    '.dharma': 'Dharma/CrySIS',
    '.stop': 'STOP/Djvu',
    '.hive': 'Hive',
    '.blackbasta': 'Black Basta',
    '.play': 'Play',
}

# Check encrypted file extensions
samples_dir = '/cases/case-2024-001/ransomware/samples/'
for f in os.listdir(samples_dir):
    ext = os.path.splitext(f)[1].lower()
    variant = ransomware_indicators.get(ext, 'Unknown')
    sha256 = hashlib.sha256(open(os.path.join(samples_dir, f), 'rb').read()).hexdigest()
    print(f"File: {f}")
    print(f"  Extension: {ext}")
    print(f"  Suspected Variant: {variant}")
    print(f"  SHA-256: {sha256}")
    print()

# Parse ransom note for IoCs
note_dir = '/cases/case-2024-001/ransomware/ransom_notes/'
for note in os.listdir(note_dir):
    with open(os.path.join(note_dir, note), 'r', errors='ignore') as f:
        content = f.read()
        print(f"\n=== Ransom Note: {note} ===")
        # Extract bitcoin addresses
        import re
        btc = re.findall(r'[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{25,39}', content)
        tor = re.findall(r'[a-z2-7]{56}\.onion', content)
        emails = re.findall(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}', content)

        if btc: print(f"  Bitcoin addresses: {btc}")
        if tor: print(f"  Tor addresses: {tor}")
        if emails: print(f"  Contact emails: {emails}")
PYEOF

# Find the earliest encrypted file (encryption start time)
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort | head -5 \
   > /cases/case-2024-001/ransomware/encryption_start.txt

# Find the latest encrypted file (encryption end time)
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort -r | head -5 \
   > /cases/case-2024-001/ransomware/encryption_end.txt

# Analyze Prefetch for ransomware executable
ls /mnt/evidence/Windows/Prefetch/ | grep -iE "(encrypt|ransom|lock|crypt)" \
   > /cases/case-2024-001/ransomware/prefetch_hits.txt

# Check Windows Event Logs for key events
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser

# Security log - authentication and access events
parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx")

attack_events = []
for record in parser.records_json():
    data = json.loads(record['data'])
    event_id = str(data['Event']['System']['EventID'])
    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']

    # Key events for ransomware investigation
    if event_id in ('4624', '4625', '4648', '4672', '4697', '4698', '4688', '1102'):
        event_data = data['Event'].get('EventData', {})
        attack_events.append({
            'time': timestamp,
            'event_id': event_id,
            'data': json.dumps(event_data, default=str)[:200]
        })

# Sort and display timeline
attack_events.sort(key=lambda x: x['time'])
print("=== RANSOMWARE ATTACK TIMELINE ===\n")
for event in attack_events[-50:]:
    print(f"  [{event['time']}] EventID {event['event_id']}: {event['data'][:150]}")
PYEOF

# Check for Volume Shadow Copy deletion (common ransomware behavior)
# Look for vssadmin.exe or wmic shadowcopy in event logs and Prefetch
grep -l "vssadmin" /cases/case-2024-001/evtx/*.evtx 2>/dev/null
ls /mnt/evidence/Windows/Prefetch/ | grep -i "vssadmin\|wmic\|bcdedit\|wbadmin"

# Check for common ransomware initial access vectors

# RDP brute force
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser
from collections import defaultdict

parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx")

failed_rdp = defaultdict(int)
successful_rdp = []

for record in parser.records_json():
    data = json.loads(record['data'])
    event_id = str(data['Event']['System']['EventID'])
    event_data = data['Event'].get('EventData', {})
    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']

    if event_id == '4625':  # Failed logon
        logon_type = str(event_data.get('LogonType', ''))
        if logon_type == '10':  # RDP
            source_ip = event_data.get('IpAddress', 'Unknown')
            failed_rdp[source_ip] += 1

    if event_id == '4624':  # Successful logon
        logon_type = str(event_data.get('LogonType', ''))
        if logon_type in ('10', '3'):  # RDP or Network
            source_ip = event_data.get('IpAddress', 'Unknown')
            username = event_data.get('TargetUserName', 'Unknown')
            successful_rdp.append({'time': timestamp, 'user': username, 'ip': source_ip, 'type': logon_type})

print("=== FAILED RDP ATTEMPTS ===")
for ip, count in sorted(failed_rdp.items(), key=lambda x: x[1], reverse=True)[:10]:
    print(f"  {ip}: {count} failed attempts")

print(f"\n=== SUCCESSFUL NETWORK/RDP LOGONS ===")
for logon in successful_rdp[-20:]:
    type_name = 'RDP' if logon['type'] == '10' else 'Network'
    print(f"  [{logon['time']}] {logon['user']} from {logon['ip']} ({type_name})")
PYEOF

# Check for phishing-related artifacts
# Browser downloads, email attachments, Office macros
find /mnt/evidence/Users/*/Downloads/ -name "*.exe" -o -name "*.dll" -o -name "*.js" \
   -o -name "*.vbs" -o -name "*.hta" -o -name "*.ps1" 2>/dev/null \
   > /cases/case-2024-001/ransomware/suspicious_downloads.txt

# Check PowerShell execution
ls /mnt/evidence/Windows/Prefetch/ | grep -i powershell

# Count encrypted files by directory
find /mnt/evidence/ -name "*.encrypted" 2>/dev/null | \
   awk -F/ '{OFS="/"; NF--; print}' | sort | uniq -c | sort -rn | head -20 \
   > /cases/case-2024-001/ransomware/encryption_scope.txt

# Check if Volume Shadow Copies survived
vssadmin list shadows 2>/dev/null > /cases/case-2024-001/ransomware/vss_status.txt

# Check for backup integrity
find /mnt/evidence/ -name "*.bak" -o -name "*.backup" 2>/dev/null | head -20

# Check No More Ransom project for available decryptors
# https://www.nomoreransom.org/en/decryption-tools.html
echo "Check https://www.nomoreransom.org/ for decryption tools" \
   > /cases/case-2024-001/ransomware/decryption_options.txt

# Attempt to recover encryption keys from memory dump
if [ -f /cases/case-2024-001/memory/memory.raw ]; then
    # Search for AES key schedules in memory
    vol -f /cases/case-2024-001/memory/memory.raw yarascan \
       --yara-rules 'rule AES_Key { strings: $aes = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 } condition: $aes }' \
       > /cases/case-2024-001/ransomware/aes_key_search.txt

    # Search for RSA key material
    vol -f /cases/case-2024-001/memory/memory.raw yarascan \
       --yara-rules 'rule RSA_Key { strings: $rsa = "RSA PRIVATE KEY" condition: $rsa }' \
       > /cases/case-2024-001/ransomware/rsa_key_search.txt
fi

# Generate comprehensive ransomware investigation report
cat << 'REPORT' > /cases/case-2024-001/ransomware/investigation_report.txt
RANSOMWARE INCIDENT INVESTIGATION REPORT
==========================================
Case Number: 2024-001
Date: $(date -u)
Analyst: [Examiner Name]

1. INCIDENT OVERVIEW
   - Ransomware Variant: [Identified variant]
   - First Encryption: [Timestamp from earliest encrypted file]
   - Last Encryption: [Timestamp from latest encrypted file]
   - Systems Affected: [Count]
   - Data Encrypted: [Volume estimate]

2. INITIAL ACCESS VECTOR
   - Method: [RDP brute force / Phishing / Exploit / etc.]
   - Entry Point: [System and IP]
   - Timestamp: [First unauthorized access]
   - Credentials Used: [Account names]

3. ATTACK CHAIN
   a. Initial Access: [Details]
   b. Execution: [Ransomware binary details]
   c. Persistence: [Services, scheduled tasks]
   d. Privilege Escalation: [Method used]
   e. Lateral Movement: [Systems accessed, methods]
   f. Collection/Staging: [Data staging before encryption]
   g. Impact: [Encryption execution]

4. INDICATORS OF COMPROMISE
   - Ransomware Binary SHA-256: [Hash]
   - C2 Servers: [IPs/Domains]
   - Bitcoin Wallet: [Address]
   - Tor Site: [.onion address]
   - Attacker IPs: [Source IPs]

5. RECOVERY ASSESSMENT
   - Decryptor Available: [Yes/No]
   - Shadow Copies: [Survived/Deleted]
   - Backups: [Status and integrity]
   - Memory Key Recovery: [Attempted/Results]

6. RECOMMENDATIONS
   - [Remediation steps]
   - [Prevention measures]
   - [Monitoring improvements]
REPORT