investigating-ransomware-attack-artifacts

name	investigating-ransomware-attack-artifacts
description	Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.
domain	cybersecurity
subdomain	digital-forensics
tags	["forensics","ransomware","malware-analysis","incident-response","encryption-recovery","evidence-collection"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.AN-03","DE.AE-02","RS.MA-01"]
mitre_attack	["T1005","T1074","T1119","T1070","T1486"]
mitre_f3	{"version":"1.1","tactics":["initial-access","stealth","monetization"],"techniques":[{"id":"T1110","name":"Brute Force","tactic":"initial-access","source":"attack"},{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"},{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"}]}

Investigating Ransomware Attack Artifacts

When to Use

• Immediately after discovering ransomware encryption on systems
• When performing forensic analysis to understand the full scope of a ransomware incident
• For identifying the ransomware variant and determining if decryption is possible
• When tracing the attack chain from initial access to encryption
• For documenting evidence to support law enforcement and insurance claims

Prerequisites

• Forensic images of affected systems (preserve before remediation)
• Memory dumps captured before system shutdown (if available)
• Ransom notes and encrypted file samples
• Network traffic captures from the attack period
• Windows Event Logs, Prefetch files, and registry hives
• Access to ransomware identification tools (ID Ransomware, No More Ransom)
• Isolated sandbox environment for malware analysis

Workflow

Step 1: Preserve Evidence and Identify the Ransomware Variant

# CRITICAL: Do NOT restart systems. Preserve memory first if possible.
# Encryption keys may still be in memory.

# Capture memory from running systems
# Windows: DumpIt.exe (generates memory.raw)
# Linux: sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

# Collect ransom note
cp /mnt/evidence/Users/*/Desktop/README*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/DECRYPT*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/HOW_TO*.txt /cases/case-2024-001/ransomware/ransom_notes/
find /mnt/evidence/ -name "*.hta" -o -name "*DECRYPT*" -o -name "*RANSOM*" -o -name "*README*" \
   2>/dev/null | head -20 > /cases/case-2024-001/ransomware/note_locations.txt

# Collect sample encrypted files (for identification)
find /mnt/evidence/Users/ -name "*.encrypted" -o -name "*.locked" -o -name "*.crypted" \
   -o -name "*.crypt" -o -name "*.enc" |  -10 > /cases/case-2024-001/ransomware/encrypted_samples.txt


 -p /cases/case-2024-001/ransomware/samples/
 -5 /cases/case-2024-001/ransomware/encrypted_samples.txt |   f; 
      /cases/case-2024-001/ransomware/samples/



python3 << 
import os, hashlib, json

ransomware_indicators = {
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
    : ,
}


samples_dir = 
 f  os.listdir(samples_dir):
    ext = os.path.splitext(f)[1].lower()
    variant = ransomware_indicators.get(ext, )
    sha256 = hashlib.sha256(open(os.path.join(samples_dir, f), ).()).hexdigest()
    (f)
    (f)
    (f)
    (f)
    ()


note_dir = 
 note  os.listdir(note_dir):
    with open(os.path.join(note_dir, note), , errors=) as f:
        content = f.read()
        (f)
        
        import re
        btc = re.findall(r, content)
        tor = re.findall(r, content)
        emails = re.findall(r, content)

         btc: (f)
         tor: (f)
         emails: (f)
PYEOF