investigating-ransomware-attack-artifacts

# Investigating Ransomware Attack Artifacts ## When to Use - Immediately after discovering ransomware encryption on systems - When performing forensic analysis to understand the full scope of a ransomware incident - For identifying the ransomware variant and determining if decryption is possible - When tracing the attack chain from initial access to encryption - For documenting evidence to support law enforcement and insurance claims ## Prerequisites - Forensic images of affected systems (preserve before remediation) - Memory dumps captured before system shutdown (if available) - Ransom notes and encrypted file samples - Network traffic captures from the attack period - Windows Event Logs, Prefetch files, and registry hives - Access to ransomware identification tools (ID Ransomware, No More Ransom) - Isolated sandbox environment for malware analysis ## Workflow ### Step 1: Preserve Evidence and Identify the Ransomware Variant ```bash # CRITICAL: Do NOT restart systems. Preserve memory first if possible. # Encryption keys may still be in memory. # Capture memory from running systems # Windows: DumpIt.exe (generates memory.raw) # Linux: sudo insmod lime.ko "path=/evidence/memory.lime format=lime" # Collect ransom note cp /mnt/evidence/Users/*/Desktop/README*.txt /cases/case-2024-001/ransomware/ransom_notes/ cp /mnt/evidence/Users/*/Desktop/DECRYPT*.txt /cases/case-2024-001/ransomware/ransom_notes/ cp /mnt/evidence/Users/*/Desktop/HOW_TO*.txt /cases/case-2024-001/ransomwa...