investigating-ransomware-attack-artifacts

调查勒索软件攻击痕迹

何时使用

• 在系统上发现勒索软件加密后立即使用
• 在执行取证分析以了解勒索软件事件全貌时
• 用于识别勒索软件变种并确定是否可能解密
• 在追踪从初始访问到加密的攻击链时
• 用于记录证据以支持执法和保险索赔

前提条件

• 受影响系统的取证镜像（在修复前保留）
• 在系统关机前捕获的内存转储（如果可用）
• 勒索信和加密文件样本
• 攻击期间捕获的网络流量
• Windows 事件日志、Prefetch 文件和注册表配置单元
• 访问勒索软件识别工具（ID Ransomware、No More Ransom）
• 用于恶意软件分析的隔离沙箱环境

工作流

步骤 1：保存证据并识别勒索软件变种

# CRITICAL: Do NOT restart systems. Preserve memory first if possible.
# Encryption keys may still be in memory.

# Capture memory from running systems
# Windows: DumpIt.exe (generates memory.raw)
# Linux: sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

# Collect ransom note
cp /mnt/evidence/Users/*/Desktop/README*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/DECRYPT*.txt /cases/case-2024-001/ransomware/ransom_notes/
cp /mnt/evidence/Users/*/Desktop/HOW_TO*.txt /cases/case-2024-001/ransomware/ransom_notes/
find /mnt/evidence/ -name "*.hta" -o -name "*DECRYPT*" -o -name "*RANSOM*" -o -name "*README*" \
   2>/dev/null | head -20 > /cases/case-2024-001/ransomware/note_locations.txt

# Collect sample encrypted files (for identification)
find /mnt/evidence/Users/ -name "*.encrypted" -o -name "*.locked" -o -name "*.crypted" \
   -o -name "*.crypt" -o -name "*.enc" | head -10 > /cases/case-2024-001/ransomware/encrypted_samples.txt

# Copy sample encrypted files
mkdir -p /cases/case-2024-001/ransomware/samples/
head -5 /cases/case-2024-001/ransomware/encrypted_samples.txt | while read f; do
    cp "$f" /cases/case-2024-001/ransomware/samples/
done

# Identify ransomware variant using file extension and ransom note
python3 << 'PYEOF'
import os, hashlib, json

ransomware_indicators = {
    '.lockbit': 'LockBit',
    '.blackcat': 'BlackCat/ALPHV',
    '.royal': 'Royal',
    '.akira': 'Akira',
    '.clop': 'Cl0p',
    '.conti': 'Conti',
    '.ryuk': 'Ryuk',
    '.revil': 'REvil/Sodinokibi',
    '.maze': 'Maze',
    '.phobos': 'Phobos',
    '.dharma': 'Dharma/CrySIS',
    '.stop': 'STOP/Djvu',
    '.hive': 'Hive',
    '.blackbasta': 'Black Basta',
    '.play': 'Play',
}

# Check encrypted file extensions
samples_dir = '/cases/case-2024-001/ransomware/samples/'
for f in os.listdir(samples_dir):
    ext = os.path.splitext(f)[1].lower()
    variant = ransomware_indicators.get(ext, 'Unknown')
    sha256 = hashlib.sha256(open(os.path.join(samples_dir, f), 'rb').read()).hexdigest()
    print(f"File: {f}")
    print(f"  Extension: {ext}")
    print(f"  Suspected Variant: {variant}")
    print(f"  SHA-256: {sha256}")
    print()

# Parse ransom note for IoCs
note_dir = '/cases/case-2024-001/ransomware/ransom_notes/'
for note in os.listdir(note_dir):
    with open(os.path.join(note_dir, note), 'r', errors='ignore') as f:
        content = f.read()
        print(f"\n=== Ransom Note: {note} ===")
        # Extract bitcoin addresses
        import re
        btc = re.findall(r'[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{25,39}', content)
        tor = re.findall(r'[a-z2-7]{56}\.onion', content)
        emails = re.findall(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}', content)

        if btc: print(f"  Bitcoin addresses: {btc}")
        if tor: print(f"  Tor addresses: {tor}")
        if emails: print(f"  Contact emails: {emails}")
PYEOF

步骤 2：确定攻击时间线

# Find the earliest encrypted file (encryption start time)
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort | head -5 \
   > /cases/case-2024-001/ransomware/encryption_start.txt

# Find the latest encrypted file (encryption end time)
find /mnt/evidence/ -name "*.encrypted" -printf '%T+ %p\n' 2>/dev/null | sort -r | head -5 \
   > /cases/case-2024-001/ransomware/encryption_end.txt

# Analyze Prefetch for ransomware executable
ls /mnt/evidence/Windows/Prefetch/ | grep -iE "(encrypt|ransom|lock|crypt)" \
   > /cases/case-2024-001/ransomware/prefetch_hits.txt

# Check Windows Event Logs for key events
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser

# Security log - authentication and access events
parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx")

attack_events = []
for record in parser.records_json():
    data = json.loads(record['data'])
    event_id = str(data['Event']['System']['EventID'])
    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']

    # Key events for ransomware investigation
    if event_id in ('4624', '4625', '4648', '4672', '4697', '4698', '4688', '1102'):
        event_data = data['Event'].get('EventData', {})
        attack_events.append({
            'time': timestamp,
            'event_id': event_id,
            'data': json.dumps(event_data, default=str)[:200]
        })

# Sort and display timeline
attack_events.sort(key=lambda x: x['time'])
print("=== RANSOMWARE ATTACK TIMELINE ===\n")
for event in attack_events[-50:]:
    print(f"  [{event['time']}] EventID {event['event_id']}: {event['data'][:150]}")
PYEOF

# Check for Volume Shadow Copy deletion (common ransomware behavior)
# Look for vssadmin.exe or wmic shadowcopy in event logs and Prefetch
grep -l "vssadmin" /cases/case-2024-001/evtx/*.evtx 2>/dev/null
ls /mnt/evidence/Windows/Prefetch/ | grep -i "vssadmin\|wmic\|bcdedit\|wbadmin"

步骤 3：追踪初始访问和横向移动

# Check for common ransomware initial access vectors

# RDP brute force
python3 << 'PYEOF'
import json
from evtx import PyEvtxParser
from collections import defaultdict

parser = PyEvtxParser("/cases/case-2024-001/evtx/Security.evtx")

failed_rdp = defaultdict(int)
successful_rdp = []

for record in parser.records_json():
    data = json.loads(record['data'])
    event_id = str(data['Event']['System']['EventID'])
    event_data = data['Event'].get('EventData', {})
    timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']

    if event_id == '4625':  # Failed logon
        logon_type = str(event_data.get('LogonType', ''))
        if logon_type == '10':  # RDP
            source_ip = event_data.get('IpAddress', 'Unknown')
            failed_rdp[source_ip] += 1

    if event_id == '4624':  # Successful logon
        logon_type = str(event_data.get('LogonType', ''))
        if logon_type in ('10', '3'):  # RDP or Network
            source_ip = event_data.get('IpAddress', 'Unknown')
            username = event_data.get('TargetUserName', 'Unknown')
            successful_rdp.append({'time': timestamp, 'user': username, 'ip': source_ip, 'type': logon_type})

print("=== FAILED RDP ATTEMPTS ===")
for ip, count in sorted(failed_rdp.items(), key=lambda x: x[1], reverse=True)[:10]:
    print(f"  {ip}: {count} failed attempts")

print(f"\n=== SUCCESSFUL NETWORK/RDP LOGONS ===")
for logon in successful_rdp[-20:]:
    type_name = 'RDP' if logon['type'] == '10' else 'Network'
    print(f"  [{logon['time']}] {logon['user']} from {logon['ip']} ({type_name})")
PYEOF

# Check for phishing-related artifacts
# Browser downloads, email attachments, Office macros
find /mnt/evidence/Users/*/Downloads/ -name "*.exe" -o -name "*.dll" -o -name "*.js" \
   -o -name "*.vbs" -o -name "*.hta" -o -name "*.ps1" 2>/dev/null \
   > /cases/case-2024-001/ransomware/suspicious_downloads.txt

# Check PowerShell execution
ls /mnt/evidence/Windows/Prefetch/ | grep -i powershell

步骤 4：评估加密范围和恢复选项

# Count encrypted files by directory
find /mnt/evidence/ -name "*.encrypted" 2>/dev/null | \
   awk -F/ '{OFS="/"; NF--; print}' | sort | uniq -c | sort -rn | head -20 \
   > /cases/case-2024-001/ransomware/encryption_scope.txt

# Check if Volume Shadow Copies survived
vssadmin list shadows 2>/dev/null > /cases/case-2024-001/ransomware/vss_status.txt

# Check for backup integrity
find /mnt/evidence/ -name "*.bak" -o -name "*.backup" 2>/dev/null | head -20

# Check No More Ransom project for available decryptors
# https://www.nomoreransom.org/en/decryption-tools.html
echo "Check https://www.nomoreransom.org/ for decryption tools" \
   > /cases/case-2024-001/ransomware/decryption_options.txt

# Attempt to recover encryption keys from memory dump
if [ -f /cases/case-2024-001/memory/memory.raw ]; then
    # Search for AES key schedules in memory
    vol -f /cases/case-2024-001/memory/memory.raw yarascan \
       --yara-rules 'rule AES_Key { strings: $aes = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 } condition: $aes }' \
       > /cases/case-2024-001/ransomware/aes_key_search.txt

    # Search for RSA key material
    vol -f /cases/case-2024-001/memory/memory.raw yarascan \
       --yara-rules 'rule RSA_Key { strings: $rsa = "RSA PRIVATE KEY" condition: $rsa }' \
       > /cases/case-2024-001/ransomware/rsa_key_search.txt
fi

步骤 5：记录发现并生成报告

# Generate comprehensive ransomware investigation report
cat << 'REPORT' > /cases/case-2024-001/ransomware/investigation_report.txt
RANSOMWARE INCIDENT INVESTIGATION REPORT
==========================================
Case Number: 2024-001
Date: $(date -u)
Analyst: [Examiner Name]

1. INCIDENT OVERVIEW
   - Ransomware Variant: [Identified variant]
   - First Encryption: [Timestamp from earliest encrypted file]
   - Last Encryption: [Timestamp from latest encrypted file]
   - Systems Affected: [Count]
   - Data Encrypted: [Volume estimate]

2. INITIAL ACCESS VECTOR
   - Method: [RDP brute force / Phishing / Exploit / etc.]
   - Entry Point: [System and IP]
   - Timestamp: [First unauthorized access]
   - Credentials Used: [Account names]

3. ATTACK CHAIN
   a. Initial Access: [Details]
   b. Execution: [Ransomware binary details]
   c. Persistence: [Services, scheduled tasks]
   d. Privilege Escalation: [Method used]
   e. Lateral Movement: [Systems accessed, methods]
   f. Collection/Staging: [Data staging before encryption]
   g. Impact: [Encryption execution]

4. INDICATORS OF COMPROMISE
   - Ransomware Binary SHA-256: [Hash]
   - C2 Servers: [IPs/Domains]
   - Bitcoin Wallet: [Address]
   - Tor Site: [.onion address]
   - Attacker IPs: [Source IPs]

5. RECOVERY ASSESSMENT
   - Decryptor Available: [Yes/No]
   - Shadow Copies: [Survived/Deleted]
   - Backups: [Status and integrity]
   - Memory Key Recovery: [Attempted/Results]

6. RECOMMENDATIONS
   - [Remediation steps]
   - [Prevention measures]
   - [Monitoring improvements]
REPORT

关键概念

概念	描述
勒索软件变种识别	根据扩展名、勒索信和行为确定具体的勒索软件家族
双重勒索	将加密与数据窃取及威胁公开相结合的攻击
卷影副本	Windows 备份机制，常被勒索软件删除以阻止恢复
加密范围	评估哪些文件、目录和系统被加密
驻留时间	从初始访问到部署勒索软件之间的时间段（通常为数天到数周）
勒索信 IoC	勒索要求中的比特币地址、Tor 站点和电子邮件地址
密钥恢复	尝试在关机前从内存中提取加密密钥
No More Ransom	执法部门倡议，为某些变种提供免费解密工具

工具与系统

工具	用途
ID Ransomware	根据样本识别勒索软件变种的在线服务
No More Ransom	来自执法部门合作的免费解密工具
Volatility	用于恢复加密密钥和恶意软件痕迹的内存取证
Chainsaw/Hayabusa	用于重建攻击时间线的 Windows 事件日志分析
PECmd	确认勒索软件可执行文件执行的 Prefetch 分析
YARA	用于识别勒索软件变种的特征匹配
Any.Run/Joe Sandbox	用于分析勒索软件行为的在线恶意软件沙箱
Capa	Mandiant 工具，通过静态分析识别恶意软件能力

常见场景

场景 1：通过 RDP 的 LockBit 攻击 在事件日志中追踪通过 RDP 暴力破解的初始访问，识别攻击者 IP 和被入侵账户，跟踪通过网络登录进行的横向移动，发现通过 PsExec 或 GPO 部署的 LockBit，根据文件时间戳记录加密时间线，检查加密前是否存在数据外泄。

场景 2：钓鱼引发的勒索软件 通过浏览器历史和电子邮件工件追踪钓鱼邮件，在 Prefetch 中识别恶意附件的执行，在网络日志中跟踪 Cobalt Strike beacon 通信，追踪权限提升和域入侵，记录勒索软件在整个网络中的部署情况。

场景 3：供应链勒索软件攻击 识别被入侵的软件更新机制，在应用程序日志中追踪恶意更新的分发，分析通过可信渠道投递的勒索软件载荷，评估哪些系统接收了该更新，确定是否已通知供应商。

场景 4：部分加密后的恢复 确定在遏制之前哪些系统和文件已被加密，检查是否有幸存的卷影副本，验证备份完整性和恢复能力，尝试基于内存的密钥恢复，联系执法部门以了解是否有可能获得解密器。

输出格式

Ransomware Investigation Summary:
  Variant: LockBit 3.0
  First Seen: 2024-01-18 02:00:00 UTC
  Encryption Duration: 4 hours 23 minutes
  Systems Encrypted: 45 out of 200 (containment stopped spread)

  Attack Timeline:
    2024-01-10 14:32 - RDP brute force from 203.0.113.45 (1,234 attempts)
    2024-01-10 15:00 - Successful RDP login as admin_backup
    2024-01-12 02:00 - Mimikatz executed (credential dump)
    2024-01-12 02:30 - Domain Admin credentials obtained
    2024-01-15 03:00 - Data exfiltration (45 GB to 185.x.x.x)
    2024-01-18 02:00 - LockBit deployed via PsExec to 45 systems
    2024-01-18 06:23 - Encryption completed on affected systems

  Recovery Options:
    Decryptor: Not available (LockBit 3.0)
    Shadow Copies: Deleted on all systems
    Backups: Last clean backup 2024-01-09 (9 days of data loss)
    Memory Keys: Not recovered (systems rebooted)

  IOCs:
    Ransomware Hash: a1b2c3d4e5f6...
    C2 IP: 185.x.x.x
    Bitcoin: bc1q...
    Tor: http://lockbit...onion