Ransomware Payload Analysis

1. Prerequisites

• Ransomware binary/sample
• File hashes
• EDR telemetry
• Sandbox results
• Memory captures
• Ransom notes
• Access to sandbox environment
• Access to reverse engineering tools
• Access to EDR platform
• Access to threat intelligence platforms
• Access to memory analysis tools

2. Step-by-Step Instructions

Common Failure Modes

• Analysing samples outside isolated environments
• Ignoring persistence mechanisms
• Missing staged exfiltration activity

1. Identify Ransomware Family

   • Determine:
     • Known ransomware family
     • Variant/version
     • Associated threat actor
     • Public reporting references

2. Analyse Encryption Behaviour

   • Review:
     • File extensions
     • Encryption speed
     • File targeting behaviour
     • Network share interaction
     • Hypervisor targeting

3. Review Persistence Mechanism

   • Identify:
     • Scheduled tasks
     • Services
     • Registry modifications
     • Startup mechanisms
     • GPO abuse

4. Assess Lateral Movement Capability

   • Determine use of:
     • PsExec
     • WMI
     • RDP
     • SMB propagation
     • Credential dumping

5. Identify Exfiltration Behaviour

   • Look for:
     • Archive creation
     • Compression activity
     • Data staging
     • Outbound transfers
     • Cloud storage abuse

6. Collect Indicators

   • Document:
     • File hashes
     • Domains/IPs
     • Mutexes
     • File paths
     • Registry keys
     • Services

3. Post-Action

• Document all findings within the incident ticket

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.