Arcana IR documentation · offline copy Nederlands

RB-ANALYSIS-013: Ransomware Payload Analysis

Document Control

Attribute	Value	Date
Document Name	Ransomware Payload Analysis
Version	[Enter version number]	[Enter date]
Owner	[Enter owner/team]	[Enter date]
Status	[Draft/Approved/Retired]	[Enter date]
Next Review Date	[Enter next review date]	[Enter date]
Approvals	[Enter approver(s)]	[Enter date]
Change Summary	Initial creation	[Enter date]

1. Prerequisites

Ransomware binary/sample
File hashes
EDR telemetry
Sandbox results
Memory captures
Ransom notes
Access to sandbox environment
Access to reverse engineering tools
Access to EDR platform
Access to threat intelligence platforms
Access to memory analysis tools

2. Step-by-Step Instructions

Common Failure Modes

Analysing samples outside isolated environments

Ignoring persistence mechanisms

Missing staged exfiltration activity

Identify Ransomware Family
- Determine:
  - Known ransomware family
  - Variant/version
  - Associated threat actor
  - Public reporting references
Analyse Encryption Behaviour
- Review:
  - File extensions
  - Encryption speed
  - File targeting behaviour
  - Network share interaction
  - Hypervisor targeting
Review Persistence Mechanism
- Identify:
  - Scheduled tasks
  - Services
  - Registry modifications
  - Startup mechanisms
  - GPO abuse
Assess Lateral Movement Capability
- Determine use of:
  - PsExec
  - WMI
  - RDP
  - SMB propagation
  - Credential dumping
Identify Exfiltration Behaviour
- Look for:
  - Archive creation
  - Compression activity
  - Data staging
  - Outbound transfers
  - Cloud storage abuse
Collect Indicators
- Document:
  - File hashes
  - Domains/IPs
  - Mutexes
  - File paths
  - Registry keys
  - Services

3. Post-Action

Document all findings within the incident ticket

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.