勒索软件专项分析

---
name: ransomware-analysis
description: >
  Perform ransomware-specific analysis including encryption algorithm identification,
  key recovery assessment, ransom note parsing, payment infrastructure tracking,
  and kill switch discovery. Covers family identification using behavioral markers
  (file extensions, mutex names, ransom note patterns), cryptographic implementation
  review for weaknesses, and recovery option evaluation. Use when analyzing suspected
  ransomware samples or responding to active ransomware incidents.
---

# Ransomware Analysis

Analyze ransomware samples to identify the family, understand the encryption
implementation, assess recovery options, and extract actionable intelligence
for detection and response.

## Prerequisites

- **Python 3.8+**: `hashlib`, `json`, `re`, `os` (standard library)
- **Python packages (optional)**: `pefile`, `yara-python`, `pycryptodome`
- **Tools (recommended)**: Ghidra/IDA Pro, x64dbg, Process Monitor, Wireshark
- **Environment**: Isolated VM with snapshots (never run ransomware on production systems)
- **References**: NoMoreRansom.org decryptor database, ID Ransomware

## Step-by-Step Instructions

### Step 1: Identify the Ransomware Family

Use the ransomware identifier script to match against known family signatures.

**Run identification:**
```bash
python3 scripts/ransomware_identifier.py \
  --sample ransomware.exe \
  --ransom-note README.txt \
  --encrypted-extension .locked \
  --output identification.json
```

**Check ransom note patterns:**
```bash
python3 scripts/ransomware_identifier.py \
  --ransom-note "YOUR FILES ARE ENCRYPTED.txt" \
  --note-only \
  --output family_match.json
```

**Upload to ID Ransomware (manual):**
- Visit https://id-ransomware.malwarehunterteam.com/
- Upload the ransom note and/or an encrypted file
- Note the identified family and available decryptors

**Key identification markers:**
| Marker | Examples |
|--------|----------|
| File extension | `.lockbit`, `.BlackCat`, `.play`, `.akira` |
| Ransom note filename | `readme.txt`, `RECOVER-FILES.html`, `!README!.txt` |
| Mutex names | `Global\{family-specific-GUID}` |
| Registry keys | Family-specific persistence or config storage |
| Wallpaper changes | Custom desktop wallpaper with instructions |
| Encryption markers | File headers, magic bytes in encrypted files |

### Step 2: Analyze the Encryption Implementation

Understand how files are encrypted to assess recovery feasibility.

**Run crypto analysis:**
```bash
python3 scripts/crypto_analyzer.py \
  --sample ransomware.exe \
  --encrypted-file document.docx.locked \
  --original-file document.docx \
  --output crypto_analysis.json
```

**Key questions to answer:**
1. What encryption algorithm is used? (AES, ChaCha20, RSA, custom)
2. How are encryption keys generated? (CSPRNG, weak PRNG, time-based)
3. How are keys stored/transmitted? (Embedded, C2, appended to files)
4. Is there a key exchange mechanism? (RSA-wrapped AES key, Diffie-Hellman)
5. Are there implementation flaws? (ECB mode, key reuse, weak RNG)

**Static analysis for crypto indicators:**
```bash
# Look for crypto-related imports
strings ransomware.exe | grep -iE "(CryptEncrypt|CryptGenRandom|BCrypt|AES|RSA|chacha|salsa)"

# Look for crypto constants (AES S-box, SHA round constants)
python3 -c "
data = open('ransomware.exe', 'rb').read()
# AES S-box first bytes
if b'\x63\x7c\x77\x7b\xf2\x6b\x6f\xc5' in data:
    print('AES S-box detected')
# ChaCha20 constant
if b'expand 32-byte k' in data:
    print('ChaCha20/Salsa20 constant detected')
"
```

**Dynamic analysis approach:**
1. Set breakpoint on crypto API calls (CryptEncrypt, BCryptEncrypt)
2. Capture key material passed to encryption functions
3. Monitor file I/O to understand encryption pattern (full file, partial, header-only)
4. Check if keys are sent to C2 before or after encryption

### Step 3: Assess Key Recovery Options

Based on the crypto analysis, determine if decryption without paying is possible.

**Check for known decryptors:**
```bash
python3 scripts/ransomware_identifier.py \
  --sample ransomware.exe \
  --check-decryptors \
  --output recovery_options.json
```

**Common weaknesses to look for:**

| Weakness | Description | Recovery Method |
|----------|-------------|-----------------|
| Weak PRNG | Key derived from predictable seed (time, PID) | Brute-force seed space |
| Key reuse | Same key for all files | Recover key from any known plaintext |
| ECB mode | Electronic Codebook mode | Pattern analysis on encrypted files |
| Local key storage | Key stored locally before C2 exfil | Extract from disk/memory |
| Stream cipher reuse | Same keystream for multiple files | XOR known plaintext |
| Offline encryption | No C2 needed, embedded public key | Check for key in binary |
| Kill switch | Domain check or mutex prevents execution | Activate kill switch |
| Implementation bugs | Off-by-one, partial encryption | Varies by bug |

**Memory forensics for key recovery:**
```bash
# If the ransomware process is still running or a memory dump is available
# Look for crypto key material in process memory
volatility3 -f memory.dmp windows.memmap --pid <ransomware_pid> --dump
strings process_memory.dmp | grep -P "^[A-Fa-f0-9]{32,64}$" | head -20
```

### Step 4: Analyze the Ransom Note

Extract intelligence from the ransom note content.

**Parse ransom note:**
```bash
python3 scripts/ransomware_identifier.py \
  --ransom-note ransom_note.txt \
  --parse-note \
  --output note_analysis.json
```

**Information to extract:**
- Payment address (Bitcoin, Monero, other cryptocurrency)
- Tor .onion negotiation site URL
- Victim/campaign ID
- Contact email addresses
- Payment amount and deadline
- Threatened consequences (data leak, increased ransom)
- File listing or proof of data theft

**Track payment infrastructure:**
```bash
# Check Bitcoin address on blockchain explorer
curl -s "https://blockchain.info/rawaddr/BC1Q_ADDRESS_HERE" | python3 -m json.tool

# Check if the BTC address has been reported
# https://www.bitcoinabuse.com/reports/BC1Q_ADDRESS_HERE
```

### Step 5: Check for Kill Switches

Some ransomware families include kill switches that prevent encryption.

**Common kill switch types:**

| Type | How it works | Example |
|------|-------------|---------|
| Domain check | DNS resolves = abort | WannaCry |
| Mutex check | If mutex exists, abort | Multiple families |
| Language check | System language is excluded | CIS country exclusions |
| File check | Specific file present = abort | Various |
| Registry check | Specific key present = abort | Various |

**Check for language-based kill switches:**
```bash
strings ransomware.exe | grep -iE "(GetSystemDefaultLangID|GetKeyboardLayout|GetUserDefaultUILanguage)"
# Common excluded language codes: 0x0419 (Russian), 0x0422 (Ukrainian), 0x0423 (Belarusian)
```

**Check for mutex-based kill switches:**
```bash
strings ransomware.exe | grep -iE "(CreateMutex|OpenMutex|Global\\\\)"
```

### Step 6: Map File Encryption Behavior

Understand the file targeting and encryption strategy.

**Monitor with Process Monitor (dynamic analysis):**
1. Set filter: Process Name = ransomware.exe, Operation = WriteFile
2. Execute sample in sandbox
3. Observe file access patterns

**Key behaviors to document:**
- Which file extensions are targeted
- Which directories are skipped (Windows, Program Files)
- Whether files are encrypted in place or renamed
- Whether original files are securely deleted
- Whether shadow copies are deleted (`vssadmin delete shadows`)
- Whether network shares are enumerated and encrypted
- Encryption speed and parallelism (multi-threaded)

**Anti-recovery techniques:**
```bash
# Check for shadow copy deletion
strings ransomware.exe | grep -iE "(vssadmin|wmic|shadowcopy|bcdedit|wbadmin)"

# Check for backup deletion
strings ransomware.exe | grep -iE "(delete catalog|recoveryenabled|bootstatuspolicy)"
```

### Step 7: Analyze Lateral Movement Capabilities

Modern ransomware often includes lateral movement features.

**Check for network propagation:**
```bash
# SMB-related imports and strings
strings ransomware.exe | grep -iE "(NetShareEnum|WNetOpenEnum|\\\\ADMIN\$|\\\\C\$|\\\\IPC\$)"

# Credential harvesting
strings ransomware.exe | grep -iE "(mimikatz|sekurlsa|lsadump|LSASS)"

# PSExec-like remote execution
strings ransomware.exe | grep -iE "(psexec|PSEXESVC|CreateService|StartService)"
```

### Step 8: Extract IOCs and Build Detections

Compile all indicators from the analysis.

**Generate detection rules:**
```bash
# Ransom note file creation
# Encrypted file extension pattern
# Mutex names
# C2 communication
# Shadow copy deletion commands
```

See `references/ransomware-families.md` for family-specific detection signatures.

## Output Format

```json
{
  "family": "LockBit 3.0",
  "confidence": "high",
  "identification_markers": {
    "extension": ".lockbit",
    "ransom_note": "README.txt",
    "mutex": "Global\\{GUID}",
    "wallpaper_change": true
  },
  "encryption": {
    "algorithm": "AES-256-CTR + RSA-2048",
    "key_generation": "CryptGenRandom (CSPRNG)",
    "key_exchange": "RSA-wrapped per-file AES key",
    "weaknesses_found": [],
    "recovery_feasible": false
  },
  "payment": {
    "cryptocurrency": "Bitcoin",
    "address": "bc1q...",
    "amount": "Unknown (negotiation required)",
    "tor_site": "http://lockbit....onion"
  },
  "kill_switches": {
    "language_check": ["Russian", "Ukrainian"],
    "mutex_check": true
  },
  "iocs": {},
  "mitre_attack": ["T1486", "T1490", "T1027", "T1083"]
}
```

## Tips

- Always work in an isolated, snapshotted VM - ransomware is destructive
- Take a memory dump before terminating the ransomware process (key recovery)
- Preserve encrypted files and ransom notes as evidence
- Check NoMoreRansom.org before attempting any recovery
- Do not pay the ransom without consulting law enforcement and legal counsel
- Some families use intermittent encryption (encrypt portions of files) for speed
- Modern ransomware often exfiltrates data before encryption (double extortion)
- Check for leaked builder tools that may expose encryption keys
- Monitor for data leak site postings related to the victim