Ransomware Containment and Evidence Preservation Under Pressure
At 07:40 on 4 November, the help desk receives 12 reports of files renamed with .locked and a ransom note named READ_ME.txt. The affected hosts include the finance file server FS-01 and 11 Windows 10 workstations. EDR shows a PowerShell process spawned by WINWORD.EXE on WS-207 at 07:12, followed by SMB connections to FS-01 and creation of READ_ME.txt. The backup NAS is online and mapped to FS-01. The incident response lead wants to shut down all hosts, restore FS-01 from the previous night’s backup, and reimage the 11 workstations immediately. A junior analyst has already unplugged WS-207 and placed it in a closet. The ransom note demands 40 BTC and includes a Tor chat URL. The company has no written containment playbook. The CEO wants a public statement within two hours.
1. Evaluate the proposed containment and restoration plan. What should be done first, and what should not be done?
Read the worked answer
The plan is too destructive and too early. Shutting down all hosts can lose volatile memory, and reimaging before scoping destroys evidence of initial access, lateral movement, and encryption behavior. Restoring FS-01 before the backup NAS is secured risks re-encryption or reinfection, especially because the NAS is online and mapped to the server.
First, isolate affected network segments and block known command-and-control indicators while preserving memory on WS-207 and FS-01. Take the backup NAS offline or make it immutable, and rotate privileged credentials. Scope the incident: identify the initial document, the PowerShell payload, SMB propagation, and all hosts that touched FS-01. Do not pay the ransom or interact with the Tor URL. The public statement should wait for legal, privacy, and communications review, but preservation and containment should not. Restoration should occur only after the persistence mechanism and entry point are understood.
2. What forensic triage should be performed on WS-207 and FS-01, and in what order?
Read the worked answer
Volatile data first. For WS-207, capture memory before reimaging or extended shutdown, then collect EDR process trees, PowerShell operational logs, command history, network connections, and the malicious document. For FS-01, capture memory and current SMB sessions, then image the disk. Preserve READ_ME.txt with its hash, timestamps, and metadata.
On disk, examine Prefetch, Amcache, ShimCache, UserAssist, event logs, scheduled tasks, services, and startup locations. On FS-01, review file-server audit logs, SMB share access, encryption event patterns, and backup catalog metadata. The junior analyst should document the unplugging of WS-207 and maintain chain of custody; unplugging is not fatal, but it may have lost memory. Triage should produce a timeline from initial execution to encryption and a list of indicators for enterprise-wide hunting.
3. How should the ransom note and Tor URL be handled, and what malware analysis steps are appropriate?
Read the worked answer
Preserve the ransom note as evidence: record its full path, size, hashes, timestamps, and metadata, and retain the original. Do not click the Tor URL, enter credentials, or engage the operator without legal direction. The note text and URL can be extracted from a copy for intelligence, but interaction can tip off the attacker and create legal and safety issues.
Malware analysis should begin with static examination of the document, PowerShell scripts, and binaries, followed by dynamic analysis in an isolated sandbox with no production network access. The examiner should identify the ransomware family, encryption method, persistence, command-and-control infrastructure, and any weaknesses or available decryptors. Indicators should feed containment and hunting. The report should distinguish confirmed findings from vendor or public reporting, and should advise law enforcement liaison before any negotiation.