Investigating Ransomware Attack Artifacts

When to Use

• Immediately after discovering ransomware encryption on systems
• When performing forensic analysis to understand the full scope of a ransomware incident
• For identifying the ransomware variant and determining if decryption is possible
• When tracing the attack chain from initial access to encryption
• For documenting evidence to support law enforcement and insurance claims

Prerequisites

• Forensic images of affected systems (preserve before remediation)
• Memory dumps captured before system shutdown (if available)
• Ransom notes and encrypted file samples
• Network traffic captures from the attack period
• Windows Event Logs, Prefetch files, and registry hives
• Access to ransomware identification tools (ID Ransomware, No More Ransom)
• Isolated sandbox environment for malware analysis

Workflow

Step 1: Preserve Evidence and Identify the Ransomware Variant

# CRITICAL: Do NOT restart systems. Preserve memory first if possible.
# Encryption keys may still be in memory.

# Capture memory from running systems
# Windows: DumpIt.exe (generates memory.raw)
# Linux: sudo insmod lime.ko "path=/evidence/memor…