Evaluation of live forensic techniques in ransomware attack mitigation

Abstract

Ransomware continues to grow in both scale, cost, complexity and impact since its initial discovery nearly 30 years ago. Security practitioners are engaged in a continual "arms race" with the ransomware developers attempting to defend their digital infrastructure against such attacks. Recent manifestations of ransomware have started to employ a hybrid combination of symmetric and asymmetric encryption to encode user's files. This paper describes an investigation that tried to determine if the techniques currently employed in the field of digital forensics could be leveraged to discover the encryption keys used by these types of malicious software thus mitigating the effects of a ransomware attack. Memory was captured from a system infected by ransomware and its contents was examined using live forensic tools, with the intent of identifying the symmetric encryption keys being used. NotPetya, Bad Rabbit and Phobos hybrid ransomware samples were tested during the investigation. If keys were discovered, the following two steps were also performed. Firstly, a timeline was manually created by combining data from multiple sources to illustrate the ransomware's behaviour as well as showing when the encryption keys were present in memory and how long they remained there. Secondly, an attempt was made to decrypt the files encrypted by the ransomware using the found keys. In all cases, the investigation was able to confirm that it was possible to identify the encryption keys used. A description of how these found keys were then used to successfully decrypt files that had been encrypted during the execution of the ransomware is also given. The resulting generated timelines provided a excellent way to visualise the behaviour of the ransomware and the encryption key management practices it employed, and from a forensic investigation and possible mitigation point of view, when the encryption keys are in memory.

On the classification of Microsoft-Windows ransomware using hardware profile

“…A ransomware is more menacing than malware, as it not only damages the system and results in loss of control from the system but also demands compensation in return. Therefore, there is a need to have the proper distinction of ransomware from other malware (Aurangzeb et al, 2017;Kok et al, 2019;Zhang et al, 2019) to save billions of dollars in financial losses (Davies, Macfarlane & Buchanan, 2020).…”

Analysis of Conti Ransomware Attack on Computer Network with Live Forensic Method

“…This study uses a live forensics method as a first step to identify the behavior of a virus that attacks one of the host computers in a computer network [20], [21]. The stages of the live forensic method in this study are as shown in Figure 1.…”

Mitigating Sodinokibi Ransomware Attack on Cloud Network Using Software-Defined Networking (SDN)

“…The process of creating a virtual environment using VirtualBox and GNS3 software to perform valid and realistic ransomware experiments. In this virtual environment, already available viruses, data, files, infected computers and clean computers [25], making it possible to carry out mitigation to prevent the spread of viruses from cleaning computers. The environmental structure design in this study is as shown in Figure 1.…”