Breaking Down Ransomware: Insights and Analysis

[rock music] So team, uh, whenever we basically, uh, get this information about a particular system got infected with the ransomware or they have encrypted the file or this at- system is under the ransomware attack and all that, the first thing we always need to do the discovery.

Okay, this is basically called as a initial discovery.

So in the initial discovery, suppose when you find some files and all that, you need to first identify what, what is the original or origin of the file.

So here we need to identify how was the file was discovered.

Example, uh, is this file was delivered via email, someone has used some external pen drive.

So let's take example here is we have a system.

Okay, so there was a employee who got one pen drive.

He plugged the pen drive, and through that ransomware, a RAT is basically deployed in the system, and then remotely hacker hack the system and encrypt the file.

Or user receive some email, he download the email, from that, you know, it, the RAT was execute, and it give a persistent access to the remote system, and through that he hacked.

So w- the first thing whenever we confirm, okay, the system A was infected with the ransomware and ransomware attack was done successfully, we need to identify the source.

Origin is basically very important because by this way you can able to identify the author, you will identify the purpose, you will identify the motive and everything.

The second most important thing when you're dealing with the initial discovery is the file behavior.

So by the checking the system logs, security logs, you have to see is this file execute automatically or it is triggered by the user.

Okay, is there any noticeable changes in the system's behavior after the file was opened? So if you're running any kind of file integrity monitoring software, you can able to compare against the previous state.

So these are the two important thing that you have to do in the initial stage to discover the ransomware and their associate properties.