Lion Cipher Lab

Characterize a ransomware sample from its artifacts: encryption, extensions, and the ransom note

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Ransomware is the incident every SOC and DFIR team dreads, and when it hits, the first question leadership asks is 'what is it doing, and can we get our files back?' You rarely start with the malware author's source code — you start with wreckage: a directory full of renamed files, a Procmon capture, a note on the desktop. Characterizing the sample from those artifacts is the skill that answers whether recovery is possible, what to hunt for on the other machines, and which family you're likely facing. This drill hands you exactly that wreckage — collected safely from an isolated sandbox — and…

What you'll learn

• reading a file-system change list to spot mass encryption: appended extension marker and a note dropped in every folder
• recognising the ransomware fingerprint — the read / encrypt / rename loop running at machine speed across thousands of files
• reading a crypto API trace (CryptAcquireContext, CryptGenKey, CryptEncrypt, BCryptEncrypt) and inferring hybrid encryption
• identifying recovery-sabotage commands (vssadmin delete shadows, bcdedit, wbadmin) as Inhibit System Recovery
• reading the ransom note as the extortion vector and pulling the victim ID, contact channel, and double-extortion threat
• mapping observed behaviour to MITRE ATT&CK T1486 (Data Encrypted for Impact) and T1490 (Inhibit System Recovery)
• extracting a full IOC / IOA set from behavioural artifacts and knowing what to preserve for recovery and attribution
• judgment: when behavioural artifacts are enough to characterize the family and when you must have the binary and keys

Steps in this lab

1. The scene: one sample, an isolated VM, five bundles of wreckage
2. Bundle 1 — the file-system change list: the extension marker and the note in every folder
3. Bundle 2 — the Procmon slice: the read / encrypt / rename loop that is the fingerprint
4. Bundle 3 — the crypto API trace: what CryptEncrypt / BCryptEncrypt reveal
5. Bundle 4 — the recovery-sabotage commands: Inhibit System Recovery (T1490)
6. Bundle 5 — the ransom note: the extortion vector, read for intelligence
7. WHEN the artifacts characterize the family — and WHEN you still need the binary and keys
8. Map it, pull the IOCs, and preserve the right things for recovery and attribution

Open the full interactive lab →