Lion Cipher Lab
Characterize a wiper from incident artifacts: destruction, boot sabotage, and why recovery fails
- Digital Forensics & IR (DFIR)
- Advanced
- ~55 min
- Free · no account required
Why it matters
The most dangerous hour of a destructive-malware incident is the first one, and the most expensive mistake in it is a category error: treating a wiper as ransomware. Ransomware encrypts your data and — usually — really can decrypt it, so the response bends toward recovery, negotiation, buying time. A wiper only LOOKS like that. It paints a ransom note on the screen, but underneath it has overwritten the disk, smashed the boot record, stopped and deleted the services that protect you, disabled Windows recovery, and destroyed every shadow copy and backup it could reach. There is no key, because…
What you'll learn
- reading raw-disk-write telemetry and recognising an MBR / boot-sector overwrite (writes to \\.\PhysicalDrive0 at offset 0)
- spotting service disruption in SCM and Sysmon events: security/backup services stopped and deleted
- reading boot-configuration sabotage from bcdedit command lines (recoveryenabled No, bootstatuspolicy ignoreallfailures)
- identifying recovery-option destruction: vssadmin shadow-copy deletion and wbadmin backup-catalog deletion
- distinguishing a WIPER from real ransomware by the recovery-is-impossible tell — no decryption key, destroyed boot structures, wiped backups
- mapping observed destruction to MITRE ATT&CK (T1485 Data Destruction, T1561 Disk Wipe, T1490 Inhibit System Recovery)
- judgment: why an incident responder treats destructive impact as irreversible from minute one and prioritises isolation and blast-radius scoping over decryption
Steps in this lab
- The scene: you're handed a victim host's artifacts, not a live decision
- Artifact 1 — raw-disk writes: reading an MBR / boot-sector overwrite
- Artifact 2 — service disruption: security and backup services stopped and deleted
- Artifact 3 — boot-configuration sabotage: reading the bcdedit command lines
- Artifact 4 — recovery-option destruction: shadow copies and backups wiped
- Artifact 5 — the ransom note, and WHEN the pattern says wiper not ransomware
- Map it to MITRE ATT&CK — the one-paragraph characterisation
- How a pro responds: destruction from minute one, isolation over decryption