Network Analysis – Ransomware Incident Report

1. Executive Summary

This report presents the findings of a network security incident investigation involving Ransomware at ABC Industries. The incident originated when a Windows 7 workstation downloaded and executed a malicious file. As a result, critical corporate bidding documents (in PDF format) were encrypted.

Through Network Traffic Analysis (PCAP) and Static Analysis, the analysis team successfully identified the malware strain as TeslaCrypt (utilizing the RSA-4096 encryption algorithm) and uncovered its Command and Control (C2) server. Currently, the encrypted data has been successfully recovered using a specialized decryption tool. The system is undergoing remediation and preventive hardening.

2. Initial Evidence

The evidence files collected from the infected workstation include:

• A PCAP file recording all network traffic during the time of the incident.
• A text file containing the ransom note and payment instructions.
• A critical document that was encrypted, named Tender.pdf.micro.

(Evidence Files Directory)

3. Technical Analysis

3.1. Network Traffic Analysis

The network traffic data (PCAP) was analyzed using Wireshark to identify the infected machine’s operating system (Victim OS) and detect any anomalous network connections. Information from Statistics > Capture File Properties indicates that the workstation was running Windows 7.

By filtering the network traffic for the HTTP (Hypertext Transfer Protocol) using the Protocol Hierarchy feature, the analysis revealed a suspicious GET request to download an executable named safecrypt.exe from the IP address 10.0.2.15 to the victim machine 10.0.2.4.

Extracting the HTTP Stream provided full details of the malicious payload download request:

3.2. Static Analysis

An MD5 hash was extracted from the safecrypt.exe executable to cross-reference with Threat Intelligence databases.

PowerShell command used to obtain the hash:

Get-FileHash /Path/To/File/safecrypt.exe -Algorithm MD5

Searching the MD5 hash 4A1D88603B1007825A9C6B36D1E5DE44 on VirusTotal revealed that 64/68 security vendors flagged the file as malicious.

Based on community data and Sandbox analysis (JOE Sandbox), this malware was identified as belonging to the TeslaCrypt Ransomware family.

Further analysis of the ransom note (help_recover_instructions.TXT) confirmed the use of the RSA-4096 encryption algorithm.

(Content of help_recover_instructions.TXT)

3.3. Command & Control (C2) Activity

Analysis of the outbound traffic generated by safecrypt.exe demonstrated that the malware communicated with a Command & Control (C2) server hosted at the domain http://dunyamuzelerimuzesi.com/.

4. Indicators of Compromise (IOCs)

The following IOCs have been compiled to sweep the environment and update Firewall, IDS/IPS, and EDR rule sets.

IOC Type	Value	Note
Affected OS	32-bit Windows 7 Service Pack 1, build 7601	Victim’s workstation
Malware URL	http://10.0.2.15/safecrypt.exe	Source of the malicious payload
Executable Name	safecrypt.exe	Ransomware payload
MD5 Hash	4a1d88603b1007825a9c6b36d1e5de44	Hash of safecrypt.exe
C2 Domain	dunyamuzelerimuzesi.com	Attacker’s C2 server
Malware Family	TeslaCrypt	Ransomware strain
Encryption Algorithm	RSA-4096	Used for document encryption
Encrypted Extension	.micro	Appended to encrypted files

5. MITRE ATT&CK Mapping

The attack lifecycle maps to the MITRE ATT&CK framework as follows:

Tactic	Technique	ID	Behavior Description
Execution	User Execution: Malicious File (Assessed)	T1204.002	The workstation downloaded safecrypt.exe, after which ransomware-related activity was observed. Direct user execution could not be confirmed from the available network evidence.
Command and Control	Application Layer Protocol: Web Protocols	T1071.001	The malware communicated with the C2 domain dunyamuzelerimuzesi.com over HTTP.
Impact	Data Encrypted for Impact	T1486	The document Tender.pdf was encrypted using RSA-4096 and appended with the .micro extension.

6. Data Recovery

Security researchers have previously analyzed this specific variant of TeslaCrypt and publicly released the decryption key alongside a recovery tool. The decryption of the critical file Tender.pdf.micro was successfully executed.

The decryption tool was deployed by pointing it to the directory containing the affected files.

(Decryption Tool Extraction)

(Decryption Tool Interface)

Upon providing the target path, the tool confirmed a successful decryption. The encrypted file Tender.pdf.micro was restored to its original state as Tender.pdf.

Document integrity verification: The file opened normally without any corruption.

7. Recommendations / Action Plan

To mitigate the risk of similar incidents occurring in the future, the SOC team recommends the following immediate actions:

1. Containment:
   • Immediately disconnect the infected workstation (IP: 10.0.2.4) from the network to prevent lateral movement of the ransomware to other servers.
2. Eradication:
   • Update signature databases for all Antivirus/EDR solutions.
   • Quarantine or permanently delete the safecrypt.exe file.
3. Prevention:
   • Add the MD5 hash 4a1d88603b1007825a9c6b36d1e5de44 to the global blacklist across all EDR agents.
   • Block inbound and outbound traffic to/from the C2 domain dunyamuzelerimuzesi.com and the payload IP 10.0.2.15 at the corporate Firewall.
   • Upgrade the operating system (currently Windows 7, which has reached End-of-Life) to a modern, actively supported version of Windows to ensure regular security patches.
4. Threat Hunting:
   • Conduct a sweeping search across SIEM logs for any HTTP connections to dunyamuzelerimuzesi.com or 10.0.2.15 network-wide to ensure no other endpoints have been compromised.