Ransomware Advanced Analysis

This playbook detects the ransomware type and searches for available decryptors. The playbook uses the ID-Ransomware service, which allows you to detect the ransomware using multiple methods.

Core · 12 tasks · 0 inputs · 0 outputs

Details

IDRansomware Advanced Analysis
From Version6.6.0
Tasks12

README

This playbook is responsible for detecting the ransomware type and searching for available decryptors.

The playbook uses the ID-Ransomware service, which allows detecting the ransomware using multiple methods.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Rasterize

Scripts

  • ReadFile

Commands

  • rasterize-email
  • extractIndicators

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Ransomware Advanced Analysis

Commands used

extractIndicators rasterize-email

Flowchart

Yes Yes Start Start Done Done Get ransomware note - Manual Get ransomware note - Manual Read the ransomware note - ReadFile Read the ransomware note ReadFile Rasterize the ransomware note - rasterize-email Rasterize the ransomware ... rasterize-email Upload the ransomware note Upload the ransomware note Were the files uploaded successfully? Were the files uploaded s... ID-Ransomware Enrichment ID-Ransomware Enrichment Search decryptor using the ransomware URL Search decryptor using th... Was the ransomware identified successfully? Was the ransomware identi... Test the decryptor Test the decryptor Extract indicator from the ransomware note - extractIndicators Extract indicator from th... extractIndicators

Source

playbook-Ransomware_Advanced_Analysis.yml
Download History Raw 
id: Ransomware Advanced Analysis
version: -1
name: Ransomware Advanced Analysis
description: |-
  This playbook detects the ransomware type and searches for available decryptors.

  The playbook uses the ID-Ransomware service, which allows you to detect the ransomware using multiple methods.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 94496b66-deeb-4ad3-850c-5b29297b6424
    type: start
    task:
      id: 94496b66-deeb-4ad3-850c-5b29297b6424
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6bea0606-e0de-47aa-8622-a9dc9bf3c4bf
    type: title
    task:
      id: 6bea0606-e0de-47aa-8622-a9dc9bf3c4bf
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 39aa0da1-a8d5-414a-8b1b-f60441955a36
    type: title
    task:
      id: 39aa0da1-a8d5-414a-8b1b-f60441955a36
      version: -1
      name: Get ransomware note - Manual
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: c7f23da2-0676-45c4-8dd7-57cff68e0bb2
    type: regular
    task:
      id: c7f23da2-0676-45c4-8dd7-57cff68e0bb2
      version: -1
      name: Read the ransomware note
      description: Loads the content of a file into context.
      scriptName: ReadFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: txt
            - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: html
          accessor: EntryID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Note
      output:
        complex:
          root: FileData
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 04faf861-3fcd-4cd2-804f-2e279c128cbe
    type: regular
    task:
      id: 04faf861-3fcd-4cd2-804f-2e279c128cbe
      version: -1
      name: Rasterize the ransomware note
      description: Converts the body of an email to an image file or a PDF file.
      tags:
      - RansomwareNote
      script: Rasterize|||rasterize-email
      type: regular
      iscommand: true
      brand: Rasterize
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      height:
        simple: "800"
      htmlBody:
        complex:
          root: FileData
      width:
        simple: "600"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: fa354c56-3f26-4e78-8218-c8bf57b54d28
    type: regular
    task:
      id: fa354c56-3f26-4e78-8218-c8bf57b54d28
      version: -1
      name: Upload the ransomware note
      description: Uploads the ransomware note for advanced analysis.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 57e20d64-4490-4bf4-805e-1edb473eb085
    type: condition
    task:
      id: 57e20d64-4490-4bf4-805e-1edb473eb085
      version: -1
      name: Were the files uploaded successfully?
      description: Manual validation for the ransomware file upload.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "Yes":
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 72ff599b-0986-4a1e-843b-c562a545f884
    type: title
    task:
      id: 72ff599b-0986-4a1e-843b-c562a545f884
      version: -1
      name: ID-Ransomware Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 180c115a-9d1c-4a76-8fa0-02ad4c57c3aa
    type: regular
    task:
      id: 180c115a-9d1c-4a76-8fa0-02ad4c57c3aa
      version: -1
      name: Search decryptor using the ransomware URL
      description: |-
        Use ID-Ransomware for identifying the ransomware type.
        If the the ransomware was identified successfully, use the decryptor to recover the encrypted files.

        [ID-Ransomware service](https://id-ransomware.malwarehunterteam.com/identify.php)

        **The identification can be done by submitting one of the following:**

        1.The ransomware note.

        2.The contact link provided in the ransomware note.

        3.An encrypted file sample (be careful when uploading encrypted files, as some may include sensitive information).
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 54a17556-1c79-452c-8bc1-3be8419e1dcf
    type: condition
    task:
      id: 54a17556-1c79-452c-8bc1-3be8419e1dcf
      version: -1
      name: Was the ransomware identified successfully?
      description: Manual validation for the results of the ID-Ransomware query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "Yes":
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: d7f9e68e-b92e-46f3-8fee-1afd80d3c922
    type: regular
    task:
      id: d7f9e68e-b92e-46f3-8fee-1afd80d3c922
      version: -1
      name: Test the decryptor
      description: A manual task for the analyst to verify that the decryptor works.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: ea3e7ea6-ad7e-4b2d-83d9-e5c019523008
    type: regular
    task:
      id: ea3e7ea6-ad7e-4b2d-83d9-e5c019523008
      version: -1
      name: Extract indicator from the ransomware note
      description: Extract all indicators according to the server's indicator extraction configuration.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      text:
        complex:
          root: FileData
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "46_14_#default#": 0.52,
      "46_42_Yes": 0.43,
      "49_14_#default#": 0.43,
      "49_50_Yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1785,
        "width": 780,
        "x": -290,
        "y": 20
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
marketplaces: ["marketplacev2", "platform"]
fromversion: 6.6.0


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam