id: Ransomware Advanced Analysis
version: -1
name: Ransomware Advanced Analysis
description: |-
  This playbook detects the ransomware type and searches for available decryptors.

  The playbook uses the ID-Ransomware service, which allows you to detect the ransomware using multiple methods.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 94496b66-deeb-4ad3-850c-5b29297b6424
    type: start
    task:
      id: 94496b66-deeb-4ad3-850c-5b29297b6424
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6bea0606-e0de-47aa-8622-a9dc9bf3c4bf
    type: title
    task:
      id: 6bea0606-e0de-47aa-8622-a9dc9bf3c4bf
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 1740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 39aa0da1-a8d5-414a-8b1b-f60441955a36
    type: title
    task:
      id: 39aa0da1-a8d5-414a-8b1b-f60441955a36
      version: -1
      name: Get ransomware note - Manual
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: c7f23da2-0676-45c4-8dd7-57cff68e0bb2
    type: regular
    task:
      id: c7f23da2-0676-45c4-8dd7-57cff68e0bb2
      version: -1
      name: Read the ransomware note
      description: Loads the content of a file into context.
      scriptName: ReadFile
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: txt
            - operator: isEqualString
              left:
                value:
                  simple: File.Extension
                iscontext: true
              right:
                value:
                  simple: html
          accessor: EntryID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    fieldMapping:
    - incidentfield: Note
      output:
        complex:
          root: FileData
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 04faf861-3fcd-4cd2-804f-2e279c128cbe
    type: regular
    task:
      id: 04faf861-3fcd-4cd2-804f-2e279c128cbe
      version: -1
      name: Rasterize the ransomware note
      description: Converts the body of an email to an image file or a PDF file.
      tags:
      - RansomwareNote
      script: Rasterize|||rasterize-email
      type: regular
      iscommand: true
      brand: Rasterize
    nexttasks:
      '#none#':
      - "51"
    scriptarguments:
      height:
        simple: "800"
      htmlBody:
        complex:
          root: FileData
      width:
        simple: "600"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: fa354c56-3f26-4e78-8218-c8bf57b54d28
    type: regular
    task:
      id: fa354c56-3f26-4e78-8218-c8bf57b54d28
      version: -1
      name: Upload the ransomware note
      description: Uploads the ransomware note for advanced analysis.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 270
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 57e20d64-4490-4bf4-805e-1edb473eb085
    type: condition
    task:
      id: 57e20d64-4490-4bf4-805e-1edb473eb085
      version: -1
      name: Were the files uploaded successfully?
      description: Manual validation for the ransomware file upload.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "Yes":
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -290,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 72ff599b-0986-4a1e-843b-c562a545f884
    type: title
    task:
      id: 72ff599b-0986-4a1e-843b-c562a545f884
      version: -1
      name: ID-Ransomware Enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "48"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 180c115a-9d1c-4a76-8fa0-02ad4c57c3aa
    type: regular
    task:
      id: 180c115a-9d1c-4a76-8fa0-02ad4c57c3aa
      version: -1
      name: Search decryptor using the ransomware URL
      description: |-
        Use ID-Ransomware for identifying the ransomware type.
        If the the ransomware was identified successfully, use the decryptor to recover the encrypted files.

        [ID-Ransomware service](https://id-ransomware.malwarehunterteam.com/identify.php)

        **The identification can be done by submitting one of the following:**

        1.The ransomware note.

        2.The contact link provided in the ransomware note.

        3.An encrypted file sample (be careful when uploading encrypted files, as some may include sensitive information).
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: 54a17556-1c79-452c-8bc1-3be8419e1dcf
    type: condition
    task:
      id: 54a17556-1c79-452c-8bc1-3be8419e1dcf
      version: -1
      name: Was the ransomware identified successfully?
      description: Manual validation for the results of the ID-Ransomware query.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "Yes":
      - "50"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: d7f9e68e-b92e-46f3-8fee-1afd80d3c922
    type: regular
    task:
      id: d7f9e68e-b92e-46f3-8fee-1afd80d3c922
      version: -1
      name: Test the decryptor
      description: A manual task for the analyst to verify that the decryptor works.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 1570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: ea3e7ea6-ad7e-4b2d-83d9-e5c019523008
    type: regular
    task:
      id: ea3e7ea6-ad7e-4b2d-83d9-e5c019523008
      version: -1
      name: Extract indicator from the ransomware note
      description: Extract all indicators according to the server's indicator extraction configuration.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "47"
    scriptarguments:
      text:
        complex:
          root: FileData
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 110,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "46_14_#default#": 0.52,
      "46_42_Yes": 0.43,
      "49_14_#default#": 0.43,
      "49_50_Yes": 0.43
    },
    "paper": {
      "dimensions": {
        "height": 1785,
        "width": 780,
        "x": -290,
        "y": 20
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests (auto formatted)
marketplaces: ["marketplacev2", "platform"]
fromversion: 6.6.0


supportedModules:
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr
- xsiam