Introduction

This investigation addresses a sophisticated ransomware attack targeting multiple endpoints within an enterprise environment. As the forensic analyst assigned to this case, my primary objective was to determine the delivery method of the ransomware, trace the attacker’s activities, and establish a timeline of events. The analysis involved inspecting logs, examining system artifacts, and identifying tools leveraged during the attack. Tools such as Event Log Explorer , KAPE , EZ Tools , and Registry Explorer were utilized to conduct this investigation. The analysis focused on uncovering tactics associated with initial access, execution, privilege escalation, defense evasion, and data exfiltration. This report provides insights into the attacker’s methodology and highlights actionable recommendations for mitigating similar incidents in the future.

Analysis

Q1 Knowing the IP address of the machine that initiated the attack helps trace the attack's origin. What is the IP address of the attacker's machine?

Upon analyzing the event logs with Event Log Explorer , I filtered entries based on Event ID 4624 , which corresponds to successful logons. My investigation specifically focused on logon type 10 , indicative of a remote interactive logon, often associated with Remote Desktop Protocol (RDP) access. The logs revealed a suspicious connection on June 30, 2024, at 11:26:57 AM, originating from the IP address 192.168.19.100 .

This IP address, falling outside the organization’s subnet, immediately raised concerns about unauthorized access. Further examination of this log entry indicated that the compromised account used was Hanii_IT, warranting additional investigation into the account's activities and permissions to determine the scope of compromise

Q2 Knowing the account used by the attacker helps track activities and identify compromised accounts. What is the SID of the account the attacker used to gain initial access on the vic…