ZEKASTRA case pack VP-06 - Ransomware on an accounting workstation - SYNTHETIC TRAINING DATA
The organisation, people, hosts, accounts, messages and times are invented. Domains end in .example (RFC 2606) and every IP address is from a documentation range (RFC 5737).

Scenario (EN)
Kuzey Lojistik A.S. runs a Windows 11 accounting workstation, KZL-MUH07 (192.0.2.57), used by d.ercan, who is also a member of the local Administrators group. On Tuesday 16 June 2026, back from lunch, the user found a new wallpaper, a note called OKU_BENI.txt on the desktop and documents whose names ended in .kilit. The IT desk disabled the network port and an incident response examiner collected the files in this pack. The company asks: how did it start, when, what ran, what was encrypted on this computer, why did the antivirus not stop it, and what can and cannot be said about the shared accounting folder.

Senaryo (TR)
Kuzey Lojistik A.Ş., d.ercan'ın kullandığı KZL-MUH07 (192.0.2.57) adlı bir Windows 11 muhasebe iş istasyonu işletir; kullanıcı aynı zamanda yerel Administrators grubunun üyesidir. 16 Haziran 2026 Salı günü öğle arasından dönen kullanıcı yeni bir masaüstü resmi, masaüstünde OKU_BENI.txt adlı bir not ve adları .kilit ile biten belgeler buldu. BT masası ağ kapısını kapattı ve bir olay müdahale incelemecisi bu paketteki dosyaları topladı. Şirket soruyor: nasıl ve ne zaman başladı, ne çalıştı, bu bilgisayarda ne şifrelendi, virüsten koruma neden durdurmadı ve ortak muhasebe klasörü hakkında ne söylenebilir, ne söylenemez?

Files
usn-journal.csv         USN change journal of C:, parsed, times UTC.
sysmon-events.csv       Sysmon events of KZL-MUH07 (1, 3, 11, 12, 13), times UTC.
security-events.csv     Security log of KZL-MUH07, times UTC.
defender-events.csv     Microsoft Defender Antivirus operational events, times UTC.
mail-gateway.csv        Mail gateway message log, LOCAL time UTC+3.
OKU_BENI.txt            The note left on the desktop. Its deadline is written in local time.
export-metadata.txt     Window, time basis and scope of every export. Read it first.
acquisition-log.txt     What was collected, when and how.
manifest.txt            SHA-256 of every file above.

Rules
1. Verify every file against manifest.txt before you read anything else.
2. Write the time basis next to every time you copy out. Convert to UTC before you compare two sources.
3. The USN journal says what changed, not who changed it. Tie a change to a process with another source.
4. What was not collected cannot be described. Say so in the report.