Ransomware on an accounting workstation: from an attachment to 295 locked files

01Brief

Kuzey Lojistik A.S. runs a Windows 11 accounting workstation, KZL-MUH07 (192.0.2.57), used by d.ercan, who is also a member of the local Administrators group. On Tuesday 16 June 2026, back from lunch, the user found a new wallpaper, a note called OKU_BENI.txt on the desktop and documents whose names ended in .kilit, and called the IT desk at 10:21 UTC. IT disabled the workstation's switch port at 10:27 UTC. An incident response examiner collected the files in this pack the same afternoon, before the workstation was shut down for imaging. The mail gateway log was exported separately and is in local time.

Internal audit asks:

1. How did the chain start, when, and is anyone else exposed to the same attachment?
2. Why did the antivirus not stop the encryption, and how did the tool get administrator rights?
3. What was encrypted on this computer, by which process, over what period, and what can be said about the share?

Answer from the files only. Name accounts, addresses, hosts, files and processes; do not name people or a criminal group. The file server KZL-FS02 and the share \\KZL-FS02\Muhasebe were not collected: say what this workstation shows about them and stop there.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Write the time basis next to every time you copy out. The mail gateway and the ransom note are local time; everything else is UTC.
• Count files, not rows. Write the filter you used next to every number.
• The USN journal says what changed, not who changed it. Tie a change to a process only through another source.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 26 points.

1. Q011 pointusn-journal.csvmanifest.txt

   On a copy of usn-journal.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.8 hex characters
   Check

2. Q022 pointsmail-gateway.csvusn-journal.csv

   When did the mail gateway accept the message with the disk-image attachment for d.ercan? Give the time in UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

3. Q031 pointmail-gateway.csv

   How many mailboxes received an attachment with the same SHA-256 as the one d.ercan received?A whole number
   Check

4. Q041 pointsysmon-events.csv

   The process started from the disk image downloads a file. From which address?An IPv4 address
   Check

5. Q052 pointsdefender-events.csvsysmon-events.csv

   When was Microsoft Defender's real-time protection switched off? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

6. Q062 pointsdefender-events.csvsysmon-events.csvusn-journal.csv

   Defender detected and quarantined a ransomware file at 09:20. Why did encryption still begin twenty minutes later?

   AThe quarantine failed; the detected file kl.exe is the one that encrypted the documents.BThe quarantine worked, but the implant that dropped the file was never detected; it gained High integrity, switched real-time protection off at 09:31:03 and brought the tool back as C:\ProgramData\Intel\igfx.exe, which nothing scanned.CDefender detections are informational only and never remove files.DThe signatures were out of date, so Defender could not recognise the second file.
   Check

7. Q071 pointsysmon-events.csv

   Which program wrote the ransom notes? Give the full path.A full Windows path
   Check

8. Q082 pointssysmon-events.csvsecurity-events.csv

   The implant ran at Medium integrity, but vssadmin.exe and igfx.exe ran at High. Which reading do the files support?

   AThe user typed an administrator password into a UAC prompt at 09:27.BA new administrator account was created and used for the encryption.CThe ms-settings handler under HKCU was pointed at a PowerShell script and fodhelper.exe, which elevates without a prompt for administrators, started it at High integrity; the elevated processes carry the user's elevated logon ID 0x2C41A07.DThe SYSTEM account ran the encryption through a scheduled task.
   Check

9. Q091 pointsysmon-events.csv

   Which program deleted the volume shadow copies? Give the file name.A file name, e.g. program.exe
   Check

10. Q102 pointsusn-journal.csv

    When was the first file renamed with the extension .kilit? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

11. Q112 pointsusn-journal.csv

    How many files on C: were renamed with the extension .kilit?A whole number
    Check

12. Q121 pointusn-journal.csvsysmon-events.csv

    In how many folders was a ransom note created?A whole number
    Check

13. Q132 pointsusn-journal.csvsysmon-events.csv

    The USN journal does not record which process made a change. What ties the .kilit renames to igfx.exe?

    AThe FileAttributes column, which names the process for each record.BNothing; the renames cannot be tied to any process.CThe renames start three seconds after igfx.exe starts, each folder's burst follows a note that Sysmon attributes to igfx.exe in the same second, and they end eight seconds before igfx.exe connects to the file server: timing and the notes tie the two, the journal alone does not.DThe .kilit extension, which only this tool uses.
    Check

14. Q142 pointssysmon-events.csvusn-journal.csv

    How many whole minutes passed between the start of the chain from the disk image and the first .kilit rename?A whole number of minutes
    Check

15. Q152 pointssysmon-events.csvexport-metadata.txtOKU_BENI.txt

    The note says files on connected shares were encrypted too. What can this pack say about \\KZL-FS02\Muhasebe?

    AAll files on the share were encrypted; the note confirms it.BNothing on the share was touched, because the USN journal of C: shows no share paths.Cigfx.exe opened an SMB connection to 192.0.2.20:445 at 09:55:06 and the share was mapped for the user (net use at 08:50:31); whether and which files there were changed can only be shown from KZL-FS02's own file system and logs, which were not collected.DThe share was encrypted from the file server itself, because the connection came after the local encryption ended.
    Check

16. Q162 pointsusn-journal.csvsysmon-events.csvsecurity-events.csvdefender-events.csvmail-gateway.csv

    Which sentence could the examiner sign from these files alone?

    Ad.ercan opened a malicious attachment and encrypted the company's accounting data, including the file server.BThe antivirus failed to detect the ransomware, which encrypted 590 files.CAt 07:04:31 UTC a shortcut in the disk image Fatura_Haziran_2026.iso, delivered to four mailboxes at 06:58 UTC, started a loader that contacted 203.0.113.45; while the workstation was locked, the loader elevated through fodhelper.exe, switched off real-time protection at 09:31:03, deleted shadow copies and ran C:\ProgramData\Intel\igfx.exe, after which 295 files on C: were overwritten and renamed .kilit between 09:41:33 and 09:54:58 UTC; the file server was contacted at 09:55:06 but was not examined.DBecause the shadow copies were deleted, the order of events on the workstation cannot be established.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis; the gateway time and the note's deadline are converted from local time.
• Files are counted, not rows, and Excel's own renames are kept out of the count.
• The link between the journal and the process is stated as an inference from timing and Sysmon, not as something the journal shows.
• The report says the protection was switched off, names how, and does not call it a detection failure.
• The report names the three other mailboxes and asks for the file server to be examined.

How findings are phrased →