Ransomware on an accounting workstation: from an attachment to 295 locked files

01Session plan

Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →

02Answer key

1. Q011 point

   On a copy of usn-journal.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.

   Answer19403d70

   The prefix matches the manifest line. The journal is the file you will filter and count most; hash the copy you work on, not only the original.

   Where

   manifest.txt, the usn-journal.csv line.

   Usual mistake

   Hashing the file after a spreadsheet has reformatted the long USN numbers and saved it.

   Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration

2. Q022 points

   When did the mail gateway accept the message with the disk-image attachment for d.ercan? Give the time in UTC.

   Answer2026-06-16 06:58:12

   The gateway row reads 09:58:12 in local time (UTC+3), so the message was accepted at 06:58:12 UTC. The USN journal shows Outlook's data file being written in the same UTC second, which ties the two clocks together.

   Where

   mail-gateway.csv, the row for d.ercan with Fatura_Haziran_2026.iso; export-metadata.txt, export 5; usn-journal.csv, the .ost row at 06:58:12.

   Usual mistake

   Copying 09:58:12 as UTC because the gateway log does not say otherwise in the row.

   E-mail header fields (Received, Date, From, Message-ID)Local time to UTC

3. Q031 point

   How many mailboxes received an attachment with the same SHA-256 as the one d.ercan received?

   Answer4

   Filter mail-gateway.csv on the attachment_sha256 of the .iso: four recipients within two seconds, all delivered with the verdict clean. Three other mailboxes hold the same file and should be checked today; this is the first containment step the report should name.

   Where

   mail-gateway.csv, attachment_sha256 and recipient columns.

   Usual mistake

   Searching by subject or sender only, or counting only the mailbox of the affected user.

4. Q041 point

   The process started from the disk image downloads a file. From which address?

   Answer203.0.113.45

   At 07:04:31 cmd.exe starts with CurrentDirectory E:\, the mounted image, and parent explorer.exe: the user opened a shortcut inside the image. Its PowerShell child connects to 203.0.113.45:80 and writes C:\Users\Public\k.dat a second later; rundll32.exe then loads k.dat and contacts the same address on port 443 about every five minutes.

   Where

   sysmon-events.csv, event 1 at 07:04:31 and 07:04:32, event 3 at 07:04:33, event 11 at 07:04:34.

   Usual mistake

   Giving the mail server address of Outlook's connections, or the sender's domain.

   Windows XML Event Log (EVTX)

5. Q052 points

   When was Microsoft Defender's real-time protection switched off? UTC.

   Answer2026-06-16 09:31:03

   Event 5007 records DisableRealtimeMonitoring changing from 0x0 to 0x1 and event 5001 follows in the same second. Sysmon shows the cause one second earlier: powershell.exe at High integrity running Set-MpPreference -DisableRealtimeMonitoring $true.

   Where

   defender-events.csv, events 5007 and 5001; sysmon-events.csv, powershell.exe at 09:31:02.

   Usual mistake

   Giving the detection time 09:20:44, which is when Defender was still working.

6. Q062 points

   Defender detected and quarantined a ransomware file at 09:20. Why did encryption still begin twenty minutes later?

   AnswerB — The quarantine worked, but the implant that dropped the file was never detected; it gained High integrity, switched real-time protection off at 09:31:03 and brought the tool back as C:\ProgramData\Intel\igfx.exe, which nothing scanned.

   Event 1117 reports a successful quarantine and the USN journal shows kl.exe deleted and a quarantine resource written at 09:20:45. The loader k.dat in rundll32.exe was never detected. The signatures had been updated at 08:21 that morning; what was missing was real-time protection, switched off before igfx.exe arrived at 09:33:15.

   Where

   defender-events.csv, 1116, 1117, 2000 and 5001; usn-journal.csv, kl.exe and igfx.exe rows; sysmon-events.csv, event 11 at 09:33:15.

   Usual mistake

   Concluding that the antivirus failed, when the records show it was switched off.

7. Q071 point

   Which program wrote the ransom notes? Give the full path.

   Answerc:\programdata\intel\igfx.exe

   Every Sysmon event 11 for OKU_BENI.txt has the image C:\ProgramData\Intel\igfx.exe and the same process ID, the process started at 09:41:30 with the arguments --yol C:\Users\d.ercan --ag. The folder name imitates a graphics driver.

   Where

   sysmon-events.csv, event 11 rows for OKU_BENI.txt and event 1 at 09:41:30.

   Usual mistake

   Answering kl.exe, which had been quarantined twenty minutes earlier.

   Windows XML Event Log (EVTX)

8. Q082 points

   The implant ran at Medium integrity, but vssadmin.exe and igfx.exe ran at High. Which reading do the files support?

   AnswerC — The ms-settings handler under HKCU was pointed at a PowerShell script and fodhelper.exe, which elevates without a prompt for administrators, started it at High integrity; the elevated processes carry the user's elevated logon ID 0x2C41A07.

   Sysmon 13 records the two registry values at 09:27:49 and 09:27:50, fodhelper.exe starts at High integrity at 09:27:51 and its child is the PowerShell script; Sysmon 12 shows the key removed at 09:28:20. The user was locked out of the desk from 09:05:12 to 10:11:48 (4800 and 4801), so no prompt was answered. The two logon IDs come from the same sign-in at 06:28:40: 0x2C41A3E filtered, 0x2C41A07 elevated.

   Where

   sysmon-events.csv, events 13, 1 and 12 between 09:27:48 and 09:28:20; security-events.csv, the two 4624 rows at 06:28:40 and 4800/4801.

   Usual mistake

   Reading two logon IDs for one user as two people or two sessions.

9. Q091 point

   Which program deleted the volume shadow copies? Give the file name.

   Answervssadmin.exe

   At 09:40:05 vssadmin.exe delete shadows /all /quiet runs at High integrity under the elevated PowerShell. wbadmin.exe deletes the backup catalog four seconds later and bcdedit.exe turns off Windows recovery: three steps that remove the ways back before encryption starts.

   Where

   sysmon-events.csv, event 1 rows at 09:40:05, 09:40:09 and 09:40:12.

   Usual mistake

   Answering wbadmin.exe, which deletes the backup catalog, not the shadow copies.

   Volume Shadow Copies

10. Q102 points

    When was the first file renamed with the extension .kilit? UTC.

    Answer2026-06-16 09:41:33

    The first RenameNewName record with the extension .kilit is in Documents\Muhasebe\2025, a second after the first note was created in the same folder. The same entry number was overwritten (DataOverwrite) a fraction of a second before: the content was replaced in place, then the name changed.

    Where

    usn-journal.csv, filter UpdateReasons = RenameNewName and Extension = .kilit, first row.

    Usual mistake

    Giving the start of igfx.exe (09:41:30) or the first note (09:41:32) as the first encrypted file.

    $UsnJrnl:$J (USN change journal)

11. Q112 points

    How many files on C: were renamed with the extension .kilit?

    Answer295

    Each rename writes RenameNewName and then RenameNewName|Close with the same entry and sequence number, so 590 rows carry the new name. Counting distinct EntryNumber and SequenceNumber pairs, or rows whose UpdateReasons is exactly RenameNewName, gives 295 files. Nine other RenameNewName rows that morning are Excel saving workbooks through a temporary file and have nothing to do with the encryption.

    Where

    usn-journal.csv, Extension, UpdateReasons, EntryNumber and SequenceNumber.

    Usual mistake

    Counting rows that contain .kilit (590), or every RenameNewName in the file (304).

    $UsnJrnl:$J (USN change journal)

12. Q121 point

    In how many folders was a ransom note created?

    Answer15

    Fifteen FileCreate records for OKU_BENI.txt in the journal, each in a different folder, and fifteen Sysmon 11 events by igfx.exe. The sixteenth Sysmon row that names the note is notepad.exe at 10:14:05: the user opening it, not the tool writing it.

    Where

    usn-journal.csv, Name = OKU_BENI.txt and UpdateReasons = FileCreate; sysmon-events.csv, event 11.

    Usual mistake

    Counting every row that mentions OKU_BENI.txt.

13. Q132 points

    The USN journal does not record which process made a change. What ties the .kilit renames to igfx.exe?

    AnswerC — The renames start three seconds after igfx.exe starts, each folder's burst follows a note that Sysmon attributes to igfx.exe in the same second, and they end eight seconds before igfx.exe connects to the file server: timing and the notes tie the two, the journal alone does not.

    The link is an inference from two sources, and the report should say so: no other process was started in that window, the notes are attributed by Sysmon, and the journal gives the files and the order. An extension proves nothing about a process.

    Where

    usn-journal.csv, the .kilit rows; sysmon-events.csv, igfx.exe events 1, 11 and 3.

    Usual mistake

    Writing that the journal shows igfx.exe renaming the files.

    $UsnJrnl:$J (USN change journal)SOP-08 Examination notes and working record

14. Q142 points

    How many whole minutes passed between the start of the chain from the disk image and the first .kilit rename?

    Answer157

    From cmd.exe in E:\ at 07:04:31 to the first rename at 09:41:33 is 2 hours, 37 minutes and 2 seconds: 157 whole minutes. Both times are UTC, so they can be subtracted directly. The window shows discovery at 08:47, a first attempt at 09:20 and the preparation that followed; it is the time in which detection of the loader would have stopped the encryption.

    Where

    sysmon-events.csv, event 1 at 07:04:31 with CurrentDirectory E:\; usn-journal.csv, first .kilit RenameNewName.

    Usual mistake

    Starting from the gateway time in local time, or from the attachment being saved.

15. Q152 points

    The note says files on connected shares were encrypted too. What can this pack say about \\KZL-FS02\Muhasebe?

    AnswerC — igfx.exe opened an SMB connection to 192.0.2.20:445 at 09:55:06 and the share was mapped for the user (net use at 08:50:31); whether and which files there were changed can only be shown from KZL-FS02's own file system and logs, which were not collected.

    The journal of C: cannot record changes on another computer's volume, and a ransom note is the attacker's claim. The workstation shows a connection and a mapped drive; the server must be examined for the rest, and the report should ask for it.

    Where

    sysmon-events.csv, igfx.exe event 3 to port 445 and net use at 08:50:31; export-metadata.txt, Not in this pack.

    Usual mistake

    Treating the ransom note as evidence of what was encrypted.

16. Q162 points

    Which sentence could the examiner sign from these files alone?

    AnswerC — At 07:04:31 UTC a shortcut in the disk image Fatura_Haziran_2026.iso, delivered to four mailboxes at 06:58 UTC, started a loader that contacted 203.0.113.45; while the workstation was locked, the loader elevated through fodhelper.exe, switched off real-time protection at 09:31:03, deleted shadow copies and ran C:\ProgramData\Intel\igfx.exe, after which 295 files on C: were overwritten and renamed .kilit between 09:41:33 and 09:54:58 UTC; the file server was contacted at 09:55:06 but was not examined.

    Sentence c ties each act to a record, uses UTC throughout, counts files rather than rows and states the limit on the server. Sentence a names a person as the actor of the encryption, which happened while the workstation was locked, and claims the server. Sentence b counts rows and calls a switched-off protection a failure. Sentence d confuses recovery with evidence: the journal and the event logs survive the deletion of shadow copies.

    Where

    All five data files; each fact in sentence c comes from one of them.

    Usual mistake

    Writing the story the case suggests instead of the one the records carry.

    F-04 Examination logSOP-09 Reporting and peer review

03Reconstructed timeline

The timeline as the correct answers build it. Local time is UTC+3.

04Scoring

Questions 1–11 carry one point each and question 12 carries three: 26 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.

Finding paragraph: criteria

• Every time carries its basis; the gateway time and the note's deadline are converted from local time.
• Files are counted, not rows, and Excel's own renames are kept out of the count.
• The link between the journal and the process is stated as an inference from timing and Sysmon, not as something the journal shows.
• The report says the protection was switched off, names how, and does not call it a detection failure.
• The report names the three other mailboxes and asks for the file server to be examined.

05Debrief

1. Ransomware is the last step. The two and a half hours before it are where it could have been stopped, and where the evidence of how it came in lies.
2. A quarantine is not a containment. The question is always what dropped the file.
3. The USN journal is the best record of what was encrypted and in what order, and it never names the process. Say that in the report.
4. A ransom note is the attacker's account. Treat what it says about shares and data as a claim to test.

06Model finding

On 16 June 2026 the mail gateway accepted a message with the attachment Fatura_Haziran_2026.iso for four mailboxes at 06:58 UTC (mail-gateway.csv, 09:58 local). On KZL-MUH07, at 07:04:31 UTC, cmd.exe started from the mounted image (CurrentDirectory E:\) and PowerShell downloaded k.dat from 203.0.113.45, which rundll32.exe loaded and which contacted that address about every five minutes until 10:27 (sysmon-events.csv). Defender quarantined C:\Users\Public\svc\kl.exe at 09:20:45. While the workstation was locked (09:05:12 to 10:11:48, security-events.csv), a PowerShell script was started at High integrity through fodhelper.exe at 09:27:51, real-time protection was switched off at 09:31:03 (defender-events.csv), C:\ProgramData\Intel\igfx.exe was written at 09:33:15 and shadow copies were deleted at 09:40:05. Between 09:41:33 and 09:54:58 UTC 295 files on C: were overwritten and renamed with the extension .kilit, and a note was created in 15 folders (usn-journal.csv); the notes are attributed to igfx.exe by Sysmon, and the renames are tied to it by timing. igfx.exe connected to 192.0.2.20:445 at 09:55:06. The file server was not collected; whether files on \\KZL-FS02\Muhasebe were changed cannot be stated from this pack.

Report anatomy and confidence scale →