Ransomware Simulation Explained : Beginner to Expert Level

This simulated log dataset represents a full human-operated ransomware intrusion, showing how the attack would realistically appear across authentication logs, endpoint telemetry, network logs, and file system events. The key takeaway is that the ransomware execution is the final step, while most detectable activity happens days earlier.

Phase 1 — Initial Access (Credential / Phishing)

  • A service account successfully logs in via remote access (VPN/RDP) from an unfamiliar external IP during non-business hours.
  • This is the first high-confidence indicator of compromise.
  • No malware is visible yet; access is obtained using valid credentials.

🔐 VPN / RDP Authentication Logs

Timestamp: 2022-04-14 02:17:43
EventID: 4624
LogonType: 10 (RemoteInteractive)
AccountName: svc_finance
SourceIP: 185.203.xxx.xxx
AuthenticationPackage: Negotiate
Status: Success
WorkstationName: VPN-GW-01

⚠️ Red flags

  • Service account used interactively
  • Login time outside business hours
  • New external IP never seen before

Phase 2 — Command Execution & Persistence

🖥️ Endpoint Process Creation (EDR / Sysmon)

  • An email client spawns hidden, encoded PowerShell, indicating post-phishing execution.
  • A scheduled task is created with a legitimate-looking name but launches a malicious DLL.
  • Persistence is established quietly to survive reboots.
EventID: 4688
ParentProcess: outlook.exe
NewProcess: powershell.exe
CommandLine:
powershell.exe -nop -w hidden -enc JABXAF...
User: svc_finance

⚠️ Red flags

  • Encoded PowerShell
  • Outlook spawning PowerShell
  • Hidden window + no profile

🗂️ Scheduled Task Creation

EventID: 4698
TaskName: \Windows\UpdateCheck
Author: svc_finance
Action:
C:\Windows\System32\rundll32.exe
C:\ProgramData\syscache.dll,Start

⚠️ Red flags

  • Masquerading task name
  • DLL execution via rundll32
  • Non-standard DLL location

Phase 3 — Internal Reconnaissance

🧭 Active Directory Enumeration

  • The compromised account enumerates Active Directory objects and admin shares (ADMIN$).
  • Access patterns indicate mapping of servers and trust relationships.
EventID: 4662
ObjectType: DomainDNS
AccessMask: 0x10
SubjectUserName: svc_finance
ObjectName: DC01.gov.local
*************************************
EventID: 5140
ShareName: \\*\ADMIN$
ClientAddress: 10.10.4.23
AccountName: svc_finance

⚠️ Red flags

  • ADMIN$ access
  • Service account enumerating AD
  • Broad share enumeration

Phase 4 — Credential Dumping

🔑 LSASS Access Attempt

  • A non-security process attempts to access LSASS memory, a strong indicator of credential dumping.
  • Attackers gain administrative-level credentials, enabling unrestricted movement.
EventID: 10 (Sysmon)
SourceProcess: C:\Windows\System32\rundll32.exe
TargetProcess: lsass.exe
GrantedAccess: 0x1fffff
User: svc_finance

⚠️ Red flags

  • LSASS memory access
  • Non-security tool accessing lsass
  • Full access mask

Phase 5 — Lateral Movement

🔄 Remote Service Creation (PsExec-style)

  • New services are created remotely on multiple server.
  • Administrative credentials are reused across systems via SMB.
  • Multiple internal logons originate from a single compromised host.
EventID: 7045
ServiceName: WindowsUpdateSvc
BinaryPath:
\\10.10.8.12\ADMIN$\update.exe
ServiceAccount: LocalSystem
*****************************************************
EventID: 4624
LogonType: 3 (Network)
AccountName: administrator
SourceIP: 10.10.4.23
TargetHost: FILE-SRV-02

⚠️ Red flags

  • Service creation from remote host
  • Admin credentials reused
  • SMB-based lateral movement

Phase 6 — Data Staging & Exfiltration

📦 File Compression Activity

  • Large volumes of sensitive files are compressed locally.
  • Multi-gigabyte encrypted outbound traffic flows to unknown destinations.
EventID: 4688
Process: powershell.exe
CommandLine:
Compress-Archive -Path D:\Finance\* -DestinationPath C:\Temp\fin_0422.zip

🌐 Large Outbound Transfer (Firewall / Proxy)

Timestamp: 2022-04-18 01:43:22
SourceIP: 10.10.8.12
DestinationIP: 89.147.xxx.xxx
DestinationPort: 443
BytesSent: 4.7 GB
Protocol: TLS
SNI: unknown

⚠️ Red flags

  • Large encrypted transfer
  • Non-business destination
  • Occurs before ransomware

Phase 7 — Pre-Encryption Destruction

🧨 Backup & Recovery Removal

  • Shadow copies and system recovery options are deliberately disabled.
  • These commands precede ransomware execution by minutes to hours.
EventID: 4688
Process: vssadmin.exe
CommandLine:
vssadmin delete shadows /all /quiet
****************************************************************
EventID: 4688
Process: bcdedit.exe
CommandLine:
bcdedit /set {default} recoveryenabled No

⚠️ Red flags

  • Shadow copy deletion
  • Recovery disabled
  • Strong ransomware precursor

Phase 8 — Ransomware Execution

🔐 Mass File Encryption

  • Mass file write/rename operations occur at high speed.
  • Unknown executables encrypt files and drop ransom notes.
  • Multiple systems encrypt simultaneously, indicating centralized control.
EventID: 4663
ObjectName: D:\Finance\budget.xlsx
AccessMask: WriteData
ProcessName: C:\ProgramData\winhost.exe
*******************************************
EventID: 4663
ObjectName: D:\Finance\budget.xlsx.conti
AccessMask: WriteData

⚠️ Red flags

  • Rapid rename/write cycles
  • Unknown executable
  • High file entropy

📝 Ransom Note Creation

EventID: 4663
ObjectName: D:\Finance\README_CONTI.txt
ProcessName: C:\ProgramData\winhost.exe

Phase 9 — Domain-Wide Impact

🧨 Group Policy Push (Optional but Observed in Some Cases)

  • Potential Group Policy changes allow rapid execution across systems.
  • Critical government services become unavailable nearly at once.
EventID: 5136
ObjectModified: CN={GPO-ID}
Attribute: gPCMachineExtensionNames
ModifiedBy: Administrator

⚠️ Red flags

  • GPO changes during incident
  • Used for mass execution

Phase 10 — Aftermath Indicators

  • Earliest reliable detections: credential misuse, PowerShell abuse, LSASS access
  • Most damaging phase: data exfiltration, not encryption
  • Root cause: identity and privilege control failure
  • Encryption is the final symptom, not the initial problem