Full Diagnostic Tree & Step-by-Step Overview
What is the current state of the ransomware incident?
- Files are actively encrypting, network shares changing, or a rogue process is running
- Encryption has finished, ransom note is displayed, or system files are modified
- System is locked at boot screen, MBR modified, or Windows lockscreen hijacked
Which immediate containment priority applies to the active infection?
- Active network traffic or shared storage files are being encrypted across network shares
- Local endpoint is executing an unauthorized encryption process or binary
Isolate Network Interfaces & SMB Shares
Solution:
Root Cause: Active Ransomware Network Propagation
Wormable malware or automated scripts propagating laterally via SMB shares and compromised network credentials.
# Step-by-Step Fix:
Disconnect Network Adapters Immediately:Unplug physical Ethernet cables.Disable Wi-Fi via CLI: netsh interface set interface "Wi-Fi" disableUnmount Network Drives & Block Port 445:Disconnect mapped drives: net use * /delete /yesBlock incoming SMB traffic: netsh advfirewall firewall add rule name="Block SMB" dir=in action=block protocol=TCP localport=445Preserve Volatile Memory:Do not restart or shut down cleanly if RAM analysis is required; put device in Hibernate or force power-off.
Halt Encryptor Executable & Preserve Process Payload
Solution:
Root Cause: User-Space Encryptor Execution
A active payload executing symmetric/asymmetric cryptographic calls against local disk volumes.
# Step-by-Step Fix:
Suspend Encryptor Process:Open Task Manager (Ctrl + Shift + Esc) -> Go to Details.Right-click high-CPU/disk utilization process -> Select Analyze wait chain or Suspend.Dump Process Artifacts:Right-click suspended process -> Select Create dump file for forensic investigation.Terminate Process:Terminate via CMD: taskkill /F /PID <PID_NUMBER>
What post-encryption recovery path are you evaluating?
- Identify ransomware strain to search for publicly available decryptors
- Verify state of local shadow copies and offsite/cloud backups
Identify Strain & Check Decryptor Availability
Solution:
Root Cause: Static Encryption Completed
Payload execution finished and generated ransom note artifacts containing extension markers.
# Step-by-Step Fix:
Identify Ransomware Family:Upload ransom note and sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com).Check Official Decryption Services:Query the No More Ransom Project database (nomoreransom.org) for validated key-recovery utilities.Preserve System Logs:Export Windows Event Logs (C:\Windows\System32\winevt\Logs) and ransom notes to isolated external media.
Evaluate Backup Integrity & Prepare System Wipe
Solution:
Root Cause: Volume Shadow Copy Deletion & Backup Exposure
Ransomware commands like vssadmin delete shadows /all /quiet wipe local recovery points.
# Step-by-Step Fix:
Check Local Shadow Copies:Open Admin CMD and run: vssadmin list shadowsVerify Offline/Immutable Backups:Confirm secondary backups (air-gapped or read-only cloud targets) were not mounted during attack execution.Wipe Disks Before Restore:Perform full disk format/re-image to remove hidden persistence mechanisms before restoring data.
Which boot or screen locking mechanism is preventing OS access?
- Master Boot Record (MBR) modified or custom bootloader ransom screen displayed
Remediate MBR Bootlocker & Restore Winlogon Shell
Solution:
Root Cause: Overwritten MBR or Winlogon Registry Hijack
Ransomware modified boot sector code or replaced default Windows desktop shell (explorer.exe).
# Step-by-Step Fix:
Boot into Windows Recovery Environment (WinRE):Boot system via USB installer -> Click Repair your computer -> Troubleshoot -> Command Prompt.Repair Boot Sector:Execute: bootrec /fixmbrExecute: bootrec /fixbootExecute: bootrec /rebuildbcdReset Winlogon Registry Shell:Load registry hive (regedit) -> Load SOFTWARE hive from C:\Windows\System32\config.Set Winlogon\Shell value to explorer.exe.