Digital forensics methods for recovering ransomware encryption keys
Μέθοδοι ψηφιακής εγκληματολογίας για την ανάκτηση κλειδιών κρυπτογράφησης ransomware
Master Thesis
Author
Tassios, Paraskevas
Τάσσιος, Παρασκευάς
Date
2024-07View/ Open
Keywords
Digital forensics ; Ransomware ; Frida tool ; Memory forensics ; CryptoAPI hookingAbstract
Ransomware has steadily increased in scale, cost, complexity, and impact since it first appeared
nearly 35 years ago. Security experts are constantly engaged in a battle with ransomware
developers, striving to protect their digital infrastructure from these attacks. Recent variants of
ransomware have begun using a combination of symmetric and asymmetric encryption to lock
users' files.This master thesis investigates whether digital forensic techniques can be used to
uncover the encryption keys utilized by such malicious software. To conduct this research, a secure
and isolated virtual environment was set up where various ransomware samples were executed.
Memory from the infected systems was then captured and examined using two different forensic
tools to identify the symmetric encryption keys used by the ransomware. Additionally, an alternative
method involving CryptoAPI hooking with the Frida tool was employed when memory forensics did
not yield results.The study tested ransomware samples including Jigsaw, NotPetya, Thanos,
Gpcode, WannaCry, and Phobos on two different operating systems. These samples were selected
due to their high-profile nature, significant ransom demands, and substantial disruption to numerous
organizations.The investigation successfully demonstrated that it is possible to discover the
encryption keys used by these ransomware samples. The findings, along with the challenges faced
during the investigation, are presented in this thesis.