# Rans0mYard **Difficulty:** Hard\ **By:** @W4L33Dx\ **Category:** Forensics\ **Description**:\ Can you help me, I was writing something, and by mistake, I opened ransomware. I want to get my files back please. The challenge download gave me a single file `RansomYard.ad1`. I found out through a quick search that I can open .ad1 files using FTK Imager.

Fig 1: FTK Imager

I analyzed the image to find any suspicious behavior. I discovered that all files were encrypted using some form of encryption.

Fig 2: Encrypted files

I couldn't locate the ransomware initially, but then I realized, 'What if **Windows Defender** quarantined it?.\ And I encountered this excellent write-up about Windows Defender Quarantine at [this link](https://blog.ry4n.org/hackthebox-ctf-confinement-write-up-a4e3b0429e30#2a9e).\ \ I found `RansomYard.exe`. Using `Detect it easy` showed that it was a .NET compiled binary.

Fig 3: DIE output

I opened the `RansomYard.exe` using [**`IlSpy`**](https://github.com/icsharpcode/ILSpy).

Fig 4: IlSpy

Check `RansomYard.cs` and `RansomYard_patched.cs` {% file src="/files/3hA4UhFfFL72h05UxKxb" %} Decompiled **`RansomYard.exe`** {% endfile %} {% file src="/files/Qipm5iHAUnq8mALNheVY" %} `Pathced`**`RansomYard.exe`** {% endfile %} After decrypting all files, we encountered a curious password-protected file named `shop.zip`.

Fig 5: shop.zip

**Using** [**`john`**](https://github.com/openwall/john)**.**

Fig 6: john

While it was cracking, I revisited the description and realized that the victim was writing something when the ransomware attacked! I searched for a bit and found [`this`](https://medium.com/@mahmoudsoheem/new-digital-forensics-artifact-from-windows-notepad-527645906b7b)

Fig 7: Victim writing

Great, we can read it, but let's make it easier to understand.

Fig 8: Victim information

The moment I read it, [CUPP](https://github.com/Mebus/cupp) instantly came to mind.

Fig 9: CUPP

Nice!, we cracked the password :D

Fig 10: Cracked

Let's proceed to read the contents of `important.txt` and thankfully it was the flag YAY! **FlagY{Y0u\_D3t3c7\_MY\_R4ns0m\_Am4z1ng!!!}** --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://iq0.gitbook.io/iq0/b/rans0myard.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.