{
  "event_type": "ransomware_simulation",
  "version": "2.0",
  "victim_id": "60D682CC526DFF6E",
  "timestamp": "2026-09-06T15:17:30.046856",
  "elapsed_seconds": 86.06,
  "target_directory": "C:\\Users\\27963\\Desktop",
  "simulate_mode": false,
  "statistics": {
    "files_discovered": 4,
    "files_encrypted": 4
  },
  "mitre_attack": {
    "T1083": "File and Directory Discovery",
    "T1486": "Data Encrypted for Impact",
    "T1547.001": "Boot/Logon Autostart: Registry Run Keys",
    "T1053.005": "Scheduled Task",
    "T1490": "Inhibit System Recovery",
    "T1562.001": "Disable/Modify Tools",
    "T1552.001": "Credentials In Files",
    "T1003.002": "Security Account Manager",
    "T1046": "Network Service Discovery",
    "T1021.002": "SMB/Windows Admin Shares",
    "T1021.001": "Remote Desktop Protocol",
    "T1021.003": "Distributed Component Object Model",
    "T1560.001": "Archive Collected Data",
    "T1048.003": "Exfiltration Over Unencrypted Non-C2 Protocol",
    "T1071.004": "DNS",
    "T1491.001": "Internal Defacement",
    "T1489": "Service Stop"
  },
  "iocs": {
    "files": [
      "*.encrypted (4)",
      "C:\\Users\\27963\\Desktop\\README_FOR_DECRYPT.txt",
      "C:\\Users\\27963\\Desktop\\HOW_TO_DECRYPT.txt",
      "C:\\Users\\27963\\Desktop\\README_FOR_DECRYPT.txt"
    ],
    "registry": [
      "HKCU\\...\\Run\\WindowsUpdateService",
      "schtasks: UpdateService"
    ],
    "processes": [],
    "network": [
      "POST http://120.55.69.86:8443/api/heartbeat",
      "192.168.1.1:[80, 8080]",
      "POST http://120.55.69.86:8443/api/scan_result",
      "DNS 363044363832434335323644464636453a343a313531373237.0.exfil.ransomsim-training.local"
    ],
    "services": []
  },
  "event_log": [
    {
      "time": "2026-09-06T15:16:06.342287",
      "phase": "主流程",
      "message": "首次运行 - 执行完整攻击链"
    },
    {
      "time": "2026-09-06T15:16:06.342287",
      "phase": "1-发现",
      "message": "开始扫描: C:\\Users\\27963\\Desktop"
    },
    {
      "time": "2026-09-06T15:16:06.529820",
      "phase": "1-发现",
      "message": "发现 4 个目标文件, 0 个含敏感关键词"
    },
    {
      "time": "2026-09-06T15:16:07.044574",
      "phase": "2-加密",
      "message": "开始加密 4 个文件..."
    },
    {
      "time": "2026-09-06T15:16:07.577010",
      "phase": "2-加密",
      "message": "加密完成，共 4 个文件"
    },
    {
      "time": "2026-09-06T15:16:08.085718",
      "phase": "C2心跳",
      "message": "尝试C2心跳..."
    },
    {
      "time": "2026-09-06T15:16:08.257644",
      "phase": "C2心跳",
      "message": "C2响应: {'commands': [], 'message': 'C2 acknowledged', 'status': 'ok'}"
    },
    {
      "time": "2026-09-06T15:16:08.771220",
      "phase": "3-持久化",
      "message": "建立持久化..."
    },
    {
      "time": "2026-09-06T15:16:09.974565",
      "phase": "3-持久化",
      "message": "注册表Run键已写入"
    },
    {
      "time": "2026-09-06T15:16:12.144726",
      "phase": "3-持久化",
      "message": "计划任务已创建"
    },
    {
      "time": "2026-09-06T15:16:12.649382",
      "phase": "4-规避",
      "message": "执行防御规避..."
    },
    {
      "time": "2026-09-06T15:16:22.546210",
      "phase": "4-规避",
      "message": "删除影卷副本: 成功"
    },
    {
      "time": "2026-09-06T15:16:25.468515",
      "phase": "4-规避",
      "message": "删除影卷副本(WMI): 成功"
    },
    {
      "time": "2026-09-06T15:16:26.007828",
      "phase": "4-规避",
      "message": "禁用系统恢复: 成功"
    },
    {
      "time": "2026-09-06T15:17:07.569641",
      "phase": "4-规避",
      "message": "禁用WinRE: 失败"
    },
    {
      "time": "2026-09-06T15:17:07.585292",
      "phase": "4-规避",
      "message": "Defender禁用失败: [WinError 2] 系统找不到指定的文件。"
    },
    {
      "time": "2026-09-06T15:17:08.313054",
      "phase": "5-凭据",
      "message": "模拟凭据窃取..."
    },
    {
      "time": "2026-09-06T15:17:08.313054",
      "phase": "5-凭据",
      "message": "WiFi配置目录不存在，跳过"
    },
    {
      "time": "2026-09-06T15:17:09.661272",
      "phase": "6-网络发现",
      "message": "扫描内网..."
    },
    {
      "time": "2026-09-06T15:17:09.661272",
      "phase": "6-网络发现",
      "message": "自动检测网段: 192.168.1.0/24 (本地IP: 192.168.1.2)"
    },
    {
      "time": "2026-09-06T15:17:26.603603",
      "phase": "6-网络发现",
      "message": "主机: 192.168.1.1 端口: [80, 8080]"
    },
    {
      "time": "2026-09-06T15:17:26.713005",
      "phase": "6-网络发现",
      "message": "扫描结果已上报C2: 1 台主机"
    },
    {
      "time": "2026-09-06T15:17:27.215728",
      "phase": "7-横向移动",
      "message": "模拟横向移动..."
    },
    {
      "time": "2026-09-06T15:17:27.716317",
      "phase": "8-数据外泄",
      "message": "模拟数据收集与外泄..."
    },
    {
      "time": "2026-09-06T15:17:27.716317",
      "phase": "8-数据外泄",
      "message": "发现 0 个敏感文件"
    },
    {
      "time": "2026-09-06T15:17:27.763268",
      "phase": "8-数据外泄",
      "message": "DNS隧道: 363044363832434335323644464636453a343a313531373237.0.exfil.ransomsim-training.local"
    },
    {
      "time": "2026-09-06T15:17:28.768933",
      "phase": "10-影响",
      "message": "执行影响阶段..."
    },
    {
      "time": "2026-09-06T15:17:28.784635",
      "phase": "10-影响",
      "message": "勒索信: C:\\Users\\27963\\Desktop\\README_FOR_DECRYPT.txt"
    },
    {
      "time": "2026-09-06T15:17:28.784635",
      "phase": "10-影响",
      "message": "勒索信: C:\\Users\\27963\\Desktop\\HOW_TO_DECRYPT.txt"
    },
    {
      "time": "2026-09-06T15:17:28.815884",
      "phase": "10-影响",
      "message": "勒索信: C:\\Users\\27963\\Desktop\\README_FOR_DECRYPT.txt"
    }
  ]
}