A review on spreading and Forensics Analysis of Windows-Based ransomware

Ransomware is one of the most advanced malware which uses high computer resources and services to encrypt system data once it infects a system and causes large financial data losses to the organization and individuals. There are certain automatic ransomware detection and analysis strategies available nowadays. File system analysis reveals some essential patterns and artifacts that can be very useful to understand its behavior spreading mechanism, taxonomy for malware forensics experts. Current trend explores Ransomware as a service (RaaS) and Malware as a service (MaaS) on Darknet. This paper reveals a theory of digital forensic methodology to identify the spreading/infection mechanism and attack path, the cryptographic methodology, windows services, process, APIs, persistence mechanism, and system lockdown strategies and malware analysis methodology. This review could be helpful to learn and understand malware forensic analysis for threat researchers, students, cyber experts, etc.