  Ransomware, a class of self-propagating malware that uses encryption to hold
the victims' data ransom, has emerged in recent years as one of the most
dangerous cyber threats, with widespread damage; e.g., zero-day ransomware
WannaCry has caused world-wide catastrophe, from knocking U.K. National Health
Service hospitals offline to shutting down a Honda Motor Company in Japan[1].
Our close collaboration with security operations of large enterprises reveals
that defense against ransomware relies on tedious analysis from high-volume
systems logs of the first few infections. Sandbox analysis of freshly captured
malware is also commonplace in operation.
  We introduce a method to identify and rank the most discriminating ransomware
features from a set of ambient (non-attack) system logs and at least one log
stream containing both ambient and ransomware behavior. These ranked features
reveal a set of malware actions that are produced automatically from system
logs, and can help automate tedious manual analysis. We test our approach using
WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox
during both ambient, and ambient plus ransomware executions. Our goal is to
extract the features of the malware from the logs with only knowledge that
malware was present. We compare outputs with a detailed analysis of WannaCry
allowing validation of the algorithm's feature extraction and provide analysis
of the method's robustness to variations of input data\textemdash changing
quality/quantity of ambient data and testing polymorphic ransomware. Most
notably, our patterns are accurate and unwavering when generated from
polymorphic WannaCry copies, on which 63 (of 63 tested) anti-virus (AV)
products fail.
