ransomware-acme-corp — reference investigation
ACME Corp is a 280-endpoint healthcare MSP serving fourteen small clinics. Initial access came via a phished MFA token against the IT director six days before encryption. Dwell included BloodHound recon, PsExec lateral movement, Cobalt Strike beaconing, shadow-copy deletion, and Veeam backup tampering. Encryption onset was 2026-03-12 02:14 UTC with a BlackCat/ALPHV ransom note. All data is synthetic.
what this proves
- every primary engine produces deterministic, fixture-locked output — verified by
npm run check:flagship(8/8). - every output is generated 100% locally in your browser — no upload, no server-side processing of your evidence.
- the full case binder is built from these outputs without uploading a single byte — click below to generate it locally.
primary engines locked to this fixture
build the case binder
one click runs all eight primary engines on the synthetic evidence, assembles findings into a self-contained html binder, and opens it in a new tab. print to pdf from there — still zero upload.
runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload
download the synthetic evidence
MIT-licensed, fully synthetic, safe to attach to a PR or send to a reviewer. Compare your local runs against the published goldens.
built deterministically from scripts/fixtures/build-ransomware-acme-corp.mjs. seed: ransomware-acme-corp:v1.
methodology
ransomware response is not “malware response.” the first 48 hours are about scoping, finding patient-zero, and preserving evidence before the actor wipes logs. start with the encryption onset timer, then walk the staging → lateral → backup → rename → note → family → exfil path. read the full ransomware response guide →
after the playbook
run each primary locally — or export findings from the binder — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across encryption onset, staging, lateral movement, and exfil — still zero upload.