Forensic Analysis of Own Ransomware: Cryptographic Deconstruction of the .own Extension, Lineage Ties, and Data Restoration Pathways

The discovery of files appended with complex parameters such as .EMAIL=[owndecrypt@gmail.com]ID=[8AB3A4D0C24E2B79].own indicates an active breach by Own Ransomware. Discovered during routine technical sweeps of new malware submissions on VirusTotal, this variant represents an iteration of the well-documented ONI / Doina ransomware family. It shares structural assembly patterns, process-killer scripts, and core encryption routines with sister strains such as Qv, Hype, Electronic, and NoMatter.

Upon gaining access to a target system, Own Ransomware systematically scans logical drive arrays, network-attached storage (NAS) units, and mapped shares. It locks critical user documents, databases, images, and archives, dropping a plain-text extortion note titled own Ransomware.txt across processed directories. The operators rely on dual email contact points (owndecrypt@gmail.com and owndecrypt@hotmail.com) alongside direct Telegram interaction (@decdata) to conduct ransom negotiations. This comprehensive technical document breaks down the threat’s execution chain, cryptographic framework, and laboratory-grade recovery options.

1. Threat Intelligence & Artifact Signature Matrix

Isolating Own Ransomware and halting lateral propagation across enterprise Active Directory domains requires precise identification of its operational signatures:

2. Architectural Dissection & Execution Chain

Own Ransomware follows a structured execution chain designed to blind local system defenses and purge offline recovery points prior to file locking.

Phase 1: Initial Access & Persistence Mapping

The malware typically enters host environments through spear-phishing emails containing malicious document macros, trojanized software installers, or brute-forced Remote Desktop Protocol (RDP) sessions. Upon execution, the payload checks local privileges and attempts token elevation to achieve NT AUTHORITY\SYSTEM rights. It creates persistence entries within the Windows Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to ensure execution survives soft system restarts.

Phase 2: Shadow Copy Demolition & Service Neutralization

To eliminate native Windows system rollback options, Own Ransomware launches hidden administrative command threads that execute the following destructive commands:

vssadmin.exe delete shadows /all /quiet
wmic.exe shadowcopy delete
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled No

Concurrently, the malware scans active process lists via CreateToolhelp32Snapshot, killing database services (SQL, Exchange, Oracle) and backup agents to release active file locks, ensuring full access to enterprise files.

3. Cryptographic Pipeline Analysis

Like most modern variants within the ONI/Doina lineage, Own Ransomware utilizes a hybrid encryption scheme that pairs a fast symmetric stream or block cipher with asymmetric public-key wrapping.

Mathematical Encryption Blueprint

For each target file $P_{file}$, the malware generates a temporary, unique symmetric key $k$ (utilizing AES-256 or ChaCha20). The original file content is encrypted in memory and written back to disk:

The local symmetric key $k$ is then encrypted using the threat actor’s master public RSA key $(e, n)$ embedded within the malware payload:

The encrypted key package $K_{enc}$, along with the generated victim ID string, is appended to the end of the file. The original filename is then altered to include the contact email, victim ID, and the final .own extension tag.

4. MITRE ATT&CK Matrix Mapping

The behavioral tactics and execution footprints of Own Ransomware map directly to standard MITRE ATT&CK enterprise classifications:

5. Verbatim Ransom Note Reference Log

Confirm that the operational instructions and contact parameters deposited across your compromised infrastructure match the official own Ransomware.txt log transcribed below:

6. Enterprise Containment & Recovery Playbook

If an endpoint or server displays active signs of an Own Ransomware infection, execute the following containment playbook immediately:

1. Isolate Network Interfaces: Immediately disconnect infected host systems from local switches and Wi-Fi networks. Isolate virtual network adapters in ESXi or Hyper-V environments to halt lateral spread.
2. Preserve Volatile Memory (RAM): Do not power down host servers immediately. Run administrative memory capture tools (such as DumpIt or FTK Imager) to capture volatile RAM dumps, preserving raw symmetric keys before they are flushed.
3. Clean Persistence Hooks: Remove malicious registry keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and terminate suspicious parent processes executing out of AppData\Local\Temp\.

7. Institutional Laboratory Recovery Options

Recovering from an Own Ransomware attack without paying extortionists requires systematic, lab-controlled data restoration:

• Sector-Level Drive Cloning: All physical and virtual disks are mirrored sector-by-sector using hardware write-blockers. All analysis and file carving tasks take place exclusively on these duplicate images.
• Unallocated MFT Carving: Because ransomware frequently writes new encrypted files to disk before deleting originals, intact original file blocks often linger in unallocated MFT sectors. Deep byte-level carving can extract these files directly.
• Database Structure Reconstruction: For large database containers (like SQL .mdf files), specialized laboratory carving scripts scan raw sectors for untouched 8KB data pages, restoring critical tables and operational schemas.