Four days ago my PC got phobos ransomware. I didn’t notice until three days ago, and the reason is that the attack stopped midway, leaving some of my data as it is and not leaving behind any ransom note or something like that.
Now, when I noticed the attack, I panicked so much, that I did two stupid mistakes. First, I deleted all (or I think I did) the files and programs that might be related to the attack (temp and prefetch folders, randomly named exe files, some software I’ve installed recently, and some strange module called frida-winjector). I now know that I should’ve sent these for analysis.
The second mistake: I had a backup but it seems that the backup software I’ve been using causes so much clatter on my external harddisk (some files had 4 copies!) so I decided I should (1) take all of that on my PC, (2) clean it up, (3) format the harddisk, then (4) put the backup back. The problem is, the ransomware attack happened on step 2, and in my panicking I copied all the unaffected data into the same backup harddisk, thus overwriting some of what may have remained of the lost data on the harddisk.
At first, I thought I could make use of shadow copies of my internal harddisk, since “encrypting a file” is just like renaming it, an encrypted copy is made and the old one deleted, so it must be in the shadow disk, right? Wrong, ransomware deletes shadow copies, as I’ve later found out.
But what if the attack stopped midway? When exactly in the process of the attack does the attacker delete the shadow copy? I’ve found the untouched data when I used a commercial recovery program, why then did I not find the encrypted data on the same disk?? Can someone understand what has happened?