Crypto - but the bad kind

JoJo's Hospital in Lexington, Kentucky, recently faced a serious cyberattack that locked their important files. The hackers sent a message to the hospital asking for money to unlock the files. They gave a specific amount of time to pay.

Q1) How many hours did the hackers give the hospital to pay the ransom?

Answer: 72 Hours

Q2) What was the name of the ransomware group?

Answer: Lock Byte

Q3) The slogan was: we spend your money, so ____

Answer: you don’t have to

Q4) How much did the hackers ask the patients to pay?

Answer: $10,000

Q5) What very important unique identifier number did the ransomware operators threaten to release?

Answer: social security number

Q6) How many total files were encrypted at the hospital?

Answer: 6420

FileCreationEvents
| where filename endswith ".encrypted"
| count

Q7) How many unique hostnames had files encrypted on them?

Answer: 321

FileCreationEvents
| where filename endswith ".encrypted"
| distinct hostname

The hackers left a note on at least one of the computers telling the hospital how to pay the ransom. This note had a specific name We_Have_Your_Data_Pay_Up.txt