Blue Team Labs Online - UNDRGRND-N3RD

Q4) The downloaded file appears to be password-protected; what is the password? (Format: password)

Then after we extracted zsnes.zip, we can see that there are 2 files within this zip file and the README.txt contains instruction for user and also passwords right here

R3Tr0g@m1ng

Q5) What is the name of the malicious file? (Format: file.ext)

This is the content inside another zip file claiming to be a Games & Softwares

As soon as we extracted it using password from README.txt, Microsoft Defender will quarantine it which we can see that it detected this file as Meterpreter which is a payload for Metasploit framework

zsnes.exe

Q6) Now that the malicious file has been identified, it needs to be analyzed. Open Pestudio. What is the hash value? (Format: SHA256)

We must disable Virus & threat protection of Windows Defender first.

Now after extracted meterpreter payload from zip file, use pestudio to analyze it which we can see SHA256 of this file right here.

d478feb0d497f4290060a973aec5338b1d547efc5bd17b9ade5d189fd85e85e1

Q7) It seems that the file has been encrypted. What is the entropy and the name of the malicious file? (Format: x.xxx, .ext)

To find out about this, lets go to sections which display all properties of each file sections of this file which we can see that the entropy of ".fhfz" section is over 6 that mean it must has been packed or encrypted.

6.040, .fhfz

Q8) What are the permissions of the malicious file? (Format: string, string)

We can also see that ".fhfz" section have write and execute permission.

write, execute

Q9) By analyzing deeper the malicious file, you can obtain the attacker's IP address. Through which protocol is the attacker communicating and on which port? (Format: protocol://x.x.x.x:port)

Utilized strings from pestudio, we can see that it will connect to 192.168.8.130 on port 4444 (reverse shell)

tcp://192.168.8.130:4444

Q10) The attacker has ensured persistence on the victim's system. What is the name of the file that guarantees this persistence? (Format: string)

There are 2 popular ways to gain persistence on Windows which are Windows Schedule Task and Run registry key which we can see un-readable registry key was created under Run registry key of a user which will execute vbs file from User's Temp folder.

JtNbiQWjYBz

Q11) What is the real name of the file and where is it stored? (Format: C:\path\to\something\file.ext)

After navigated to Temp directory of this user, we can see the content of this script by just simply clicking it which we can also see that it will execute something that was encoded in base64.

After decoding it, we can see its an PE32 executable file

We can see that its not the same file as zsnes.exe as well.

C:\Users\mjarovic\AppData\Local\Temp\rIPnsjhr.vbs

Q12) Before the attack, the victim received an email containing sensitive information. What is the subject of the email and who sent it? (Format: string, email)

Go back to Autopsy under "Data Artifacts" -> "E-Mail Messages" -> "Default ([Default])" -> "Default (2)", we can see 2 emails with identical subject and message sent to the victim and the only different here is the Date Received of both emails.

Junior Sales Manager application, j.phillips@funtech.gg

Q13) What is the PC name and IP address of the sender? (Format: string, x.x.x.x)

Lets focus on the first one and go to "Strings" section under "Text" to display email header which we can see both PC name and IP address of the sender from "Recieve" header

funtech-pc1, 192.168.8.144

Q14) On which day and at what time was the email sent? (Format: xxx, x xxx xxxx HH:MM:SS)

If we take a look at this, it says that this email was sent at Mon, 1 Jul 2024 23:55:42 CEST (UTC +2)

But from the "Recieve" header, we can see the timestamp is slightly faster than it displayed from previous image. (but the answer accepted the first one, so lets just go with that)

Mon, 1 Jul 2024 23:55:42

Q15) In the email was attached a file. What is the name? (Format: file.ext)

We can see that a pdf file was sent as an attachment of this email right here

Here is another way to obtain the attachment filename.

MattJarovic-FunTech.pdf

Q16) What are the credentials provided for the new domain and the email password? (Format: domain username, domain password, email password)

Lets go to the location of this file, we can see that this file contains user credential for computer (domain account) and email.

We can also found this file inside user's Documents\work folder

m.jarovic, FunTech.SalesManager2024, email.funtech.gg

Q17) The attacker likely found and exfiltrated the victim's identity document while browsing through the user's directories. What is the name of the file, and what is the victim's city of residence and date of birth? (Format: file.ext, string, xx-xx-xxxx)

Under user's Documents\Personal folder, we can see that there is a digital copy of the victim ID card within this folder.

matt-id.jpg, San Francisco, 26-05-1990

Q18) At the end of the attack, it appears that a file was uploaded as a signature to claim the attack. What is the name of the file in question, and when was it uploaded? (Format: file.ext, xxxx-xx-xx, HH:MM:SS)

Under user's Documents\Games folder that user extracted meterpreter payload from zip file, we can see that there is an image located here and the Created Time is also happened after the attacker accessed sensitive files on this system.

cyberbat.jpg, 2024-07-03, 15:33:15

Q19) Given that the attacker has obtained sensitive information related to the previously analyzed data, it is possible to suppose who might be the next victim. What is the domain that will be attacked? (Format: domain)

Since the attacker already established persistence within this system and also obtained user credential of this domain then the attacker might come back then attack another user / machine within the same domain.

funtech.gg

https://blueteamlabs.online/achievement/share/52929/226

Summary

Matt Jarovic downloaded and interacted with a zip file contains malicious file then executed it which is actually a meterpreter payload that created remote shell connection to the attacker which the attacker gained access to this his system, obtain Matt's ID card and credentials for his domain account and email, uploaded proof of compromised and lastly, established persistence on user's Run registry which can come back to continue to compromise funtech.gg domain later.

Timeline

• 2024-07-03 15:26:32 : Matt Jarovic downloaded and interacted with a zip file contains malicious file.
• 2024-07-03 15:31:37 : Matt Jarovic unzipped a zip file.
• 2024-07-03 15:32:00 : Matt Jarovic executed malicious file.
• 2024-07-03 15:32:34 : The attacker accessed matt-id.jpg
• 2024-07-03 15:32:57 : The attacker accessed pdf file contains credentials of user.
• 2024-07-03 15:33:15 : cyberbat.jpg was created.
• 2024-07-03 15:34:05 : A persistence was created under Matt Jarovic user run registry key.

IOCs

• underground-n3rd[.]gg
• d1b650e7d3dffffc00ca4fe2a1137dfe45adc114bc33988926ab098e0801a53d (SHA256 of zsnes.zip)
• c1d25471af85b089c6c631f51117cca076b0e516e01c312752d5e1a3d27f40e0 (SHA256 of zsnes-LatestV1.51.zip)
• d478feb0d497f4290060a973aec5338b1d547efc5bd17b9ade5d189fd85e85e1 (SHA256 of zsnes.exe)
• fc3f303d53a8017b1a7c6d3e66f9fb4d3fac62731952bfb5e574f260260238b6 (SHA256 of binary created by rIPnsjhr.vbs)
• c7f5bef776dec41d3924636265ef7f4e2ed1c913711b9232a9d3375a41f3057c (SHA256 of cyberbat.jpg)
• 192[.]168[.]8[.]130