Pyramid Of Pain
-
Read the above.
No Answer
-
Provide the ransomware name for the hash '63625702e63e333f235b5025078cea1545f29b1ad42b1e46031911321779b6be' using open-source lookup tools
Using online tool like Virustotal :
Answer : Conti
-
What is the ASN for the third IP address observed?
Using the link to any.run, it give me the information.
I get the same info first by checking the IP in Hurricane Electric :
Answer : Host Europe GmbH
-
What is the domain name associated with the first IP address observed?
Answer : craftingalegacy.com
-
Go to this report on app.any.run and provide the first malicious URL request you are seeing, you will be using this report to answer the remaining questions of this task.
The first malicious URL is the first DNS request :
Answer : craftingalegacy.com
-
What term refers to an address used to access websites?
The translation for human readable of IP address : Domain Name
Answer : Domain Name
-
What type of attack uses Unicode characters in the domain name to imitate the a known domain?
Answer : Punycode attack
-
Provide the redirected website for the shortened URL using a preview: https://tinyurl.com/bw7t8p4u
Let's check which website this URL redirect to :
ME@PC:~$ curl https://tinyurl.com/bw7t8p4u
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url='https://tryhackme.com/'" />
<title>Redirecting to https://tryhackme.com/</title>
</head>
<body>
Redirecting to <a href="https://tryhackme.com/">https://tryhackme.com/</a>.
</body>
</html>ME@PC:~$
Answer : https://tryhackme.com/
What is the suspicious IP the victim machine tried to connect to in the screenshot above?
Answer : 35.214.215.33
Use the tools introduced in task 2 and provide the name of the malware associated with the IP address
Searching for the hash in online tool Virustotal :
Answer : emotet
Using your OSINT skills, what is the name of the malicious document associated with the dropped binary?
Answer : G_jugk.Exe
Use your OSINT skills and provide the name of the malicious document associated with the dropped binary
CHecking for that binary on google (hint), i found an any.run report :
This gives me the name of the file ossociated with the binary :
Answer : CMO-100120 CDW-102220.doc
-
What browser uses the User-Agent string shown in the screenshot above?
Answer : internet explorer
-
How many POST requests are in the screenshot from the pcap file?
Answer : 6
- Provide the method used to determine similarity between the files
"Fuzzy hashing is also a strong weapon against the attacker's tools. Fuzzy hashing helps you to perform similarity analysis - match two files with minor differences based on the fuzzy hash values. One of the examples of fuzzy hashing is the usage of SSDeep; on the SSDeep official website, you can also find the complete explanation for fuzzy hashing. "
Answer : Fuzzy hashing
-
Provide the alternative name for fuzzy hashes without the abbreviation
Per SSDeep :
Answer : context triggered piecewise hashes
-
Navigate to ATT&CK Matrix webpage. How many techniques fall under the Exfiltration category?
Per MITRE | ATT&CK main page :
Answer : 9
-
Chimera is a China-based hacking group that has been active since 2018. What is the name of the commercial, remote access tool they use for C2 beacons and data exfiltration?
I looked up for Chimera in the search bar then searched for exfiltration on the Chimera page result :
Answer : Cobalt Strike
-
Complete the static site.
Flag not poping with right answer : looked at forum = "Seems that Task 9 is having some issues"
No Answer.
-
Read the above.
No Answer.