First Shift CTF | Promotion Night | TryHackMe Walkthrough
Task 8:Promotion Night
What was the network share path where ransomware was placed?
file share starts with \\ so well use it as a filter
Ans: \DC-01\SYSVOL\gaze.exe
SYSVOL is like a shared folder for the whole domain
What is the value ransomware created to persist on reboot?
value so it must be registry keys
Ans: BabyLockerKZ
What was the most likely extension of the encrypted files?
check the hash of the gaze.exe in virustotal and its behaviour
Ans: .danger17
Which MITRE technique ID was used to deploy ransomware?
Windows Management Instrumentation (WMI) is a built-in Microsoft infrastructure for managing data and operations on Windows operating systems. It provides a standardized, object-oriented framework allowing administrators to query, monitor, and automate system management tasks, such as tracking hardware status, software installations, or remote machine configuration. WmiPrvSE.exe processes spawn when specific data queries are made, and can close when idle.
Ans: T1047
What ports of SRV-ITFS did the adversary successfully scan?
SRV-JMP: 10.10.90.6 SRV-ITFS:10.10.110.26
Ans: 135, 139, 445, 3389, 5985
What is the full path to the malware that performed the Discovery?
The net view command in Windows displays shared network resources like computers, domains, or specific server shares from the Command Prompt, helping users discover available devices and services
Ans: C:\Windows\System32\fr-FR\ruche.dll
Which artifact did the adversary create to persist on the beachhead?
Ans: LanguageSync
What is the MD5 hash of the embedded initial shellcode?
update.ps1 is the file that has the shellcode
index=* host=”SRV-JMP” update.ps1
27 blocks forms the full script
Below query helps in collecting all the code and making it into single Line
index=* sourcetype=”wineventlog” EventCode=4104 | rex field=_raw “Creating Scriptblock text ((?\d+) of (?\d+)):” | rex field=_raw “(?s)):\s*(?.?)\sScriptBlock ID:” | sort 0 ScriptBlock_ID part | stats list(chunk) as scriptblock by ScriptBlock_ID | eval scriptblock=mvjoin(scriptblock, “”) | eval sb_len=len(scriptblock) | table ScriptBlock_ID sb_len scriptblock | sort -sb_len
bitwise XOR with 35
Ans: 27b0d51406b5360b49d968d69df0f3e6
Which C2 framework was used by the adversary in the intrusion?
check the hash with virustotal
Ans: Cobalt Strike
What hostname did the adversary log in from on the beachhead?
Ans:DESKTOP-J9PR0CO
What was the UNC path that likely contained AWS credentials?
Ans: \SRV-ITFS\Integrations\cloud-keys.csv
From which IP address did the adversary access AWS?
Ans: 152.42.128.207
Which two sensitive files did the adversary exfiltrate from AWS?
index=”*” sourcetype=”aws:cloudtrail” src_ip=”152.42.128.207" eventName=GetObject
Ans: beta.tar.gz, latest.tar.gz
What file did the adversary upload to S3 in place of the wiped ones?
Ans: YOU-HAVE-BEEN-PWNED.txt
THANK YOU FOR READING!!! ❤️💫
