# First Shift CTF | Promotion Night | TryHackMe Walkthrough

### Task 8:Promotion Night

> **What was the network share path where ransomware was placed?**

file share starts with \\\\ so well use it as a filter

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/c2a77e98-fd3d-43ae-bb08-50405ed5c5d7.png align="center")

***Ans: \\\\DC-01\\SYSVOL\\gaze.exe***

SYSVOL is like a shared folder for the whole domain

> **What is the value ransomware created to persist on reboot?**

value so it must be registry keys

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/840caf3d-f027-40c8-8e8b-b3b37c74d093.png align="center")

***Ans: BabyLockerKZ***

> **What was the most likely extension of the encrypted files?**

check the hash of the gaze.exe in virustotal and its behaviour

***Ans: .danger17***

> **Which MITRE technique ID was used to deploy ransomware?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/08547101-c1dd-44e1-861f-f86e9b901009.png align="center")

Windows Management Instrumentation (WMI) is a built-in Microsoft infrastructure for managing data and operations on Windows operating systems. It provides a standardized, object-oriented framework allowing administrators to query, monitor, and automate system management tasks, such as tracking hardware status, software installations, or remote machine configuration. WmiPrvSE.exe processes spawn when specific data queries are made, and can close when idle.

***Ans: T1047***

> **What ports of SRV-ITFS did the adversary successfully scan?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/40bda1f8-a11c-4fbe-96da-41a54b3d7152.png align="center")

SRV-JMP: 10.10.90.6 SRV-ITFS:10.10.110.26

***Ans: 135, 139, 445, 3389, 5985***

> **What is the full path to the malware that performed the Discovery?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/f6589e9b-b935-4066-b882-4ec53d2d5b69.png align="center")

The net view command in Windows displays shared network resources like computers, domains, or specific server shares from the Command Prompt, helping users discover available devices and services

***Ans: C:\\Windows\\System32\\fr-FR\\ruche.dll***

> **Which artifact did the adversary create to persist on the beachhead?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/21092b36-bd1e-4a3c-9a29-5b1d719c20ab.png align="center")

***Ans: LanguageSync***

> **What is the MD5 hash of the embedded initial shellcode?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/ac11e37a-6097-4de0-8960-85b9947880bf.png align="center")

update.ps1 is the file that has the shellcode

index=\* host=”SRV-JMP” update.ps1

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/581ae3ba-bca6-4740-a2a4-928cf940ff54.png align="center")

27 blocks forms the full script

Below query helps in collecting all the code and making it into single Line

index=\* sourcetype=”wineventlog” EventCode=4104 | rex field=\_raw “Creating Scriptblock text ((?\\d+) of (?\\d+)):” | rex field=\_raw “(?s)):\\s\*(?.*?)\\s*ScriptBlock ID:” | sort 0 ScriptBlock\_ID part | stats list(chunk) as scriptblock by ScriptBlock\_ID | eval scriptblock=mvjoin(scriptblock, “”) | eval sb\_len=len(scriptblock) | table ScriptBlock\_ID sb\_len scriptblock | sort -sb\_len

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/c4064548-c50b-45ec-9014-4d494982884c.png align="center")

bitwise XOR with 35

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/b01a5466-c3f9-4133-ab4e-3053de7bfde0.png align="center")

***Ans: 27b0d51406b5360b49d968d69df0f3e6***

> **Which C2 framework was used by the adversary in the intrusion?**

check the hash with virustotal

***Ans: Cobalt Strike***

> **What hostname did the adversary log in from on the beachhead?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/e5b1ea4b-7649-4eec-832d-d04db948812b.png align="center")

***Ans:DESKTOP-J9PR0CO***

> **What was the UNC path that likely contained AWS credentials?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/1ea0aa92-ee39-435c-88fb-f5ae0241e900.png align="center")

***Ans: \\SRV-ITFS\\Integrations\\cloud-keys.csv***

> **From which IP address did the adversary access AWS?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/48016adf-87fc-4bea-87fd-7248038566c2.png align="center")

***Ans: 152.42.128.207***

> **Which two sensitive files did the adversary exfiltrate from AWS?**

index=”\*” sourcetype=”aws:cloudtrail” src\_ip=”152.42.128.207" eventName=GetObject

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/feb2d8e8-2db4-405d-aa61-9f08857b599b.png align="center")

***Ans: beta.tar.gz, latest.tar.gz***

> **What file did the adversary upload to S3 in place of the wiped ones?**

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/3b2b9a47-136d-4383-a889-610ed219608c.png align="center")

***Ans: YOU-HAVE-BEEN-PWNED.txt***

**THANK YOU FOR READING!!! ❤️💫**