|
Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for imaging and analysis. Our recruiter mentioned he received an email from someone regarding their resume. A copy of the email was recovered and is provided for reference. Find and decode the source of the malware to find the flag. Note: Find and Decode the source of the malware to find the flag. The reading the email file we know following information Filename: resume.zip IP: http://10.10.99.55:8080/resume.zip Used following command to analyze the process  Found some suspicious stuff  Used netscan plugin to analyze the network connection and identified that process powershell is connecting to the Malicious IP address found the email. The malicious process is powershell 2752.  Lets perform a filescan and see if we can find the resume file in the memory.  We have some hits - lets dump them out and do strings on them.  Lets do strings on the dumped files.  There is some data in Base 64 - lets use cyberchef to decode it.  The output of base 64 has another base64 encoding in it. Looks like someone is running powershell  Finally we got some readable text and I can see the flag HTB{$_j0G_y0uR_M3m0rY_$} in it.  |
Mac Forensics
|
RSS Feed