ShadowTrace TryHackMe

Introduction

Hi all, this entry I will demonstrate the usage of pestudio software, developer inspect tool, and online encode decode tools to answer all the question.

In this room, the learening objectives would be:

  • Extract IOCs from suspicious binaries
  • Correlate alerts with malicious activity
  • Perform basic SOC triage action
By using the tools, given you can demonstarte your skills above.


1) File Analysis

This section will test you on how you analyze .exe file using tools given.

1.1) What is the architecture of the binary file windows-update.exe?

inside the pestudio, go to top which will be the default section when you open the file using pestudio 

look for the file > type under the property column, and you can see the architecture sued which is executable, 64-bit



1.2) What is the hash (sha-256) of the file windows-update.exe?

you can see the hash at the top column. 





1.3) Identify the URL within the file to use it as an IOC

the same, search for the column shown below. 




1.4) With the URL identified, can you spot a domain that can be used as an IOC?

this part you need to search inside the strings section.

as you scroll you can see this url.




1.5) Input the decoded flag from the suspicious domain

the same, youn can search this url inside the strings section, as you can see there is base 64 code there, copy and paste it on online tools then you can see the flag after decode




1.6) What library related to socket communication is loaded by the binary?

go to the libraries section, and read the description column. Under the colukmn it will explain what does each libraries used for. 




2) Alerts Analysis

In this section, it will test you on how you analzye alerts


2.1) Can you idnetify the malicious URL from the trigger by the process powershell.exe? 

copy the strings inside the " " and the decode it by using online tools such as https://www.base64decode.org/ 







2.2) can you identify the malicious url from the alert tirggered by chrome.exe?

for this you need to copy the javascript strings, and then right click on your screen -> inspect -> console -> paste the strings -> if it doesn'y allow you to paste, type allow pasting and then paste the strings again -> then you will get the url






2.3) what's the name of the file saved in the alert triggered by chrome.exe? 

you can see the file name inside the javascript strings which is test.txt


3) Conclusion

In this room, it test you how to use all these tools

- pestudio tools (static analysis of windows executable .exe file) 
- inspect -> console tools (run javascript strings), and 
- Online encode and decode tools (https://www.base64decode.org/)

to do simple analysis of .exe file and also alerts. 








Comments

Post a Comment

Popular posts from this blog

Data Exfiltrtation Detection (DNS, FTP, HTTP, ICMP)

Image
Learning Objectives In this entry, we will cover the following learning objectives: - Understand the common methods used for data exfiltration. - Learn how to detect exfiltration attempts using network traffic analysis. - Identify signs of exfiltration on endpoint devices. - Correlate logs in a SIEM to uncover hidden exfiltration channels. 1) Data Exfil: Overview Tech, and indicators -> unauthorized data transfer from in to out by adversaries -> can be by insider or malware 1.1) Why they do data exfil?  Reason Description Financial Gain Stolen data (e.g., credit card information, personal records) can be sold on the dark web or used for fraud. Espionage Nation-state actors target intellectual property, trade secrets, or classified information for strategic advantage. Ransomware & Extortion Attackers steal data and threaten to leak it unless a ransom is paid. Disruption & Sabotage Adversaries aim to damage an organization's reputation or operations by exposing sensitiv...
Read more

Firewall, WAF, and VPN manual log Analysis using command line.

Image
Incident Scenario Initech Corp, a mid-sized financial services company, has recently deployed a new firewall and intrusion detection system (IDS) to monitor its network perimeter. Over the past month, security analysts have noticed abnormal traffic patterns, but the SOC team has been overwhelmed and missed deeper analysis. As a new security analyst, you have been tasked with reviewing one month of perimeter logs to determine what techniques the adversary used, and whether they succeeded in breaching the perimeter. You have been given three sets of logs from the time of the incident. The logs can be found in the Perimeter_logs/challenge directory on the Desktop. Firewall Logs:firewall.log WAF Logs:ids_alerts.log  VPN Logs:vpn_auth.log  LOG ANALYSIS Let's start by exploring the logs, as shown below: Commandline: head firewall.log Explore ids logs, as shown below: Commandline: head ids_alerts.log Examine VPN Logs, as shown below: Commandline: head vpn_auth.log Reconnaissance atte...
Read more

Reversing ELF TryHackMe

Image
  1) crackme1 for the first challenge all we need to do is run the file named "crackme1" and we got the flag. 2) crackme2 when we try to run the file, it correct us and say the right usage is ./crackme2 + password, and we need to find this password. As we open the file in ghidra, we can see if we use "super_secret+password" it will give us access granted as the output. and as we suspected, once we use it as the password, it will give us the flag.  3) crackme3 The same case as crackme2, so first let's see if there is any interesting strings that we can see.  here we can see there is a base64 strings as we open the file in ghidra, it says that if we input the base64 strings as the password, then the password is correct.  so we decode the strings first and then use it as the password.  4) crackme4 This launches GDB (GNU Debugger) and loads the executable crackme4. This tells GDB to print all the functions found inside the binary. This lets you identify where the re...
Read more