Sherlock Santa Krampus : OpTinselTrace24-1: Sneaky Cookies

 

 

                     I-  Scenario 

 

 QUESTION 1:

Krampus, a notorious threat actor, possibly social-engineered bingle as email security filters were offline for maintenance. Find any suspicious files under Bingle Jollybeard User directory and get back to us with the full file name

explanation: After succesfully unzip the downloaded file , make a tree on it and look for any suspicious coming from Bingle \Jollybeard   user 

        Answer :

QUESTION 2:

Using the malicious file sent as part of phishing, the attacker abused a legitimate binary to download and execute a C&C stager. What is the full command used to download and execute the C&C Binary?

 

explanation : Ok , Inside of the directory where the shorcut file is located , use " lnkinfo"  like this  ([if you haven't it install | sudo apt-get install liblnk-utils)

 

Yes, the answer is well in front of you  

QUESTION 3 :  

When was this file ran on the system by the victim?

QUESTION 4:

What is the Mitre Sub technique ID for the technique used in Q1 and Q2 ?

 

Reviewing Q1 , it was talking about social-engineering , referer to mitre ; i was able to retrieve the concerned indent under user-execution in enterprise section ; use this url for better understanding https://attack.mitre.org/techniques/T1204/001/

QUESTION 5:

What was the name of threat actor's machine used to develop/create the malicious file sent as part of phishing?

So , referring to the exiftool command , it might possible

Answer :

Question 6:When did attacker enumerated the running processes on the system?

 Question 7:After establishing a C&C Channel, attacker proceeded to abuse another Legitimate binary to download an exe file. What is the full URI for this download?

 Answer:

Question 8:What is the Mitre ID for the technique used in Q7?                                                                                                                                                                                                                                                    

 

 

 

 

 

 

 

 

 

 

 

 Follow for next party !  ! !  

 

 

Thanks for reading , artemis37