# HawkEye Blue Team Challenge

:::success
https://cyberdefenders.org/blueteam-ctf-challenges/91#nav-questions
:::

:::info
Scenario:
An accountant at your organization received an email regarding an invoice with a download link. Suspicious network traffic was observed shortly after opening the email. As a SOC analyst, investigate the network trace and analyze exfiltration attempts.

Tools:
Wireshark
BrimSecurity
Apackets
MaxMind Geo IP
VirusTotal
:::

#### 1. How many packets does the capture have?

4003

檢視 Capture File Properties。


#### 2. At what time was the first packet captured?

2019-04-10 20:37:07 UTC

檢視 Capture File Properties 會看到UTC+8的時間。

檢視第一個封包，時間是原始UTC(UTC+0)的時間。

#### 3. What is the duration of the capture?

01:03:41

檢視 Capture File Properties。


#### 4. What is the most active computer at the link level?

00:08:02:1c:47:ae

檢視 Conversations，發現 00:08:02:1c:47:ae 主機活動數量最多。


#### 5. Manufacturer of the NIC of the most active system at the link level?

Hewlett-Packard

MAC address 共48bits，前24bits代表製造商，可以利用線上工具查詢。

參考資料：
https://dnschecker.org/mac-lookup.php

https://www.jannet.hk/mac-address-vendor-lookup-zh-hant/


#### 6. Where is the headquarter of the company that manufactured the NIC of the most active computer at the link level?

Palo Alto

查詢HP wiki，Hewlett-Packard總部位在 Palo Alto, California, United States


#### 7. The organization works with private addressing and netmask /24. How many computers in the organization are involved in the capture?

3

檢視 Endpoints，發現網段10.4.10.0/24 共有10.4.10.2、10.4.10.4、10.4.10.132 三台主機。

#### 8. What is the name of the most active computer at the network level?

beijing-5cd1-pc

可以利用工具NeyworkMinier快速顯示主機名稱。

封包內容中有SMTP的封包，也可以在EHLO看到10.4.10.132的主機名稱。

#### 9. What is the IP of the organization's DNS server?

10.4.10.4

Filter查詢dns，可以發現10.4.10.4是環境內的DNS主機。

#### 10. What domain is the victim asking about in packet 204?

proforma-invoices.com

檢視packet 204


#### 11. What is the IP of the domain in the previous question?

217.182.138.150

檢視dns回覆，在packet 206

#### 12. Indicate the country to which the IP in the previous section belongs.

France

查詢GEOIP


參考資料：
https://www.maxmind.com/en/geoip-demo

#### 13. What operating system does the victim's computer run?

Windows NT 6.1

作業系統資訊可以從http請求中的User-Agent來判斷:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)


#### 14. What is the name of the malicious file downloaded by the accountant?

tkraw_Protected99.exe

從wireshark file-->export object 中可以看到檔案tkraw_Protected99.exe

從NetworkMinier中也可以看到檔案tkraw_Protected99.exe下載的行為。

在packet 210也可以看到http GET下載tkraw_Protected99.exe

#### 15. What is the md5 hash of the downloaded file?

71826ba081e303866ce2a2534491a2f7

承上題，利用wireshark file-->export object可以將檔案匯出，丟到VT上查詢可得到惡意程式相關資訊，包含雜湊。


#### 16. What software runs the webserver that hosts the malware?

litespeed

用NetworkMiner查詢可以發現217.182.138.150使用的web server軟體是litespeed


用wireshark去follow整段下載的tcp封包，裡面也會顯示server端使用的軟體。


#### 17. What is the public IP of the victim's computer?

173.66.146.112

用NetworkMiner查詢可以發現10.4.10.132的public ip 是173.66.146.112。

或利用wireshark去觀察smtp的封包，也可以在smtp server 回覆hello的地方找到public ip。

#### 18. In which country is the email server to which the stolen information is sent?

United States

用線上工具查詢email server的ip 23.229.162.69


參考資料：
https://www.maxmind.com/en/geoip-demo

#### 19. Analyzing the first extraction of information. What software runs the email server to which the stolen data is sent?

Exim 4.91

觀察smtp的封包在三向交握後，server端會先提供自身資訊。

#### 20. To which email account is the stolen information sent?

[e-mail]

觀察smtp封包，攻擊者利用[e-mail]將資料寄給自己。

#### 21. What is the password used by the malware to send the email?

Sales@23

承上題，可以看到登入的密碼是U2FsZXNAMjM=，smtp內容用base64 encode，解開之後得到密碼為Sales@23


#### 22. Which malware variant exfiltrated the data?

Reborn v9

將信件內容decode，可以看到是利用keylogger工具reborn v9來偷取資料。


#### 23. What are the bankofamerica access credentials? (username:password)

roman.mcguire:P@ssw0rd$

承上題，找尋bankofamerica的資料。


#### 24. Every how many minutes does the collected data get exfiltrated?

10

檢視smtp封包，發現頻率為約10分鐘一次