CyberDefenders: Malware Traffic Analysis 1 blueteam challenge.

Malware Traffic Analysis 1

SHA1SUM	8c99d51484ce26fe39719a25afde3e00749c75a0
Published	Aug. 19, 2020
Author	Brad Duncan
Size	2.0 MB
Tags	Wireshark PCAP Malware Traffic Analysis Network

Instructions	Uncompress the challenge (pass: cyberdefenders.org) Load suricatarunner.exe and suricataupdater.exe in BrimSecurity from settings Uncompress suricata.zip from description and move suircata.rules to ".\var\lib\suricata\rules" inside suricatarunner directory

Your progress

0% Completed0/12 Questions

Your score

Last solve

The attached PCAP belongs to an Exploitation Kit infection. Analyze it using your favorite tool and answer the challenge questions.

Tools:

#	Question	Weight	Solved
#1	What is the IP address of the Windows VM that gets infected?	50	2040
Hint Report an issue

#2	What is the hostname of the Windows VM that gets infected?	50	1901
Hint Report an issue

#3	What is the MAC address of the infected VM?	50	1946
Hint Report an issue

#4	What is the IP address of the compromised web site?	50	1861
Hint Report an issue

#5	What is the FQDN of the compromised website?	50	1822
Hint Report an issue

#6	What is the IP address of the server that delivered the exploit kit and malware?	50	1754
Hint Report an issue

#7	What is the FQDN that delivered the exploit kit and malware?	50	1730
Hint Report an issue

#8	What is the redirect URL that points to the exploit kit (EK) landing page?	100	1630
Hint Report an issue

#9	Other than CVE-2013-2551 IE exploit, another application was targeted by the EK and starts with "J". Provide the full application name.	100	1452
Hint Report an issue

#10	How many times was the payload delivered?	100	1567
Hint Report an issue

#12	The compromised website has a malicious script with a URL. What is this URL?	150	1433
Hint Report an issue

#13	Extract the two exploit files. What are the MD5 file hashes? (comma-separated )	150	1279
Hint Report an issue