CyberDefenders: Malware Traffic Analysis 2 blueteam challenge.

Malware Traffic Analysis 2

SHA1SUM	867ef0df6e44ef9660d28afd401f9fa886fad502
Published	Sept. 15, 2020
Author	Brad Duncan
Size	2.0 MB
Tags	Wireshark PCAP Malware Traffic Analysis Network

Instructions	Uncompress the challenge (pass: cyberdefenders.org) Load suricatarunner.exe and suricataupdater.exe in BrimSecurity from settings Uncompress suricata.zip from description and move suircata.rules to ".\var\lib\suricata\rules" inside suricatarunner directory

Your progress

0% Completed0/17 Questions

Your score

0/1500

Digital Forensics

Last solve

4 days ago by racarreon57

The attached PCAP belongs to an Exploitation Kit infection. Analyze it using your favorite tool and answer the challenge questions.

Tools:

#	Question	Weight	Solved
#1	What is the IP address of the Windows VM that gets infected?	50	974
Hint Report an issue

#2	What is the MAC address of the infected VM?	50	960
Hint Report an issue

#3	What are the IP address and port number that delivered the exploit kit and malware?	100	886
Hint Report an issue

#4	What are the two FQDN's that delivered the exploit kit? comma-separated in alphabetical order.	50	850
Hint Report an issue

#5	What is the IP address of the compromised web site?	100	891
Hint Report an issue

#6	What is the FQDN of the compromised website?	50	897
Hint Report an issue

#7	What is the name exploit kit (EK) that delivered the malware? (two words)	100	667
Hint Report an issue

#8	What is the redirect URL that points to the exploit kit landing page?	100	670
Hint Report an issue

#9	What is the IP address of the redirect URL that points to the exploit kit landing page?	100	674
Hint Report an issue

#10	Extract the malware payload (PE file) from the PCAP. What is the MD5 hash?	100	665
Hint Report an issue

#11	What is the CVE of the exploited vulnerability?	100	596
Hint Report an issue

#12	What is the mime-type of the file that took the longest time (duration) to be analyzed using Zeek?	150	532
Hint Report an issue

#13	What was the referrer for the visited URI that returned the file "f.txt"?	50	576
Hint Report an issue

#14	When was this PCAP captured?	100	659
Hint Report an issue

#15	When was the PE file compiled?	100	598
Hint Report an issue

#16	What is the name of the SSL certificate issuer that appeared only once? (one word)	50	565
Hint Report an issue

#17	What were the two protection methods enabled during the compilation of the present PE file? Format: comma-separated in alphabetical order	150	474
Hint Report an issue

Submit Writeup