XLM Macros Blue Team Challenge

Sample1: This document contains six hidden sheets. What are their names? Provide the value of the one starting with S.

Sample1: What URL is the malware using to download the next stage? Only include the second-level and top-level domain. For example, xyz.com.

Sample1: What malware family was this document attempting to drop?

Sample2: This document has a very hidden sheet. What is the name of this sheet?

Sample2: This document uses reg.exe. What registry key is it checking?

Sample2: From the use of reg.exe, what value of the assessed key indicates a sandbox environment?

Sample2: This document performs several additional anti-analysis checks. What Excel 4 macro function does it use?

Sample2: This document checks for the name of the environment in which Excel is running. What value is it using to compare?

Sample2: What type of payload is downloaded?

Sample2: What URL does the malware download the payload from?

Sample2: What is the filename that the payload is saved as?

Sample2: How is the payload executed? For example, mshta.exe

Sample2: What was the malware family?