MrRobot Blue Team Challenge

Machine:Target1
What is the filename that was delivered in the email?

Machine:Target1
What is the name of the rat's family used by the attacker?

Machine:Target1
The malware appears to be leveraging process injection. What is the PID of the process that is injected?

Machine:Target1
What is the unique value the malware is using to maintain persistence after reboot?

Machine:Target1
Malware often uses a unique value or name to ensure that only one copy runs on the system. What is the unique name the malware is using?

Machine:Target1
It appears that a notorious hacker compromised this box before our current attackers. Name the movie he or she is from.

Machine:Target1
What is the NTLM password hash for the administrator account?

Machine:Target1
The attackers appear to have moved over some tools to the compromised front desk host. How many tools did the attacker move?

Machine:Target1
What is the password for the front desk local administrator account?

Machine:Target1
What is the std create data timestamp for the nbtscan.exe tool?

Machine:Target1
The attackers appear to have stored the output from the nbtscan.exe tool in a text file on a disk called nbs.txt. What is the IP address of the first machine in that file?

Machine:Target1
What is the full IP address and the port was the attacker's malware using?

Machine:Target1
It appears the attacker also installed legit remote administration software. What is the name of the running process?

Machine:Target1
It appears the attackers also used a built-in remote access method. What IP address did they connect to?

Machine:Target2
It appears the attacker moved latterly from the front desk machine to the security admins (Gideon) machine and dumped the passwords. What is Gideon's password?

Machine:Target2
Once the attacker gained access to "Gideon," they pivoted to the AllSafeCyberSec domain controller to steal files. It appears they were successful. What password did they use?

Machine:Target2
What was the name of the RAR file created by the attackers?

Machine:Target2
How many files did the attacker add to the RAR archive?

Machine:Target2
The attacker appears to have created a scheduled task on Gideon's machine. What is the name of the file associated with the scheduled task?

Machine:POS
What is the malware CNC's server?

Machine:POS
What is the common name of the malware used to infect the POS system?

Machine:POS
In the POS malware whitelist. What application was specific to Allsafecybersec?

Machine:POS
What is the name of the file the malware was initially launched from?