Malware Traffic Analysis 5 Lab Official Walkthrough

Scenario

You're working as a soc analyst at a Security Operations Center (SOC) for a Thanksgiving-themed company. One quiet evening, you hear someone knocking at the SOC analyst's entrance. As you answer the door, an exhausted mail server technician stumbles in and quickly falls to the floor. He whispers in a shaky voice, "Mail filters are down... Spam everywhere..."

As you help him up, he looks to the sky and yells, "The gates of hell have opened!" The technician immediately collapses again and softly whispers, "The horror... The horror...".

The mail filter outage lasted throughout the next day. Fortunately, very few incidents were reported. But one example caught your eye. During the mail filter outage, one of the company employees decided to play "email roulette." The employee opened one of the malicious emails from his inbox and treated it as a legitimate message.

You acquired four malicious emails the employee received. You also received a PCAP of traffic from his infected computer. Your task is to figure out which email was used to compromise the system.

Before you start

Everything this walkthrough uses is already on the lab machine. The artifacts are in ~/Desktop/Start here/Artifacts and the tooling is in ~/Desktop/Start here/Tools. Copy the artifacts into a working directory so the originals stay untouched:

mkdir -p ~/mta5 && cd ~/mta5
cp ~/Desktop/Start\ here/Artifacts/c41-MTA5* .

Didier Stevens' scripts are not on PATH, so they are called by full path throughout:

python3 "$HOME/Desktop/Start here/Tools/DidierStevensSuite/emldump.py" <file>

oledump.py emits a harmless SyntaxWarning on this image's Python build, so its calls carry -W ignore to keep the output readable.

Tools used in this walkthrough: