What IP address has Po1s0n1vy tied to domains that are pre-staged to attack Wayne Enterprises?
index=botsv1 sourcetype=fgt_utm (srcip="192.168.250.70" OR dstip="192.168.250.70") catdesc="Malicious Websites"
Answer: 23.22.63.114
Based on the data gathered from this attack and common open source intelligence sources for domain names, what is the email address that is most likely associated with Po1s0n1vy APT group?
Answer: [email protected]
What IP address is likely attempting a brute force password attack against imreallynotbatman.com?
index="botsv1" imreallynotbatman.com sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND isnotnull(username)
| table username, password, c_ip, dest_ip, uri
Answer: 23.22.63.114
What is the name of the executable uploaded by Po1s0n1vy? Please include file extension. (For example, "notepad.exe" or "favicon.ico")
index="botsv1" dest_ip="192.168.250.70" sourcetype="suricata" http.http_method=POST "imreallynotbatman.com"
| rex field=fileinfo.filename "(?<executable>.*?\.(exe|ps1))"
| where isnotnull(executable)
| table _time, executable, src_ip
3791.exe, /_vti_bin/shtml.exe
Co Relation with Sysmon
index="botsv1" source="WinEventLog:Microsoft-Windows-Sysmon/Operational" 3791.exe extracted_eventid=1
| table Command_Line, Image_Path, Parent_Image_Path
No record of shtml.exe found, increasing the chances of 3791.exe being malicious file
Answer: 3791.exe
What is the MD5 hash of the executable uploaded?
index="botsv1" source="WinEventLog:Microsoft-Windows-Sysmon/Operational" extracted_eventid=1 "3791.exe"
| table Command_Line, Image_Path, Parent_Image_Path, Hashes
Answer: AAE3F5A29935E6ABCC2C2754D12A9AF0
GCPD reported that common TTPs (Tactics, Techniques, Procedures) for the Po1s0n1vy APT group, if initial compromise fails, is to send a spear phishing email with custom malware attached to their intended target. This malware is usually connected to Po1s0n1vys initial attack infrastructure. Using research techniques, provide the SHA256 hash of this malware.
Answer: 9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8
Malicious File name: MirandaTateScreensaver.scr.exe related to IP: 23.22.63.114
What special hex code is associated with the customized malware discussed in question 111? (Hint: It's not in Splunk)
Answer: 53 74 65 76 65 20 42 72 61 6e 74 27 73 20 42 65 61 72 64 20 69 73 20 61 20 70 6f 77 65 72 66 75 6c 20 74 68 69 6e 67 2e 20 46 69 6e 64 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 61 73 6b 20 68 69 6d 20 74 6f 20 62 75 79 20 79 6f 75 20 61 20 62 65 65 72 21 21 21 VirusTotal Community Post
One of Po1s0n1vy's staged domains has some disjointed "unique" whois information. Concatenate the two codes together and submit as a single answer.
https://www.whoxy.com/whois-history/demo_result.php, or try a free demo of whoxy.com Who is history API.
Target URL: wanecorpinc.com one of the domains linked with 23.22.63.114
{
"num": 2,
"domain_name": "waynecorinc.com",
"query_time": "2017-08-03 16:46:53",
"create_date": "2016-08-09",
"update_date": "2017-07-10",
"expiry_date": "2018-08-09",
"domain_registrar": {
"iana_id": 48,
"registrar_name": "eNom, Inc.",
"whois_server": "whois.enom.com",
"website_url": "<http://www.enom.com>",
"registrar_status": "Accredited"
},
"registrant_contact": {
"full_name": "LILLIAN ROSE",
"company_name": "TOXICODENDRON INC.",
"mailing_address": "1 EDGE FORREST LANE",
"city_name": "SPRINGFIELD",
"state_name": "MO",
"zip_code": "65803",
"country_name": "United States",
"country_code": "US",
"email_address": "[email protected]",
"phone_number": "+1.7357647667"
},
"administrative_contact": {
"full_name": "LILLIAN ROSE",
"company_name": "31 73 74 32 66 69 6E 64 67 65 74 73 66 72 65 65 62 65 65 72",
"mailing_address": "66 72 6F 6D 72 79 61 6E 66 69 6E 64 68 69 6D 74 6F 67 65 74",
"city_name": "SPRINGFIELD",
"state_name": "MO",
"zip_code": "65803",
"country_name": "United States",
"country_code": "US",
"email_address": "[email protected]",
"phone_number": "+1.7357647667"
},
"technical_contact": {
"full_name": "LILLIAN ROSE",
"company_name": "TOXICODENDRON INC.",
"mailing_address": "1 EDGE FORREST LANE",
"city_name": "SPRINGFIELD",
"state_name": "MO",
"zip_code": "65803",
"country_name": "United States",
"country_code": "US",
"email_address": "[email protected]",
"phone_number": "+1.7357647667"
},
"name_servers": [
"dns1.registrar",
"dns2.registrar"
],
"domain_status": [
"clientTransferProhibited"
]
},
Answer: 31 73 74 32 66 69 6E 64 67 65 74 73 66 72 65 65 62 65 65 72 66 72 6F 6D 72 79 61 6E 66 69 6E 64 68 69 6D 74 6F 67 65 74
What was the first brute-force password used?
index="botsv1" imreallynotbatman.com sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND isnotnull(username)
| table _time, username, password, c_ip, dest_ip, uri
Answer: 12345678
One of the passwords in the brute force attack is James Brodsky's favorite Coldplay song. Hint: we are looking for a six character word on this one. Which is it?
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where isnotnull(password) AND len(password) == 6
| fields _time, username, password, c_ip, dest_ip
| append [ search sourcetype="coldplay" | fields songName ]
| eventstats values(songName) as all_songs
| mvexpand all_songs
| where lower(password) == lower(all_songs)
| table _time, c_ip, dest_ip, username, password, all_songs
| _time | c_ip | dest_ip | username | password | songName |
|---|---|---|---|---|---|
| 2016-08-10 17:45:26.973 | 23.22.63.114 | 192.168.250.70 | admin | orange | Orange |
| 2016-08-10 17:45:30.867 | 23.22.63.114 | 192.168.250.70 | admin | yellow | Yellow |
Answer: Yellow
What was the correct password for admin access to the content management system running "imreallynotbatman.com"?
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| where username="admin"
| table _time, c_ip, dest_ip, username, password, http_user_agent
Answer: batman
| _time | c_ip | dest_ip | username | password | http_user_agent |
|---|---|---|---|---|---|
| 2016-08-10 17:48:05.858 | 40.80.148.42 | 192.168.250.70 | admin | batman | Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko |
| 2016-08-10 17:46:51.394 | 23.22.63.114 | 192.168.250.70 | admin | rock | Python-urllib/2.7 |
What was the average password length used in the password brute forcing attempt? (Round to closest whole integer. For example "5" not "5.23213")
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| eval average_password = len(password)
| stats avg(average_password) as average_lenght
Answer: 6 (6.2595238095238095)
How many seconds elapsed between the time the brute force password scan identified the correct password and the compromised login? Round to 2 decimal places.
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| eval attack_time = if (username="admin" AND password="batman" AND http_user_agent="Python-urllib/2.7", _time, null())
| eval compromised_time = if(username="admin" AND password="batman" AND http_user_agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", _time, null())
| stats min(attack_time) as timeOfAttack min(compromised_time) as timeOfCompromisedLogin
| eval elapsedTime = timeOfCompromisedLogin - timeOfAttack
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| search username="admin" AND password="batman"
| sort 0 _time
| delta _time as elapsedTime
| where elapsedTime > 0
| eval elapsedTime = round(elapsedTime, 2)
| stats values(elapsedTime) as elapsedTime
Answer: 92.17
How many unique passwords were attempted in the brute force attempt?
index="botsv1" "imreallynotbatman.com" sourcetype="stream:http" http_method=POST
| rex field=form_data "username=(?<username>[^&]+)"
| rex field=form_data "(passwd|password)=(?<password>[^&]+)"
| search username="admin" http_user_agent="Python-urllib/2.7"
| stats dc(password) as uniquePasswordCount
Answer: 412
What was the most likely IP address of we8105desk on 24AUG2016?