Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Carnage

Apply your analytical skills to analyze the malicious network traffic using Wireshark.

Task 1: Scenario



Eric Fischer from the Purchasing Department at Bartell Ltd has received an email from a known contact with a Word document attachment.  Upon opening the document, he accidentally clicked on "Enable Content."  The SOC Department immediately received an alert from the endpoint agent that Eric's workstation was making suspicious connections outbound. The pcap was retrieved from the network sensor and handed to you for analysis. 

Task: Investigate the packet capture and uncover the malicious activities. 

*Credit goes to Brad Duncan for capturing the traffic and sharing the pcap packet capture with InfoSec community. 

NOTE: DO NOT directly interact with any domains and IP addresses in this challenge. 

Deploy the machine attached to this task; it will be visible in the split-screen view once it is ready.

If you don't see a lab machine load, then click the Show Split View button.


Answer the questions below

  1. Read the above.

Task 2: Traffic Analysis



Are you ready for the journey?

Please, load the pcap file in your Analysis folder on the Desktop into Wireshark to answer the questions below.

Answer the questions below

  1. What was the date and time for the first HTTP connection to the malicious IP?

    (answer format: yyyy-mm-dd hh:mm:ss)

  2. What is the name of the zip file that was downloaded?

  3. What was the domain hosting the malicious zip file?

  4. Without downloading the file, what is the name of the file in the zip file?

  5. What is the name of the webserver of the malicious IP from which the zip file was downloaded?

  6. What is the version of the webserver from the previous question?

  7. Malicious files were downloaded to the victim host from multiple domains. What were the three domains involved with this activity?

  8. Which certificate authority issued the SSL certificate to the first domain from the previous question?

  9. What are the two IP addresses of the Cobalt Strike servers? Use VirusTotal (the Community tab) to confirm if IPs are identified as Cobalt Strike C2 servers. (answer format: enter the IP addresses in sequential order)
  10. What is the Host header for the first Cobalt Strike IP address from the previous question?
  11. What is the domain name for the first IP address of the Cobalt Strike server? You may use VirusTotal to confirm if it's the Cobalt Strike server (check the Community tab).
  12. What is the domain name of the second Cobalt Strike server IP?  You may use VirusTotal to confirm if it's the Cobalt Strike server (check the Community tab).

  13. What is the domain name of the post-infection traffic?

  14. What are the first eleven characters that the victim host sends out to the malicious domain involved in the post-infection traffic? 

  15. What was the length for the first packet sent out to the C2 server?

  16. What was the Server header for the malicious domain from the previous question?

  17. The malware used an API to check for the IP address of the victim’s machine. What was the date and time when the DNS query for the IP check domain occurred? (answer format: yyyy-mm-dd hh:mm:ss UTC)

  18. What was the domain in the DNS query from the previous question?

  19. Looks like there was some malicious spam (malspam) activity going on. What was the first MAIL FROM address observed in the traffic?

  20. How many packets were observed for the SMTP traffic?

Room Icon

Carnage

Apply your analytical skills to analyze the malicious network traffic using Wireshark.

medium

60 min

22,589

User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off



Eric Fischer from the Purchasing Department at Bartell Ltd has received an email from a known contact with a Word document attachment.  Upon opening the document, he accidentally clicked on "Enable Content."  The Department immediately received an alert from the endpoint agent that Eric's workstation was making suspicious connections outbound. The was retrieved from the network sensor and handed to you for analysis. 

Task: Investigate the packet capture and uncover the malicious activities. 

*Credit goes to Brad Duncan for capturing the traffic and sharing the pcap packet capture with InfoSec community. 

NOTE: DO NOT directly interact with any domains and IP addresses in this challenge. 

Deploy the machine attached to this task; it will be visible in the split-screen view once it is ready.

If you don't see a lab machine load, then click the Show Split View button.


Answer the questions below
Read the above.



Are you ready for the journey?

Please, load the file in your Analysis folder on the Desktop into Wireshark to answer the questions below.

Answer the questions below

What was the date and time for the first HTTP connection to the malicious IP?

(answer format: yyyy-mm-dd hh:mm:ss)

What is the name of the zip file that was downloaded?

What was the domain hosting the malicious zip file?

Without downloading the file, what is the name of the file in the zip file?

What is the name of the webserver of the malicious IP from which the zip file was downloaded?

What is the version of the webserver from the previous question?

Malicious files were downloaded to the victim host from multiple domains. What were the three domains involved with this activity?

Which certificate authority issued the SSL certificate to the first domain from the previous question?

What are the two IP addresses of the Cobalt Strike servers? Use VirusTotal (the Community tab) to confirm if IPs are identified as Cobalt Strike C2 servers. (answer format: enter the IP addresses in sequential order)
What is the Host header for the first Cobalt Strike IP address from the previous question?
What is the domain name for the first IP address of the Cobalt Strike server? You may use VirusTotal to confirm if it's the Cobalt Strike server (check the Community tab).
What is the domain name of the second Cobalt Strike server IP?  You may use VirusTotal to confirm if it's the Cobalt Strike server (check the Community tab).

What is the domain name of the post-infection traffic?

What are the first eleven characters that the victim host sends out to the malicious domain involved in the post-infection traffic? 

What was the length for the first packet sent out to the C2 server?

What was the Server header for the malicious domain from the previous question?

The malware used an API to check for the IP address of the victim’s machine. What was the date and time when the DNS query for the IP check domain occurred? (answer format: yyyy-mm-dd hh:mm:ss UTC)

What was the domain in the DNS query from the previous question?

Looks like there was some malicious spam (malspam) activity going on. What was the first MAIL FROM address observed in the traffic?

How many packets were observed for the SMTP traffic?