Investigating Windows 3.x

What is the rule name for this run key generated by Sysmon?

What tactics is classified with this MITRE ATT&CK ID?

What was UTC time for the Sysmon event?

What was the Sysmon Event ID? Event Type? (answer, answer)

Decode the payload. What service will the payload attempt start?

What process does the payload attempt to terminate?

What DLL file does the payload attempt to remove? (full path)

What is the Windows Event ID associated with this service?

What is listed as the New Default Printer?

What process is associated with this event?

Examine the other processes. What is the PID of the process running the encoded payload?

Decode the payload. What is the a visible partial path?

This is the default communication profile the agent used to connect to the attack machine. What attack framework was used? What is the name of the variable? (answer, answer)

What other file paths are you likely to find in the logs? (answer, answer)

What is the MITRE ATT&CK URI for the attack framework?

What other process connected to the attacker machine?

What is the PID for this process?

What was the path for the first image loaded for the process identified in Q's 19 & 20?

What Sysmon event was generated between these 2 processes? What is its associated Event ID #? (answer, answer)

What is the UTC time for the first event between these 2 processes?

What is the value under Date and Time? (MM/DD/YYYY H:MM:SS [AM/PM])

What is the first operation listed by the 2nd process starting with the Date and Time from Q25?

What is the name of the last module in the stack from this event which had a successful result?

Most likely what module within the attack framework was used between the 2 processes? 

What is the MITRE ID for this technique?