Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

The Waiting Room

A supplier email hides an odd attachment. Follow the evidence and find what left the workstation.

Task 1: Digital Forensics The Waiting Room

STRANGE & UNUSUAL ACTIVITY // FORENSICS 

The Waiting Room

MEDIUM
A routine supplier email has left Michelle Smith with an attachment that did not open as expected. Examine the correspondence, trace the workstation activity, and determine what happened after she opened it.
ATTACHMENT FORENSICS MALWARE ANALYSIS NETWORK FORENSICS
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Michelle Smith received a supplier email about an upcoming payment run. After she opened an attachment, her workstation contacted an unfamiliar service. Your task is to investigate the supplied email, Windows events, and captured traffic to reconstruct the execution chain and determine what left the workstation.

EVIDENCE PROVIDED
+ Supplier Email (.eml)
+ Windows Event Log (.evtx)
+ Network Capture (.pcap)
02 // OBJECTIVES
01. Identify the attachment responsible for the suspicious activity.
02. Reconstruct the execution chain using the Windows events.
03. Examine the attachment and correlate its behavior with the captured traffic.
04. Recover the transferred data and establish what left the workstation.
ANALYST NOTE
Analyze the attachment without executing it. Use the Windows events and captured traffic to distinguish what the attachment contains from what actually ran.
 
SUSPICIOUS_ATTACHMENT_ACTIVITY // CASE FILE OPEN
THE_WAITING_ROOM // FORENSICS // MALWARE_ANALYSIS

Answer the questions below

  1. What is the SHA-256 hash of the embedded attachment that initiated the suspicious activity?

  2. Which Unicode code point was used to disguise that attachment’s displayed filename? 

  3. Which hostname served the downloaded stage?

  4. What was the process ID of the interpreter that executed the downloaded script?

  5. What encryption key protected the document transferred from the workstation?

  6. What is the SHA-256 hash of the document transferred from the workstation?

Room Icon

The Waiting Room

A supplier email hides an odd attachment. Follow the evidence and find what left the workstation.

medium

45 min

Team room

100

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
STRANGE & UNUSUAL ACTIVITY // FORENSICS 

The Waiting Room

MEDIUM
A routine supplier email has left Michelle Smith with an attachment that did not open as expected. Examine the correspondence, trace the workstation activity, and determine what happened after she opened it.
ATTACHMENT FORENSICS MALWARE ANALYSIS NETWORK FORENSICS
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Michelle Smith received a supplier email about an upcoming payment run. After she opened an attachment, her workstation contacted an unfamiliar service. Your task is to investigate the supplied email, Windows events, and captured traffic to reconstruct the execution chain and determine what left the workstation.

EVIDENCE PROVIDED
+ Supplier Email (.eml)
+ Windows Event Log (.)
+ Network Capture (.)
02 // OBJECTIVES
01. Identify the attachment responsible for the suspicious activity.
02. Reconstruct the execution chain using the Windows events.
03. Examine the attachment and correlate its behavior with the captured traffic.
04. Recover the transferred data and establish what left the workstation.
ANALYST NOTE
Analyze the attachment without executing it. Use the Windows events and captured traffic to distinguish what the attachment contains from what actually ran.
 
SUSPICIOUS_ATTACHMENT_ACTIVITY // CASE FILE OPEN
THE_WAITING_ROOM // FORENSICS // MALWARE_ANALYSIS
Answer the questions below

What is the SHA-256 hash of the embedded attachment that initiated the suspicious activity?

Which Unicode code point was used to disguise that attachment’s displayed filename? 

Which hostname served the downloaded stage?

What was the process ID of the interpreter that executed the downloaded script?

What encryption key protected the document transferred from the workstation?

What is the SHA-256 hash of the document transferred from the workstation?