TL;DR
The lab hands you four ThreatFox export files and calls the work intelligence analysis. Sixteen questions later you have named a Cobalt Strike beacon hiding behind dot.gif, traced a quarantined Android hash to IRATA spyware, and followed a “private address” a junior analyst skipped straight to AdWind C2 delivered by a weaponized Turkish invoice document. The tooling never gets fancier than Gnumeric and grep. The judgment shows up at the end, when 39,992 of 56,732 rows look safe to block and you have to decide what a proxy rule is worth.
Scenario
As an Intelligence Analyst you are tasked with assisting the SOC Analysts with their investigations, providing additional context and information.
We recommend using Gnumeric to open the CSV files, or Linux CLI commands from within the exports folder.
The investigation
Beaconing to 45.63.126.199/dot.gif
Question (2 points). The SOC recently observed network connections from 3 internal hosts towards hxxp://45.63.126[.]199/dot.gif (URL has been sanitized). What is this activity likely related to?
Answer: Cobalt Strike
How I got there. I searched the ip-port export for the IP with ctrl+f. The row for 45.63.126.199:80 is a botnet_cc indicator, ioc_type ip:port, tagged win.cobalt_strike with the malware_printable value “Cobalt Strike” and a confidence of 100.
Counting dot.gif across the exports
Question (2 points). How many URLs are using the same endpoint ‘dot.gif’, across all export files? (include duplicates)
Answer: 568
How I got there. One command, four files, no eyeballing:
grep -R "dot.gif" -i *.csv | wc -lfull_urls.csv holds 564 of the rows and the smaller exports add 4 more, 568 total.
The quarantined hash on the executive’s phone
Question (2 points). The SHA256 hash of a file was detected and quarantined on one of the Executives old android phones. We are trying to work out what this file does so we can take next steps. The hash value is 6461851c092d0074150e4e56a146108ae82130c22580fb444c1444e7d936e0b5. Is this file associated with malware? If so, what is the malware name? (as stated by Malware Bazaar)
Answer: IRATA
How I got there. Grepping the sha256 export for the hash returns a row that already carries the family name. MalwareBazaar lists the same sample as IRATA, an Android RAT.
Following the reference to IRATA infrastructure
Question (2 points). Investigate the reference link for this SHA256 hash value. Submit the threat name (acronym only), the C2 domain, IP, and the domain registrar.
Answer: IRATA, uklivemy.gq, 20.238.64.240, Freenom
How I got there. The row from the hash search has a reference column, and the link on it opens the full ThreatFox record: threat IRATA, C2 domain uklivemy.gq, IP 20.238.64.240, registered through Freenom.
What the sample can collect
Question (2 points). Visit https://www.joesandbox.com/analysis/1319345/1/html. Investigate the MITRE ATT&CK Matrix to understand the Collection activities this file can take, and what the potential impact is to the Executives work mobile phone. Submit the 5 Technique names in alphabetical order.
Answer: Access Contact List, Access Stored Application Data, Capture SMS Messages, Location Tracking, Network Information Discovery
How I got there. The report’s MITRE ATT&CK matrix lists five techniques under Collection. They are already alphabetical in the report, which makes the ordering step painless. On an executive’s phone those five together mean contacts, messages, stored app data and location walking out the door.
Two ports on the skipped address
Question (2 points). A junior analyst was handling an event that involved outbound connections to a private address and didn’t perform any further analysis on the IP. What are the two ports used by the IP 192.236.198.236?
Answer: 1505, 1506
How I got there. Grepping the ip-port export for the IP returns exactly two rows, ports 1505 and 1506:
grep "192.236.198.236" full_ip-port.csvThe C2 domain behind the IP
Question (2 points). Use the reference to help you further research the IP. What is the C2 domain?
Answer: ianticrish.tk
How I got there. The reference on those rows leads to a threat researcher’s post naming the C2 domain. The same relation shows up on VirusTotal in the IP’s relations tab, so two independent paths point at ianticrish.tk. The feed tags the IP as botnet C2 for AdWind, a Java-based cross-platform RAT also known as AlienSpy or JBifrost.
Delivery method
Question (1 point). What is the likely delivery method into our organization? Provide the Technique name and Technique ID from ATT&CK.
Answer: Phishing (T1566)
How I got there. Everything in the chain so far reaches a user as something they open, and the MalwareBazaar record for the related sample lists delivery via email attachment. ATT&CK maps that to Phishing, T1566.
Naming the weaponized document
Question (2 points). Investigate further and try to find the name of the weaponized Word document, so we can use our EDR to check if it is present anywhere else within the organization.
Answer: 08.2022 pazartesi siparişler.docx
How I got there. The AdWind sample’s MalwareBazaar page lists the original file name: 08.2022 pazartesi siparişler.docx, Turkish for “August 2022 Monday orders”. An invoice-shaped lure with a weekday in the name is a classic malspam pattern, and the missing piece clicks into place here: the delivery question, the .tk C2 and this document are one campaign.
The dropped JAR
Question (2 points). What is the name of the .JAR file dropped by the Word document?
Answer: NMUWYTGOKCTUFSVCHRSLKJYOWPRFSYUECNLHFLTBLFKVTIJJMQ.JAR
How I got there. The JoeSandbox report for the same sample lists the dropped files, and among them sits this all-caps, random-looking .JAR. That is AdWind’s payload stage: a Java archive so it runs on any machine with a JRE, named by a generator rather than a human.
Discord as free malware hosting
Question (1 point). Executives have expressed concern about allowing employees to visit Discord on the corporate network because of online reports that it can be used for malware delivery and data exfiltration. Investigate how Discord can be abused for malicious file storage/distribution! What is the URL of the Discord CDN, ending with /attachments/?
Answer: https://cdn.discordapp.com/attachments/
How I got there. Searching full_urls.csv for “discord” returns rows that all begin the same way. Submitting one complete URL fails the check; cutting it at /attachments/ is what the question wants, the shared base of every Discord-hosted payload.
Counting the Discord rows
Question (1 point). Looking at all export files, how many rows reference this URL? (include duplicates)
Answer: 565
How I got there. Same counting pattern as the dot.gif question:
grep -c "https://cdn.discordapp.com/attachments" *.csv565 rows across the exports.
The family behind the Discord URLs
Question (1 point). Based on this information, what is the name of the malware family that is being widely distributed via Discord?
Answer: Dridex
How I got there. Same rows, malware_printable column: Dridex repeats across the Discord-hosted payloads. That matches public reporting, which has documented Dridex affiliates staging loaders on Discord’s CDN for years.
How much is safe to block
Question (1 point). We can proactively use indicators from threat feeds for detection, or for prevention via blocking. When it comes to blocking indicators, they need to come from a reputable source with a high level of confidence, to avoid blocking legitimate entities. How many rows in the full_urls.csv have a confidence rating of 100, and would likely be safe to block on the web proxy?
Answer: 39992
How I got there. The confidence column sits at column J in full_urls.csv, so one formula does the counting:
=COUNTIF(J:J,"100")39992 rows. One writeup counting by grep pattern reports 39993; three sources that anchor on the column itself report 39992, which is the number I went with.
Unknown malware on port 8001
Question (1 point). An analyst has reported activity coming from an IP address using source port 8001, but they don’t understand what this IP is trying to achieve. Looking at full_ip-port.csv in Gnumeric, filter on malware_printable = Unknown malware, and find an IP that is using port 8001. What is the IP address value?
Answer: 107.172.214.23
How I got there. In full_ip-port.csv I filtered on malware_printable = Unknown malware and looked for port 8001. One row qualifies: 107.172.214.23.
The vulnerability behind the unknown IP
Question (1 point). Investigating the reference material, what is the CVE ID of the vulnerability that this IP has been trying to exploit? And what is the industry nickname for this vulnerability?
Answer: CVE-2021-44228, Log4Shell
How I got there. The reference on that row leads to a researcher post pointing at CVE-2021-44228. Searching the ID brings up the nickname the industry settled on within days: Log4Shell.
What this lab really tests
Whether you can turn a folder of feed exports into decisions. Every question is a small version of the same job: pick the right file, match the indicator, follow the reference one hop, and stop when the evidence is enough to act on. The blocking question is the honest one, because it prices the whole exercise: confidence ratings exist so that “block” has a defensible cost, and counting them is a proxy policy, not a quiz answer.
Skills and techniques
- Linux CLI:
grep -candgrep -R ... | wc -lover large CSV exports - Gnumeric: search across tens of thousands of rows,
=COUNTIF(J:J,"100")on the confidence column - MalwareBazaar: hash lookups, sample pages, delivery tags
- JoeSandbox: reading a MITRE ATT&CK matrix out of a sandbox report
- VirusTotal: IP-to-domain relations pivot
- MITRE ATT&CK: T1566 (Phishing), T1190 (Exploit Public-Facing Application, Log4Shell context)
- Malware families handled: Cobalt Strike, IRATA, AdWind/AlienSpy, Dridex