Heartbreaker
Description
Files
└─$ 7z x HeartBreaker.zip -P'hacktheblue'Tasks
Task 1. The victim received an email from an unidentified sender. What email address was used for the suspicious email?
└─$ find . -iname '*mail*'
./wb-ws-01/C/Users/ash.williams/AppData/Local/Microsoft/Outlook/ashwilliams012100@gmail.com.ost
└─$ cd ./wb-ws-01/C/Users/ash.williams/AppData/Local/Microsoft/Outlook
└─$ file ashwilliams012100@gmail.com.ost
ashwilliams012100@gmail.com.ost: Microsoft Outlook Offline Storage (>=2003, Unicode, version 36), dwReserved1=0x78, dwReserved2=0x12ff86, bidUnused=0000000000000000, dwUnique=0x164f, 16818176 bytes, CRC32 0x28f18ca3
└─$ pffexport ashwilliams012100@gmail.com.ost # https://unix.stackexchange.com/a/611130
└─$ find . -empty -delete # Cleanup
└─$ tree -h -L 1
[4.0K] .
├── [4.0K] Contacts (This computer only)
├── [4.0K] [Gmail]
└── [4.0K] Inbox
4 directories, 0 files
Task 2. It appears there's a link within the email. Can you provide the complete URL where the malicious binary file was hosted?
Task 3. The threat actor managed to identify the victim's AWS credentials. From which file type did the threat actor extract these credentials?
Task 4. Provide the actual IAM credentials of the victim found within the artifacts.
Task 5. When (UTC) was the malicious binary activated on the victim's workstation?
Task 6. Following the download and execution of the binary file, the victim attempted to search for specific keywords on the internet. What were those keywords?
Task 7. At what time (UTC) did the binary successfully send an identical malicious email from the victim's machine to all the contacts?
Task 8. How many recipients were targeted by the distribution of the said email excluding the victim's email account?
Task 9. Which legitimate program was utilized to obtain details regarding the domain controller?
Task 10. Specify the domain (including sub-domain if applicable) that was used to download the tool for exfiltration.
Task 11. The threat actor attempted to conceal the tool to elude suspicion. Can you specify the name of the folder used to store and hide the file transfer program?
Task 12. Under which MITRE ATT&CK technique does the action described in question #11 fall?
Task 13: Can you determine the minimum number of files that were compressed before they were extracted?
Task 14: To exfiltrate data from the victim's workstation, the binary executed a command. Can you provide the complete command used for this action?
Last updated