Skip to content

Index

  • in THM
  • 4 min read

THM - Advent of Cyber 2022 - Day 13


Difficulty: ⭐
Challenge Link
OS: Linux

After receiving the phishing email on Day 6 and investigating malware on Day 12, it seemed everything was ready to go back to normal. However, monitoring systems started to show suspicious traffic patterns just before closing the case. Now Santa's SOC team needs help in analysing these suspicious network patterns.

Learning Objectives

  • Learn what traffic analysis is and why it still matters.
  • Learn the fundamentals of traffic analysis.
  • Learn the essential Wireshark features used in case investigation.
  • Learn how to assess the patterns and identify anomalies on the network.
  • Learn to use additional tools to identify malicious addresses and conduct further analysis.
  • Help the Elf team investigate suspicious traffic patterns.
  • in THM
  • 3 min read

THM - Advent of Cyber 2022 - Day 12


Difficulty: ⭐⭐
Challenge Link
OS: Linux

The malicious document attached to the phishing email was confirmed to have been executed. Aside from the fact that rogue connections were observed, we know little about what it does.

Our in-house expert Forensic McBlue confirmed that the malicious document spawned another suspicious binary. Pivoting from that, he dumped it from memory for this task to be further analysed via Malware Analysis.

Learning Objectives

  • Learn the fundamentals of analysing malware samples without relying on automated sandbox scanners.
  • Learn and understand typical malware behaviour and its importance in the incident investigation pipeline.