NTFS Forensics Challenge LetsDefend
Hello Everyone. Today we are going to be doing a walkthrough on the challenge listed above. We will start by unzipping the mft.zip file in the ChallengeFile folder. Now we will use MFTECmd.exe to parse the MFT file to then analyze the output CSV file with Timeline Explorer:
The first question we are asked is what isthe malicious file that was downloaded. To solve that, we will type in the search box “Zone ID,” as this is associated with downloaded files and look for something suspicious. We found something immediately:
scanner98.zip is our culprit. Our next question is what is the source URL where the file was downloaded from. If we look around in the scanner98.zip file entry, we find:
The answer is the URL in the picture. Our next question was: when was the file downloaded? That would be the Last Access0x30 entry of the scanner98.zip file:
In the next question, we are asked what is the malicious PowerShell script that was downloaded onto the system. In order to do that, we will sort by extension by clicking the extension tab at the top of the screen:
This will sort the files by extension and then we want to look for the files with a .ps1 extension that has the downloads folder in its path:
The answer is x.ps1. We get asked the file size of the PowerShell script; scroll over until you see:
152 would be your answer. For this last part, we are going to use MFTExplorer to get the last bit of information we need. Go ahead and load up the $MFT file in the ChallengeFile folder and follow the path given in the previous question:
If you scroll down the data interpreter, you’ll come across a URL:
This would be your answer:https://raw.githubusercontent.com/samratashok/nishang/master/Gather/Keylogger.ps1
Get Dh’s stories in your inbox
Join Medium for free to get updates from this writer.
We see that this is a keylogger, so let’s look up what MITRE technique keylogging is.
Lastly, it asks us what cmdlet was used to execute the keylogger script. If you go back to the data interpreter, right before the URL, you see a “-c” and “IEX”. IEX is the cmdlet. Here’s a picture just in case:
That completes this challenge!
