THM — Snapped Phish-ing Line
As a member of the IT department at SwiftSpend Financial, you are responsible for assisting employees with technical concerns. What initially appeared to be a routine day quickly escalated when multiple employees across different departments reported receiving a suspicious email. Several users noted unusual characteristics in the message, and unfortunately, some had already submitted their credentials and were no longer able to access their accounts. With the potential for a wider compromise, the incident has been escalated for investigation. Your task is to analyze the available evidence, determine the scope of the attack, and uncover how the adversary operated.
Objectives
- Analyze the provided email samples to identify key artifacts
- Investigate phishing URLs to understand redirection
- Retrieve and examine the phishing kit used in the attack
- Use CTI tools to gather intelligence on the adversary
- Analyze the phishing kit to uncover additional indicators
Prerequisites
It is suggested that you complete the previous four rooms of the Phishing Analysis Module to help prepare you for email analysis:
- Check out Phishing Analysis Fundamentals for an overview of email communications and analysis
- Explore Phishing Emails in Action to gain experience analyzing phishing emails
- Go over Phishing Analysis Tools to learn about tools that enable deeper email analysis
- Cover Phishing Prevention to learn about preventing, detecting, and mitigating email threats
Lab Access
To begin, click the Start Machine button to deploy the virtual machine. Once the environment has loaded in the split-screen view, navigate to the desktop and open the phish-emails folder to begin your investigation. Best of luck in your investigation!
Get Eko Dimas Prasetyo’s stories in your inbox
Join Medium for free to get updates from this writer.
Begin reviewing the emails in the phish-emails folder on your desktop.
Which individual received the email regarding a Quote for Services Rendered?
First, open the phish-emails folder, then open the file Quote for Services Rendered
Once you open it, you can see who this email was sent to…
Answer: William McClean
What email address was used by the adversary to send the phishing emails?
The attacker’s email address can be seen in the From field
Answer: Accounts.Payable@groupmarketingonline.icu
Investigate the attachment in the email addressed to Zoe Duncan.
What is the root domain of the redirection URL found within the file?
First, download the email attachment addressed to Zoe Duncan. Then open the file.
Here, we know that the attacker created a Microsoft website login page with the domain kennaroads.buzz
Answer: kennaroads.buzz
Open the attachment in your VM web browser.
Which company is the login page impersonating?
It’s very clear that the company is Microsoft
Answer: Microsoft
Let’s check if the attacker left any files exposed on the same website.
Navigate to the /data directory.
What is the name of the archive file?
Let’s set the URL path to kennaroads.buzz/data/ to locate the archive file.
Answer: Update365.zip
Download the phishing kit archive to your virtual environment.
Using the sha256sum command, what is the SHA256 hash of the file?
Use sha256sum
damianhall@ip-10-67-186-77:~/Downloads$ ls
Update365.zip
damianhall@ip-10-67-186-77:~/Downloads$ sha256sum Update365.zip
ba3c15267393419eb08c7b2652b8b6b39b406ef300ae8a18fee4d16b19ac9686 Update365.zipAnswer: ba3c15267393419eb08c7b2652b8b6b39b406ef300ae8a18fee4d16b19ac9686
Investigate the file hash from the previous question using VirusTotal.
Aside from phishing, what other threat category is assigned to the ZIP archive?
We already have the hash for the Update365.zip file; now we just need to search for it on VirusTotal.
In addition to phishing, we know there’s also a Trojan threat from that ZIP file
Answer: Trojan
Review the VirusTotal Details page for the phishing kit.
How many files are contained within the archive?
While still on the VirusTotal page, open the “Details” tab, then scroll down a bit until you find “Bundle Info”
There, you’ll see how many files are in the archive.
Answer: 49
Let’s see if the attacker has exposed any captured credentials.
Navigate to the /data/Update365/ directory and investigate the log file.
What is the email address of the user who submitted their credentials more than once?
Go to the URL /data/Update365/log.txt ,
There you can see users who have already submitted their credentials to the phishing website
Answer: michael.ascot@swiftspend.finance
Extract the phishing kit archive and locate the submit.php file.
What email address is used by the adversary to collect compromised credentials?
Open the submit.php
The email address used by the adversary to collect credentials is found on line 49
Answer:
m3npat@yandex.com
Return to the phishing URL and locate the flag.txt file.
Using CyberChef to decode the flag, what is the secret value?
At first, I wasn’t sure where flag.txt was
I suspected the /office365 path because when I went there, I was immediately redirected to /ea8e432daa......
So I tried replacing /ea8e432daa……… with /flag.txt, and it turned out my hunch was right.
It contains an encrypted message, in the question has already provided a link to CyberChef to decrypt the message directly.
Answer: THM{pL4y_w1Th_tH3_URL}
