Reaper Writeup
Sherlock Scenario
Our SIEM alerted us to a suspicious logon event which needs to be looked at immediately . The alert details were that the IP Address and the Source Workstation name were a mismatch .You are provided a network capture and event logs from the surrounding time around the incident timeframe. Corelate the given evidence and report back to your SOC Manager.
A ZIP archive named Reaper.zip is provided containing the artifacts required for analysis.
Initial Phase
The investigation starts with a ZIP file with the artifacts Network logs and Windows Security event log.evtx.
These artifacts are a record of evidence gathered by a breached system and are utilized to create the sequence of attack.
Analysis
What is the IP Address for Forela-Wkstn001?
- Brute-force attempt may be witnessed where it is observed that repeated requests are sent within brief time by the same user.
Ans : 172.17.79.129
2. What is the IP Address for Forela-Wkstn002?
Ans: 172.17.79.136
3. What is the username of the account whose hash was stolen by attacker?
NetBIOS Name Service was used for attacks. Filtering protocol NBNS helped in identifying an unknown device which had ip 172.17.79.135.
Filtered the ip which helped us find the leaked hash of user arthur.kyle
Ans : arthur.kyle
4. What is the IP Address of Unknown Device used by the attacker to intercept credentials?
Ans: 172.17.79.135
5. What was the fileshare navigated by the victim user account?
Get fb11add9’s stories in your inbox
Join Medium for free to get updates from this writer.
Ans: \\DC01\Trip
This points to a network share named trip that is accessible on the server DC01.
If this path appears in:
- Security.evtx logs → it may indicate authentication or object access events
- Network logs → it may show SMB traffic or remote file access
6. What is the source port used to logon to target workstation using the compromised account?
The Security.evtx file is opened using a Windows Event Log analysis tool. Searching for fileshare found details shown in the picture.
Ans : 40252
7. What is the Logon ID for the malicious session?
Ans: 0x64a799
8. The detection was based on the mismatch of hostname and the assigned IP Address.What is the workstation name and the source IP Address from which the malicious logon occur?
The the mismatch of hostname and IP Address which is 172.17.79.135 was found to be the unknown device found to found previously in network logs above but here the host name is Forela-Wkstn002.
Ans: FORELA-WKSTN002, 172.17.79.135
9. At what UTC time did the the malicious logon happen?
The Event Viewer shows 7/31/2024 10:40:16 AM as NTP in my personal device. So converted it into UTC and submitted my flag.
Ans: 2024–07–31 04:55:16
10. What is the share Name accessed as part of the authentication process by the malicious tool used by the attacker?
The share file seems to be \\*\IPC$ which is listed in the Share Information.
Ans: \\*\IPC$
Finally Completed the Room ;)!!
