TryHackMe — Redline
Learn how to use Redline to perform memory analysis and to scan for IOCs on an endpoint.
I really suck at memory analysis, so this is going to be a toughie
Task 1 Introduction
Question 1:
Who created Redline?
HOW: Answer is in the above text. Linking the page for future reference.
https://fireeye.market/apps/211364
Answer: fireeye
Task 2 Data Collection
Question 1:
What data collection method takes the least amount of time?
Answer: Standard Collector
Question 2:
You are reading a research paper on a new strain of ransomware. You want to run the data collection on your computer based on the patterns provided, such as domains, hashes, IP addresses, filenames, etc. What method would you choose to run a granular data collection against the known indicators?
Answer: IOC Search Collector
Question 3:
What script would you run to initiate the data collection process? Please include the file extension.
Answer: RunRedlineAudit.bat
Question 4:
If you want to collect the data on Disks and Volumes, under which option can you find it?
Answer: disk enumeration
Question 5:
What cache does Windows use to maintain a preference for recently executed code?
HINT: Check the Redline User Guide
Answer: prefetch
Task 3 The Redline Interface
Question 1:
Where in the Redline UI can you view information about the Logged in User?
Answer: System Information
Task 4 Standard Collector Analysis
Question 1:
Provide the Operating System detected for the workstation.
HINT: Check System Information
HOW: My machine crashed, so I lost the image I had made. I found the lab one in C:\Users\Administrator\Documents\Analysis\Sessions\AnalysisSession1. When I opened that I went to System Information, and scrolled down.
Answer: Windows Server 2019 Standard 17763
Question 2:
Provide the BIOS Version for the workstation.
HINT: Check System Information. If the answer doesn’t match, are you using the imported analysis?
HOW: I had to make a new analysis, so I did other questions using the session already in the image to answer the other questions while I waited.
Answer: AMAZON — 1
Question 3:
What is the suspicious scheduled task that got created on the victim’s computer?
HOW: Went to tasks, and the suspicious one really stands out.
Answer: MSOfficeUpdateFa.ke
Question 4:
Find the message that the intruder left for you in the task.
HINT: Check the “Comment” section for the scheduled task
HOW: It’s in the comment section of the above screenshot
Answer: THM-p3R5IStENCe-m3Chani$m
Question 5:
There is a new System Event ID created by an intruder with the source name “THM-Redline-User” and the Type “ERROR”. Find the Event ID #.
HOW: Go to events, search for “THM-Redline-User” and you will find it easily:
Answer: 546
Question 6:
Provide the message for the Event ID.
HOW: Click on the even you found in the last question and you will get an expanded view of the message.
Get Y3T1_’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer: Someone cracked my password. Now I need to rename my puppy-++-
Question 7:
It looks like the intruder downloaded a file containing the flag for Question 8. Provide the full URL of the website.
HOW: I went to the download history, and one of the files is called flag.txt
Answer: https://wormhole.app/download-stream/gI9vQtChjyYAmZ8Ody0AuA
Question 8:
Provide the full path to where the file was downloaded to including the filename.
HOW: All details are in the previously found file.
Answer: C:\Program Files (x86)\Windows Mail\SomeMailFolder\flag.txt
Question 9:
Provide the message the intruder left for you in the file.
HOW: Copy and paste the above path into file explorer and read the .txt file
Answer: THM{600D-C@7cH-My-FR1EnD}
Task 5 IOC Search Collector
Handy Link for the future: https://www.fireeye.com/content/dam/fireeye-www/services/freeware/ug-ioc-editor.pdf.
NOTE: I’m getting really annoyed with this one. My VM crashed again, and then I couldn’t open the IOC, so I had to run it again. It’s been over an hour of just trying to get ready to answer these questions.
I gave up and googled it. It turns out that this room is just broken, and it’s known to not work. I guess they haven’t updated it.
There is discussion for a solution (on reddit i think). Basically you need to create an IoC report from the existing scan on the machine ( C:\Users\Administrator\Documents\Analysis\Sessions\AnalysisSession1), creating a new IoC search collector doesn't work.So for tasks 5 and 6 I recommend following this writeup, and reading how they got their answers since this is essentially crap.
Task 7 Endpoint Investigation
Question 1:
Can you identify the product name of the machine?
HOW:
Answer: Windows 7 Home Basic
Question 2:
Can you find the name of the note left on the Desktop for the “Charles”?
HOW:
Answer: \_R_E_A_D___T_H_I_S___AJYG1O_.txt
Question 3:
Find the Windows Defender service; what is the name of its service DLL?
HOW:
Answer: MpSvc.dll
Question 3:
The user manually downloaded a zip file from the web. Can you find the filename?
HOW:
Answer: eb5489216d4361f9e3650e6a6332f7ee21b0bc9f3f3a4018c69733949be1d481.zip
Question 4:
Provide the filename of the malicious executable that got dropped on the user’s Desktop.
HOW:
Answer: Endermanch@Cerber5.exe
Question 5:
Provide the MD5 hash for the dropped malicious executable.
HOW:
Answer: fe1bc60a95b2c2d77cd5d232296a7fa4
Question 6:
What is the name of the ransomware?
HOW: Looked at the hash on virustotal.com
Answer: Cerber
CONCLUSION:
This is obviously a useful tool, but my word was this ever a pointless endeavour in this room. THM really needs to improve the stability of the VMs as there is no good reason for this to have taken me so long. For hours now I’ve just been fighting with this virtual machine.
Even including the analysis files in the image would make this so much easier. That way when your VM inevitably crashes you can just open the image and you don’t have to fuck around for 30 minutes recapturing everything, and then fighting with it further.
