Business CTF 2023 - Looking at Forensics Challenges from last years' competition by 0xdf
Source: YouTube · Hack The Box · published Jul 13, 2023 · 27:20
This video walks through solving two forensics challenges from Business CTF 2022: "MB coin" and "Perseverance," demonstrating analysis of real malware artifacts including a phishing document and WMI persistence 0:00-1:54.
Key Takeaways:
• The MB coin challenge involves analyzing a phishing document with obfuscated VBA macros that drops a VB script to download DLLs 1:56-4:04. The macros hide malicious code in document shapes and use string reversal 4:05-5:58.
• The VB script downloads five DLLs and decrypts them with custom XOR keys, then executes the final DLL using rundll32 6:01-13:00. Since the URLs don't exist, you must extract the DLL from the provided PCAP 13:00-16:20.
• The Perseverance challenge focuses on WMI persistence, which uses three components: filters (when to trigger), consumers (what action to take), and bindings (connecting filters to consumers) 17:00-19:47.
• You can use FLARE team's Python scripts (pywbem) to parse the WMI repository and identify malicious filter-consumer bindings 19:48-23:44.
• The final flag is extracted from an encrypted key within a .NET executable recovered from the WMI repository after base64 decoding and decompression 23:44-27:16.
These challenges demonstrate practical forensic analysis techniques for real-world malware samples including phishing documents and WMI persistence mechanisms.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hey y'all this is oxdf and uh today for the business CTF 2023 we're going to be looking at a couple of the forensics challenges from the 2022 business CTF uh the first one of them is the MB coin the challenge I actually got to create um it was a fun one to make and uh hopefully find one to solve it's a real piece of malware a real fishing dock and it's a Word document that has some lightly obfuscated uh Visual Basic for applications like macros in there and uh it drops a VB script which then downloads a handful of dlls or tries to now if you run that it's not going to actually download them because those the URLs it connects to aren't don't exist but we also get a pcap with the challenge and we can go through the pcap and carve out the requests that were made figure out how to take the dat…