Hawkeye :
CyberDefenders
Scenario:
An accountant at your organization received an email regarding an invoice with a download link. Suspicious network traffic was observed shortly after opening the email. As a SOC analyst, investigate the network trace and analyze exfiltration attempts.
1(How many packets does the capture have?
Well we can look at :
Or look at Statistics then Capture File Properties :
2(At what time was the first packet captured?
Well if we look at Statistics then Capture File Properties, there you can see the first packet that was captured :
Don’t forget to add UTC at the end
3(What is the duration of the capture?
You can see the elapsed :
4(What is the most active computer at the link level?
You can look at Statistics, then Conversations, and then look at IPV4 :
If we search for the MAC of this IP :
You can look at Statistics, then Conversations, and then look at Ethernet
Here we are confirmed .
5(Manufacturer of the NIC of the most active system at the link level?
Here we must do a MAC Address Lookup for the Mac that we found a moment ago :
6(Where is the headquarter of the company that manufactured the NIC of the most active computer at the link level?
You will use Google this time :
7(The organization works with private addressing and netmask /24. How many computers in the organization are involved in the capture?
You can look at the stats, then the conversations, then look at the IPV4 and you will find the addressing and netmask/24:
8(What is the name of the most active computer at the network level?
We know that the most active IP is 10.4.10.132 and also the owner of the Mac is 00:08:02:1c:47:ae, so :
Also through DNS :
9(What is the IP of the organization’s DNS server?
If you search through DNS :
10(What domain is the victim asking about in packet 204?
We’re going to do go to packet :
Inside packet 204 :
11(What is the IP of the domain in the previous question?
We can see the answer in packet 206 :
12(Indicate the country to which the IP in the previous section belongs.
We can use ip look up website :
13(What operating system does the victim’s computer run?
If we search for any triffic that moves in TCP, and also do a Follow for the TCP Stream, then you will be able to specify what you want in the User Agent:
14(What is the name of the malicious file downloaded by the accountant?
If we go to TAP File, then Export objects, then HTTP ,We will find the malicious file :
This filter can also be used :
In Wireshark, the expression http.request.method == “GET” is a filter that can be used to capture only HTTP GET requests. The == operator is used to compare the value of the http.request.method field to the string “GET”. If the value of the field matches the string, then the packet is captured.
Here is a breakdown of the filter:
http: This part of the filter specifies that we are interested in HTTP packets.\ .request: This part of the filter specifies that we are interested in HTTP request packets.\ .method: This part of the filter specifies that we are interested in the HTTP request method.\ ==: This part of the filter is the comparison operator. It means that we are comparing the value of the http.request.method field to the string “GET”.\ “GET”: This part of the filter is the string that we are comparing the value of the http.request.method field to.
15(What is the md5 hash of the downloaded file?
We’ll go to the TAP file, then Export Objects, then HTTP, so we’ll save the file to find the md5 hash :
Then we will work :
16(What software runs the webserver that hosts the malware?
If we go to the traffic of the downloaded file and then follow and then HTTP Stream :
17(What is the public IP of the victim’s computer?
If we go to http traffic, the src IP will be 10.4.10.132 , We will find the public IP , Specifically, GET traffic, then follow > HTTP Stream :
18(In which country is the email server to which the stolen information is sent?
We know that there is traffic between the IP 10.4.10.132 and the external IP 66.171.248.178 :
When we used IP LOOKUP, to know more information about the IP address
19(Analyzing the first extraction of information. What software runs the email server to which the stolen data is sent?
You can find more information about the programs running the email server by going to “Follow” > TCP stream ,Flow, as we did in question seven :
20(To which email account is the stolen information sent?
The answer does not go away in the same TCP stream :
21(What is the password used by the malware to send the email?
If you notice AUTH login, and there is some encrypted information :
If we use the most famous tool cyberchef.org :
22(Which malware variant exfiltrated the data?
If you notice, you will find that the message content is BASE64 encoded, so we will do BASE64 encoded :
I will use my friend cyberchef.org again :
23(What are the bankofamerica access credentials? (username:password)
Don’t go away, we are in the right place :
24(Every how many minutes does the collected data get exfiltrated?
If you select the last two traffic, for example, and then open Follow>>TCP Stream :
Look at the time here :
tcp.stream eq 37
And here :
tcp.stream eq 35
If you subtract the two from each other, you will get the result you want. Remember, he wants minutes .
💬 "Control the code, and you control the world." 🔐 From wiping metadata to gaining root access — every step is documented and my goal is to deeply understand the system, not just hack!
See You Soon
AS Cyber “)).