Boogeyman 2

Prompts and answers

• What email was used to send the phishing email?
  westaylor23@outlook.com
• What is the email of the victim employee?
  maxine.beck@quicklogisticsorg.onmicrosoft.com
• What is the name of the attached malicious document?
  Resume_WesleyTaylor.doc
• What is the MD5 hash of the malicious attachment?
  52c4384a0b9e248b95804352ebec6c5b
• What URL is used to download the stage 2 payload based on the document's macro?
  https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png
• What is the name of the process that executed the newly downloaded stage 2 payload?
  wscript.exe
• What is the full file path of the malicious stage 2 payload?
  C:\ProgramData\update.js
• What is the PID of the process that executed the stage 2 payload?
  4260
• What is the parent PID of the process that executed the stage 2 payload?
  1124
• What URL is used to download the malicious binary executed by the stage 2 payload?
  https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.exe
• What is the PID of the malicious process used to establish the C2 connection?
  6216
• What is the full file path of the malicious process used to establish the C2 connection?
  C:\Windows\Tasks\updater.exe
• What is the IP address and port of the C2 connection initiated by the malicious binary? (Format: IP address:port)
  128.199.95.189:8080
• What is the full file path of the malicious email attachment based on the memory dump?
  C:\Users\maxine.beck\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\WQHGZCFI\Resume_WesleyTaylor (002).doc
• The attacker implanted a scheduled task right after establishing the c2 callback. What is the full command used by the attacker to maintain persistent access?
  schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\"'