New Hire Old Artifacts

Prompts and answers

• A Web Browser Password Viewer executed on the infected machine. What is the name of the binary? Enter the full path.
  C:\Users\FINANC~1\AppData\Local\Temp\11111.exe
• What is listed as the company name?
  NirSoft
• Another suspicious binary running from the same folder was executed on the workstation. What was the name of the binary? What is listed as its original filename? (format: file.xyz,file.xyz)
  IonicLarge.exe,PalitExplorer.exe
• The binary from the previous question made two outbound connections to a malicious IP address. What was the IP address? Enter the answer in a defang format.
  2[.]56[.]59[.]42
• The same binary made some change to a registry key. What was the key path?
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
• Some processes were killed and the associated binaries were deleted. What were the names of the two binaries? (format: file.xyz,file.xyz)
  WvmIOrcfsuILdX6SNwIRmGOJ.exe,phcIAmLJMAIMSa9j9MpgJo1m.exe
• The attacker ran several commands within a PowerShell session to change the behaviour of Windows Defender. What was the last command executed in the series of similar commands?
  powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
• Based on the previous answer, what were the four IDs set by the attacker? Enter the answer in order of execution. (format: 1st,2nd,3rd,4th)
  2147735503,2147737010,2147737007,2147737394
• Another malicious binary was executed on the infected workstation from another AppData location. What was the full path to the binary?
  C:\Users\Finance01\AppData\Roaming\EasyCalc\EasyCalc.exe
• What were the DLLs that were loaded from the binary from the previous question? Enter the answers in alphabetical order. (format: file1.dll,file2.dll,file3.dll)
  ffmpeg.dll,nw.dll,nw_elf.dll