Snapped Phishing Line

Prompts and answers

• ![[Pasted image 20230708224448.png]]
  William McClean
• What email address was used by the adversary to send the phishing emails?
  Accounts.Payable@groupmarketingonline.icu
• Use CyberChef to defang the URL
  hxxp[://]kennaroads[.]buzz/data/Update365/office365/40e7baa2f826a57fcf04e5202526f8bd/?email=zoe[.]duncan@swiftspend[.]finance&error
• ![[Pasted image 20230708231224.png]]
  hxxp[://]kennaroads[.]buzz/data/Update365[.]zip
• What is the SHA256 hash of the phishing kit archive?
  ba3c15267393419eb08c7b2652b8b6b39b406ef300ae8a18fee4d16b19ac9686
• Use an Open Source tool similar to https://threatbook.io and https://urlscan.io which you can use to gather more information about the domain.
  2020-04-08 21:55:50 UTC
• When was the phishing domain that was used to host the phishing kit archive first registered? (format: YYYY-MM-DD)
  2020-06-25
• What was the email address of the user who submitted their password twice?
  michael.ascot@swiftspend.finance
• Examine the phishing kit.
  m3npat@yandex.com
• The adversary used other email addresses in the obtained phishing kit. What is the email address that ends in "@gmail.com"?
  jamestanner2299@gmail.com
• The flag contains a ".txt" extension and, with some adjustments, should be downloadable from the phishing URL.
  THM{pL4y_w1Th_tH3_URL}