=

Day 4: I’m all atomic inside!

Task 1 - What was the flag found in the .txt file that is found in the same directory as the PhishingAttachment.xslm artefact?

^
  • Open powershell and use the command Invoke-AtomicTest T1566.001 -ShowDetails to get the details about MITRE ATT&CK technique T1566.001 Spearphishing.
    T1566.001 details
    It is downloading 2 files, we have to find and do analysis on thoes files using sysmon.
  • Open event viewer. Goto Applications and Services logs >> Microsoft >> Windows >> Sysmon >> Operational. It would look similar like
    sysmon in event viewer
    ( Remember the Clear log and Refresh options in right hand side )
  • Now start the attack emulation in Powershell using the command Invoke-AtomicTest T1566.001 -TestNumbers 1
  • In event viewer, do refresh. You will see some events
    sysmon in event viewer
    ( In this command you can see the path of the stored file.)
  • Navigate to the file C:\Users\Administrator\AppData\Local\Temp\, and open the file PhishingAttachment.txt and get the flag out.

Answer 👉 THM{GlitchTestingForSpearphishing}

Task 2 - What ATT&CK technique ID would be our point of interest?

^

By reading the challenge. There is a hint for this question.

try hack me challenge snipt

After dong some google search , i got the technique

in depth internet search
https://attack.mitre.org/techniques/T1059/

Answer 👉 T1059

Task 3 - What ATT&CK subtechnique ID focuses on the Windows Command Shell?

^

Open the technique which one you got in previous question. There are many sub techniques. One for Windows Command Shell is T1059.003

result of sub techniques of T1059

Answer 👉 T1059.003

Task 4 - What is the name of the Atomic Test to be simulated?

^

Its time to explore the details about the technique T1059.003 . Using the powershell command Invoke-AtomicTest T1059.003 -ShowDetails. In search for the malware, We can see that test number 4 is related to a ransomware malware.

test number 4 of T1059.003

Answer 👉 Simulate BlackByte Ransomware Print Bombing

Task 5 - What is the name of the file used in the test?

^

  • To find the name of the file that was used in this test. First open sysmon in event manager, Goto Applications and Services logs >> Microsoft >> Windows >> Sysmon >> Operational. Clear the logs

  • Now run the test in powershell using the command Invoke-AtomicTest T1059.003 -TestNumber 4
    running test number 4 of T1059.003
  • Refresh the sysmon, in an event I find the name and full path of a suspicious file.
    suspicious file name and full path

Answer 👉 Wareville_Ransomware.txt

Task 6 - What is the flag found from this Atomic Test?

^

Now we know the full path of the file. Open the file to get out the flag.

Answer 👉 THM{R2xpdGNoIGlzIG5vdCB0aGUgZW5lbXk=}

Task 7 - Learn more about the Atomic Red Team via the linked room.

^

No Answer Needed