Get in touch
Countdown Walkthrough
Fabian Sybille • July 14, 2021
Scenario
NYC Police received information that a gang of attackers has entered the city and are planning to detonate an explosive device. Law enforcement have begun investigating all leads to determine whether this is true or a hoax.
Persons of interest were taken into custody, and one additional suspect named ‘Zerry’ was detained while officers raided his house. During the search they found one laptop, collected the digital evidence, and sent it to NYC digital forensics division.
Police believe Zerry is directly associated with the gang and are analyzing his device to uncover any information about the potential attack.
Verify the Disk Image. Submit SectorCount and MD5
- The disk image is located at C:\Users\BTLOTest\Desktop\Investigation Files\Disk Image\Zerry
- The below text file is always generated when FTK Imager is used to create the disk image. These details can be used to verify the integrity of the disk image.
What is the decryption key of the online messenger app used by Zerry?
- Launch Autopsy from the desktop and open the Countdown.aut file that's located in the Countdown folder on the desktop.
- Before we find the decryption key, we have to figure out the online messenger app that's being used. Once Countdown.aut is open in Autopsy, there's an Installed Programs folder but it doesn't have any instant messaging apps inside of it. From here I went to the Prefetch folder. Prefetch shows what applications have executed. Inside of the Prefetch folder we see SIGNAL.EXE, a known encrypted messaging app.
- Just to see if we could find it anywhere else, I also looked in the Downloads folder for the user, Zerry and the Signal exe was there also.
- There's also a Signal folder in the AppData/Roaming folder
- That's 3 places we've found evidence or artifacts of the Signal exe running.
- Now that we've found the encrypted messaging app, we need to find the decryption key. I googled "signal decryption key" and the first result had the answer. The decryption key is located at AppData/Roaming/Signal/config.json. After clicking config.json, the key is in the lower right pane.
What is the registered phone number and profile name of Zerry in the messenger application use?
- We'll use the key we just found to decrypt the file db.sqlite, this is where all of the messages are stored. File is located in AppData/Roaming/Signal/sql. Right click the file and export it to the desktop.
- Now we have to use SQLLiteDatabaseBrowserPortable.exe to open the file db.sqlite and decrypt it. The application can be found in the Investigation Files folder from the desktop. Once you open the application, choose Open Database at the top and choose db.sqlite from the desktop. In the password field, enter 0x before pasting in the decryption key. Also make sure to choose Raw key from the dropdown on the right.
- Now we need the phone number and the profile name. Click the Browse Data tab at the top and then click the dropdown next to Table and choose conversations. Scroll to the right and you'll see the column titled profileName. The phone number is in the e164 column. In order to get the emoji, press Win+ for the emoji keyboard.
What is the email id found in the chat?
- In the dropdown next to table, choose messages. Scroll to the right until you find the body column. Looking in that column for the email address.
Social
Scenario One of our web servers triggered an AV alert, but none of the sysadmins say they were logged onto it. We've taken a network capture before shutting the server down to take a clone of the disk. Can you take a look at the PCAP and see if anything is up? Analysis Immediately when looking at the pcap, we can see a TCP 3 way handshake taking place between 22.22.22.7 and 22.22.22.5 with the .7 address initiating it. The requests are also coming from the .7 address which tells us that the .5 address is the web server. We also see /upload.aspx. Aspx lets us know the server is likely running asp.net. So it's likely a windows server.
Scenario The Security Operations Center at Defense Superior are monitoring a customer’s email gateway and network traffic (Crimeson LLC). One of the SOC team identified some anomalous traffic from Josh Morrison’s workstation, who works as a Junior Financial Controller. When contacted Josh mentioned he received an email from an internal colleague asking him to download an invoice via a hyperlink and review it. The email read: There was a rate adjustment for one or more invoices you previously sent to one of our customers. The adjusted invoices can be downloaded via this [link] for your review and payment processing. If you have any questions about the adjustments, please contact me. Thank you. Jacob Tomlinson, Senior Financial Controller, Crimeson LLC. The SOC team immediately pulled the email and confirmed it included a link to a malicious executable file. The Security Incident Response Team (SIRT) was activated and you have been assigned to lead the way and help the SOC uncover what happened. You have NetWitness and Wireshark in your toolkit to help find out what happened during this incident. What is the full filename of the initial payload file? The scenario says the invoice was downloaded via a hyperlink. The first thing that came to mind was a GET request to the url attached to the hyperlink. GET requests are used when retrieving executables from URLs. So I opened the pcap in wireshark and filtered for GET requests.
TrickBot was originally designed as a banking Trojan to steal financial data. A favorite of cyber criminals and typically distributed via phishing campaigns.