USB attack investigation
Mallory’s critical PowerPoint presentation on her MacBook gets encrypted by ransomware on August 18. What is the name of this file after it was encrypted?
index="botsv2" host="MACLORY-AIR13" (*.ppt OR *.pptx)
There is a Games of Thrones movie file that was encrypted as well. What season and episode is it?
index="botsv2" host="MACLORY-AIR13" sourcetype=ps *.crypt_ NOT *.pdf
Kevin Lagerfield used a USB drive to move malware onto kutekitten, Mallory’s personal MacBook. She ran the malware, which obfuscates itself during execution. Provide the vendor name of the USB drive Kevin likely used. Answer Guidance: Use time correlation to identify the USB drive.
index="botsv2" host="kutekitten" "\\/Users\\/mkraeusen" sourcetype=osquery_results "columns.target_path"="/Users/mkraeusen/Downloads/Important_HR_INFO_for_mkraeusen"
The device was infected before this event, so change the query to (but do NOT enter yet)
index="botsv2" host="kutekitten" usb
In the still listed events from the previous query:
|Go back to the bottom and apply 60 seconds before that first event|
Search in the events for
vendor_id and use it to find the vendor name.
Alcor Micro Corp.
What programming language is at least part of the malware from the question above written in?
When was this malware first seen in the wild? Answer Guidance: YYYY-MM-DD
The malware infecting kutekitten uses dynamic DNS destinations to communicate with two C&C servers shortly after installation. What is the fully-qualified domain name (FQDN) of the first (alphabetically) of these destinations?
From the question above, what is the fully-qualified domain name (FQDN) of the second (alphabetically) contacted C&C server?