Frognado in Valdoria| KC7 walkthrough

The Valdorian Times has published another groundbreaking article ahead of the election. This time, it’s about the incumbent mayoral candidate. According to the Times, the Mayor took bribes from FramtidX, a development company, to allow them to build a mall on protected land, a special marsh home to endangered frogs. 🐸🌿

Is this another fake story published by the Times, or is there any truth to it? As a cybersecurity analyst for FramtidX, you must dig deep, uncover the cyber side of the scandal, and discover the truth. 🕵️‍♂️💻🔍 Every piece of evidence you find will help reveal the reality behind the headlines. Can you solve the mystery and protect the future of Valdoria? ⚖️🌟

Module Link: https://kc7cyber.com/challenges/227

Happy Hunting 🕵️‍♂️🕵️‍♂️🕵️‍♂️

Section 1: Maybe it’s just a tadpole? 😢👀

FramtidX’s website has been defaced, and it’s definitely not a good look for a company that boasts about having all the latest tech at their disposal.

Also what’s up with those angry frogs?

Question 2: What is the MITRE ATT&CK ID for defacement?

Answer: T1491

Question 3: Who is the Web Administrator? (Paste the full name.)

Answer: Anita Bath

Question 4: What is the hostname of the Web Administrator machine?

Answer: MYZB-LAPTOP

First, let’s find proof that the update to the website was made from her machine. The defacement is signed by Valdoria’s number one enemy, the Shadow Truth. Maybe we can find that string somewhere?

Question 5: When did the defacement happen exactly?

Answer: 2024–07–10T11:45:50.000Z

Question 6: When was the first image uploaded? (Paste the full timestamp.)

Answer: 2024–07–10T10:53:37.000Z

Question 7: What is the Sha256 hash of the first meme that was uploaded to the webserver?

Answer: 9880c2d74afb2e57c7de7b9d6d0976112887502bb80344d35df34e774628dba0

Question 8: What domain were the images downloaded from?

Answer: ronniesdankmemes.com

Question 9: Which command did the attacker use to look for files containing passwords?

Answer: Get-ChildItem -Path C:\Users\anbath\Documents* -Include password -Recurse

Question 10: What is the name of the file containing passwords?

Answer: mypasswordsnstuff.txt

Question 11: The command you just found containing Anita’s password shows they exfiltrated the file to a domain they control.

What is the name of that domain?

Answer: newdevelopmentupdates.org

Question 12: What is the last IP address that the domain you found in Q11 resolve to?

Answer: 239.72.6.38

Question 13: Do the IPs found in Q11 resolve to other domains? If they do, answer with the domain. If not, type no.

Answer: greenprojectnews.net

Question 14: What version of Firefox is the threat actor using?

Answer: 3.6.11

Question 15: What is Anita’s email address?

Answer: anita_bath@framtidxdevcorp.com

Question 16: Let’s see if she received any emails involving the domains you found in Q11 and Q13.

What is the subject of the email she received?

Answer: Web Server Credentials Update

Question 17: What is the link attached to that email?

Answer: https://greenprojectnews.net/share/modules/files/share/enter

Question 18: When did Anita click on the link? (Paste the full timestamp.)

Answer: 2024–06–26T15:24:20.000Z

Question 19: There might even be traces of her typing her credentials in.

What is the full url showing her doing just that?

Answer: https://greenprojectnews.net/share/modules/files/share/enter?username=anbath&password=**

Question 20: Who sent Anita the mail?

Answer: alex_johnson@framtidxdevcorp.com

Section 2: KQL 101 📚

Question 3: How many employees work at FramtidX?

Answer: 755

Question 4: What is the CEO’s name?

Answer: Johanna Karlsson

Question 6: How many emails did Mona Hunter receive?

Answer: 24

Question 7: How many distinct senders were seen in the email logs from techinnovators.io?

Answer: 675

Question 8: How many distinct websites did Mona Hunter visit?

The IP address in the query is Mona’s. It’s helpful to check for her IP before running the query

Answer: 46

Question 9: How many distinct domains in the PassiveDns records contain the word green?

Answer: 11

Question 10: How many distinct URLs did employees with the first name Dorothy visit?

Answer: 419

Question 11: How many authentication attempts did we see to the accounts of employees with the first name Dorothy?

Answer: 490

Section 3: Alright it’s definitely an angry frog or two 🥵😨

“My name is Erik Bjorn, I’m a Chief Architect here.”

Already you like this guy better than the creepy mute man. He explains that he had wanted to go over some details on the construction plans for the mall, but when he opened the file, he was greeted by, well, “just see for yourself.”

You manage to keep your face perfectly blank this time (but, yes, you laugh internally). This confirms your suspicion that the threat actor went beyond Anita’s machine. The frogs are furious.

You thank Erik for the information, telling him your investigation will go faster thanks to him. He nods gravely. He needs to get in touch with the other Chief Architect who is on vacation to inform her of the situation (“she’s not gonna be happy, those architectural plans were her babies”), so you leave him to it and go back to your desk.

Thanks to your work on Anita’s case, you have an idea of how it all started, you just need to confirm it. And from there you can just follow the breadcrumbs.

Question 1: What is the name of Erik Bjorn’s colleague?

Answer: Sofia Lindgren

You check to see if the Chief Architects received emails from the same internal address you found when investigating Anita.

Question 2: What is the subject of these emails?

Answer: Important: Architectural Plan Changes

The link in those emails leads to another sign-in page.

Question 3: Which domain is the page hosted on?

Answer: greenprojectnews.net

That is the same domain used to phish Anita.

You also notice that in both cases, the mail subject was tailored to fit the role of the recipient.

Question 4: What type of phishing attack is this?

Answer: Spearphishing

This method implies the threat actor did some reconnaissance on the company before they started.

Question 5: How many distinct pages on the company’s website did the threat actor browse to?

Answer: 78

Question 6:

The question says ‘job’ related referrer, this hould help clear the confusion. I had to down some good food before coming up with this query and getting the answer to this ;D

Answer: https://www.valdorianjobs.com

Let’s go back to the sign-in page Erik and Sofia received. Looking at their browsing history, it looks like both of them clicked on the link. Let’s hope they did not enter their passwords…

Question 7: Did any of them try to log in to that actor controlled page? If only one of them did, answer with their name, if both did, type both.

Run the first query to determine the link in question. The link has been added to the second query and from the result, we see the source-ip’s of both employees

Answer: both

Question 8: What time did they manage to log in to Sofia’s machine?

Here, I mapped the attacker’s ip based on their domain to Sofia’s username and the authentication events

Answer: 2024–06–27T10:41:38.000Z

Question 9: What is the first Powershell cmdlet used to delete something from Erik and Sofia’s machines?

This image provides answers to the coming questions as well

Answer: Remove-Item

Question 10: What is the name of the file that was deleted?

Answer: SuperImportantMallProjectArchitecturalPlans.docx

Question 11: What is the name of the file they downloaded?

Answer: fake_plans.docx

Question 12: Which domain hosted that file?

Answer: newdevelopmentupdates.org

Question 13: What Powershell cmdlet did the attackers use to rename the downloaded file?

Answer: Rename-Item

Question 14: What was the file renamed to?

Answer: SuperImportantMallProjectArchitecturalPlans.docx

Ah-ha! It makes perfect sense! After deleting the original plans, the attackers downloaded a replacement and renamed it with the name of the OG file so that nobody would catch on to what they were doing. That way, the next time Erik or Sofia would look at the plans, they would be surprised by the meme! Sneaky!

Question 15: According to MITRE, what kind of impact is this an example of?

Answer: Data Manipulation

Section 4: Nope, it’s a full on frognado!!!! 🐸🌪️😱

Question 1: What is Alex Johnson’s role in the company?

Answer: Developer

Question 2: How many internal phishing emails were sent from Alex’s email address?

Answer: 7

Question 3: How many distinct roles were targeted by the spearphishing emails?

Answer: 4

Hu-ho. One of those roles is not like the others.

Question 4: What is the name of the very important person who was targeted?

Answer: Johanna Karlsson

Question 5: What was the subject of the mail targeting the person found in Q4?

Answer: Urgent: Security Update Required

This doesn’t bode well. At all.

Let’s take a few steps back for a minute. You remember the threat actor did a lot of recon on the company’s website. Let’s take another look at the queries they made.

Question 6: What are they trying to find out about the person from Q4?

It’s obvious what the attacker’s looking for, but the CyberChef tool can also be used to decode this url

Answer: dark secrets

Alright, they seem convinced that FramtidX is an evil corporation that, among other things, despises frogs. And what better way to try and prove it than by compromising its CEO?

You go back to the phishing email you found in Q5. It includes, unsurprisingly, another sign-in page. You hope Johanna did not fall for it.

Question 7: Did Johanna type in her credentials? yes/no.

It’s seen that Johanna’s ip address browsed to the attacker’s domain

Answer: Yes

Question 8: When did the threat actor log in to Johanna’s machine?

Answer: 2024–06–27T12:40:59.000Z

That is so not a good look for the company that even the frigging CEO was so easily compromised!

Let’s uncover what the threat actor did on her machine after they logged into it. FramtidX will be lucky if all you find are more frog memes…

It looks like they were interested into collecting a certain type of document.

Question 9: In which folder did they collect the incriminating files?

Answer: C:\Users\jokarlsson\Documents\StolenEmails\

To continue prepping the files for a potential exfiltration, they archived the content of the folder found in Q9.

Question 10: What command did they use to do this?

Answer: Compress-Archive -Path C:\Users\jokarlsson\Documents\StolenEmails* -DestinationPath C:\Users\jokarlsson\Documents\StolenEmails.zip

Those must have been some very important emails… Let’s see if you can find which one they were interested in.

Johanna seems to have had a few email exchange with a very specific person.

Question 11: What is the email address of that person?

The subjects of the mails with Erik seemed juicy so let’s go with that

Answer: erik.stevens@valdoriapublicworks.gov

Question 12: How many emails total can you find between them?

Answer: 6

Question 13: What is the mayor looking forward to?

Answer: We’re going to make so much freaking money!

Question 14: What is the link Johanna shared with the mayor in her last email?

Answer: https://www.whyyoushoudntcareaboutnature.com

It definitely looks like the hacktivists found proof of some shady deal going on between those two…

Okay, you know they prepped the emails in a specific folder and archived it. But what did they do with it next?

You go back to the processes and find a command that divides the zip file into chunks.

Question 15: When did this happen?

Answer: 2024–07–08T14:41:47.000Z

The threat actor divided the archive into smaller bits so that the exfiltration could fly under the radar.

Question 16: How many chunks were the archive divided into?

Answer: 10

The hacktivists sent the chunks to an email address they control.

Question 17: What is that email address?

Answer: htuortwodahs@yopmail.com

They also sent a copy of their findings to someone you worked with last time you were in Valdoria.

Question 18: Who is the other recipient?

Answer: nene.leaks@valdoriantimes.com

Woopsie, that’s the editor of the Valdorian Times. Guess the city will have another scandal on their hands.

Question 19: What is the subject of the emails sent to the editor?

Answer: Confidential Documents: Scandalous Emails Exposed on Mall Project!!!!!

And that brings us to the end of this case.😌 😮‍💨

Thank you for viewing my walkthrough.

We’ve been able to interpret the logs and identify malicious activity

Till next time…

Happy Hunting🕵️‍♂️🕵️‍♂️