The Greenholt Phish

THM Link: https://tryhackme.com/room/phishingemails5fgjlzxc

The Scenario:

A Sales Executive at Greenholt PLC received an email that he didn’t expect to receive from a customer. He claims that the customer never uses generic greetings such as “Good day” and didn’t expect any amount of money to be transferred to his account. The email also contains an attachment that he never requested. He forwarded the email to the SOC (Security Operations Center) department for further investigation.

Investigate the email sample to determine if it is legitimate.

Get some information on the scenario:

1. The victim is a Sales Executive
2. He didn’t expect to receive from a customer
3. Not using Good day
4. Did not expect any money
5. The email contains an attachment and was never requested

Open email with Thunderbird

Start analyzing the email

info@mutawamarine.com

SPF Alignment: Sender Policy Framework. Simply, it’s an authentication policy, which ensures that the sender is authorized by the sender, and relates to SMTP. The SPF Alignment is PASS only when the “Return-Path” And “From” domains are the same. Different between which helps us understand email could be spoofed

From this image, we can see that the SPF failed, which means the authentication was not approved

What is the Transfer Reference Number listed in the email’s Subject?

Who is the email from?

What is his email address?

What email address will receive a reply to this email?

What is the Originating IP?

1. Identify the First “Received” Header: Email headers usually contain multiple “Received” lines, which track the servers that handled the email as it was transmitted. The first “Received” line typically indicates the originating server.
2. Locate the IP Address: In the first “Received” line, look for the IP address following the from keyword. This is the IP address from which the email was originally sent.

To find which email is first, we can check the time and identify the first email.

Times are different, and we need to convert the UTC zone

Wed, 10 Jun 2020 05:58:54 +0000 → Wed, 10 Jun 2020 05:58:54 +0000 UTC

Wed, 10 Jun 2020 01:02:04 -0400 → Wed, 10 Jun 2020 05:02:04 UTC

• Received from hwsrv-737338.hostwindsdns.com ([192.119.71.157]:51810 helo=mutawamarine.com): This line indicates that the email was originally sent from the server hwsrv-737338.hostwindsdns.com with the IP address 192.119.71.157.

Therefore, the Originating IP is 192.119.71.157.

Who is the owner of the Originating IP? (Do not include the “.” in your answer.)

•There are several OSINT tools you can use to find the owner of any IP address, such as Whoislookup.com, VirusTotal, and NSLookup.​

For Powershell

Resolve-DnsName

What is the SPF record for the Return-Path domain?

Go to MXtoolbox https://mxtoolbox.com/

From the above image, we can see that the SPF failed; this means the authentication was not approved

What is the DMARC record for the Return-Path domain? DMARC: Domain-based Message Authentication, Reporting, and Conformance. It helps protect and reduce spam. Imagine how much you’d get without it

Same steps with SPF, but this time select DMARC in the drop-down

v=DMARC1 — this is the DMARC version

p=quarantine → means it is spam and should be filtered

fo=1 Generate reports if authentication fails

What is the name of the attachment?

For questions like this, if you’re using Mousepad, you can easily find the answer by pressing Ctrl + F and searching for the word “attachment. “

What is the SHA256 hash of the file attachment?

Now, let’s look at how to find the SHA-256 hash of the file attachment. We’ll go through the process of obtaining the hash using both Linux and PowerShell.​

For PowerShell (Windows):​

get-filehash <file> # For SHA256 (default)​

get-filehash -algorithm md5 <file> # For MD5​

get-filehash -algorithm SHA1 <file> # For SHA1​

For Linux:​

sha256sum <file> # For SHA256​

md5sum <file> # For MD5​

sha1sum <file> # For SHA1​

sha512sum <file>

sha256sum SWT_#09674321__PDF.CAB

What is the attachment’s file size? (Don’t forget to add “KB” to your answer, NUM KB)

What is the actual file extension of the attachment?