2025–06–13 — TRAFFIC ANALYSIS EXERCISE: IT’S A TRAP! — Malware-analysis.net

Here’s the link to the exercise. It’s safer to download the files on the virtual machine you’ll use to inspect the traffic and files. Here’s a list of different Linux distros you can use for forensics compiled on eSecurity Planet.

I downloaded the two zip files on my Kali.

I remember using this website in college. The zip password was: infected. That no longer works. I found this on the website.

I extract it as usual by right-clicking on the zipped file and selecting “Extract Here”.

By looking at the date on the file, we can deduce the password. Here it’s: “infected_20250613”.

It worked for both files.

From the website, here’s what’s asked:

I’ll just analyse the traffic before answering the questions. Right now, I’ll be looking for an infected machine in the local network.

• LAN segment range: 10.6.13[.]0/24 (10.6.13[.]0 through 10.6.13[.]255)

Now, this is just a hunch, but I’m thinking the malware was downloaded via HTTP. If that’s not the case, I’ll make a list of protocols to check to find out which one it is.

I used this Wireshark filter:

_ws.col.protocol == "HTTP"

I looked around. I could have added a filter to get all GET requests if there’s a lot of traffic. Here’s what I found.

.133 makes an unusual GET request to an unusual domain. I searched it on VirusTotal.

I can look at RELATIONS.

I’m assuming these are the malicious files linked to that domain. C2 stands for command and control; this is what the attacker uses to send commands to the target machine and exfiltrate data from it.

I can look at the forensics files that are in one of the zip files.

I recognize c2.exe, it might be the same thing.

I load it on VirusTotal. In a real life scenario, I would only use the hash in case it’s a file with information on the company. We would not wanna leak sensitive data online.

I can look through the files of the zip in more details. c2.exe is in two directories. I can use the command strings to extract bits and pieces.

┌──(zen㉿medusa)-[~/Desktop/2025-06-13-traffic-analysis-exercise-forensic-analysis/AppData-Roaming-afUGkp]
└─$ strings ycBFVIbLl.lnk
CFSF
AppData
Roaming
afUGkp
Zs|.
Zs| 
c2.exe
Zs|.
C:\Users\rgaines\AppData\Roaming\afUGkp\c2.exe
desktop-5ave44c
1SPS

Here I see that the malware is in the user rgaines’ files. In the path of the other .lnk file (AppData-Roaming-Microsoft-Windows-Start_Menu-Programs-Startup), it looks like there’s an event at startup. The attacker created a task successfully (persistence). So c2.exe is likely to run at every startup.

┌──(zen㉿medusa)-[~/Desktop/2025-06-13-traffic-analysis-exercise-forensic-analysis/AppData-Roaming-Microsoft-Windows-Start_Menu-Programs-Startup]
└─$ strings ycBFVIbLl.lnk
CFSF
AppData
Roaming
Zs|.
afUGkp
Zs|.
Zs| 
c2.exe
Zs|.
C:\Users\rgaines\AppData\Roaming\afUGkp\c2.exe
desktop

It’s definitely malicious. I can start answering the questions now that I know the target. I can tighten my search. I can try to pinpoint the first event from the information I have.

Questions:

• What is the IP address of the infected Windows client?

Based on my research, it would be 10.6.13.133.

• What is the mac address of the infected Windows client?

I can use a filter to see traffic going to/from .133:

ip.dst == 10.6.13.133 || ip.src == 10.6.13.133

Here in this packet, I can look at the Ethernet section of the packet and then the source.

The mac address is 24:77:03:ac:97:df

• What is the hostname of the infected Windows client?

I can use this filter here to see .133 related traffic and also NetBIOS traffic.

ip.dst == 10.6.13.133 || ip.src == 10.6.13.133 && _ws.col.protocol == "NBNS"

The hostname is DESKTOP-5AVE44C.

• What is the user account name from the infected Windows client?

I saw previously in the c2.exe file the username rgaines, but I’ll check the traffic too. Different protocols allow authentication ex. FTP (ftp.request.command == “USER”), HTTP (http.authbasic), SMB (smb2.session_setup), Kerberos/NTLM (kerberos.CNameString). The Kerberos filter is the one that showed results for me.

kerberos.CNameString

Here I see traffic between .3, which is the domain controller, and .133, the infected host.

Once I look through the Kerberos section of the packet, I see the user rgaines. It seems like the attacker is targeting the domain controller to pivot to it with rgaines, then elevate their privileges. Maybe there’s attempted reconnaissance with mimikatz, Bloodhound/Sharphound, SMB spidering.

EXTRA research for IOCs:

Possible use of an automated tool for reconnaissance confirmed

I checked out of curiosity for SMB spidering. There’s traffic happening within the same second; this tells me it’s an automated tool. I used this filter:

ip.addr == 10.6.13.133 && smb2

Here, it looks like reconnaissance; this is the info a tool like Bloodhound or Sharphound would request. Commands are executed to extract information.

Even the SMB traffic leans towards Bloodhound or Sharphound.

Malicious domains

I decided to extract all domains to check if more than one malicious domain was accessed. I used tshark to extract them all and write them in a text file named domain.txt.

$ tshark -r 2025-06-13-traffic-analysis-exercise.pcap -Y "dns.flags.response == 0" -T fields -e
dns.qry.name | sort -u > domains.txt

I made sure to delete internal domains, hostnames… out of the list.

Here I can delete these, they are the target’s.

Then I got an API key to be able to scan multiple domains at once without manual entries on VirusTotal. You get 500 requests a day and 4 requests per minute for free.

I asked Copilot or ChatGPT to write me a Python script to send 4 domains/minute to be scanned. All you need to do is insert your API key.

#!/usr/bin/env python3
import requests
import sys
import time
API_KEY = "YOUR_API_KEY" # replace with your actual key
RATE_LIMIT = 4 # requests per minute
SLEEP_TIME = 60 / RATE_LIMIT
def submit_url(url):
"""Submit the URL/domain to VirusTotal for a fresh scan."""
response = requests.post(
"https://www.virustotal.com/api/v3/urls",
headers={"x-apikey": API_KEY},
data={"url": url}
)
if response.status_code != 200:
print(f"{url}: Error {response.status_code} submitting")
return None
return response.json().get("data", {}).get("id")
def get_verdict(scan_id, url):
"""Retrieve the analysis results for the submitted URL/domain."""
response = requests.get(
f"https://www.virustotal.com/api/v3/analyses/{scan_id}",
headers={"x-apikey": API_KEY}
)
if response.status_code != 200:
print(f"{url}: Error retrieving results ({response.status_code})")
return
data = response.json().get("data", {}).get("attributes", {})
stats = data.get("stats", {})
malicious = stats.get("malicious", 0)
suspicious = stats.get("suspicious", 0)
if malicious > 0 or suspicious > 0:
print(f"{url}: DANGEROUS ({malicious} malicious, {suspicious} suspicious)")
else:
print(f"{url}: Clean ({malicious} malicious, {suspicious} suspicious)")
def main():
urls = [line.strip() for line in sys.stdin if line.strip()]
for url in urls:
scan_id = submit_url(url)
if scan_id:
# wait a bit to respect rate limits and allow scan to complete
time.sleep(SLEEP_TIME)
get_verdict(scan_id, url)
time.sleep(SLEEP_TIME)
if __name__ == "__main__":
main()

This is how you run the command and what it should look like. You add the txt file with the domains as an argument. It is a little long, so you can do something else while you wait.

$ python3 VT.py < domains.txt
acroipm2.adobe.com: Clean (0 malicious, 0 suspicious)
analytics.google.com: Clean (0 malicious, 0 suspicious)
...

Here are the interesting results. I defanged them. I forgot to take out a subdomain of the local domain (in bold), and it’s flagged as malicious.

dng-microsoftds[.]com: DANGEROUS (8 malicious, 0 suspicious)
event-datamicrosoft[.]live: DANGEROUS (15 malicious, 1 suspicious)
eventdata-microsoft[.]live: DANGEROUS (13 malicious, 0 suspicious)
event-time-microsoft[.]org: DANGEROUS (13 malicious, 0 suspicious)
varying-rentals-calgary-predict[.]trycloudflare[.]com: DANGEROUS (14 malicious, 0 suspicious)
wpad[.]massfriction[.]com: DANGEROUS (2 malicious, 0 suspicious)
hillcoweb[.]com: DANGEROUS (9 malicious, 1 suspicious)

With a tshark command, I was able to get the packets for each time the malicious domains were reached. To me, this looks like command and control. In the traffic, it did seem like an automated tool was used for reconnaissance, so this confirms constant communication. I took out the domain in bold.

$ while read domain; do
  tshark -r 2025-06-13-traffic-analysis-exercise.pcap \
  -Y "dns.flags.response == 0 && dns.qry.name == \"$domain\"" \
  -T fields -e frame.number -e frame.time -e dns.qry.name
done < domains.txt | sort -k2

2884    2025-06-13T11:34:46.266175000-0400      hillcoweb[.]com
2886    2025-06-13T11:34:46.266400000-0400      hillcoweb[.]com
6550    2025-06-13T11:35:38.176459000-0400      dng-microsoftds[.]com
6637    2025-06-13T11:35:48.668145000-0400      event-time-microsoft[.]org
6690    2025-06-13T11:35:58.350269000-0400      eventdata-microsoft[.]live
44525   2025-06-13T11:38:55.580248000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
44659   2025-06-13T11:39:25.700426000-0400      event-datamicrosoft[.]live
45411   2025-06-13T11:43:57.100752000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
45794   2025-06-13T11:45:57.639410000-0400      event-datamicrosoft[.]live
45795   2025-06-13T11:45:57.706059000-0400      event-datamicrosoft[.]live
46505   2025-06-13T11:50:59.142163000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
46648   2025-06-13T11:51:59.364928000-0400      event-datamicrosoft[.]live
46649   2025-06-13T11:51:59.430042000-0400      event-datamicrosoft[.]live
47282   2025-06-13T11:56:30.320252000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
47447   2025-06-13T11:58:00.638537000-0400      event-datamicrosoft[.]live
47448   2025-06-13T11:58:00.705274000-0400      event-datamicrosoft[.]live
47838   2025-06-13T12:01:31.323912000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
47839   2025-06-13T12:01:31.380333000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
48522   2025-06-13T12:06:02.627861000-0400      event-datamicrosoft[.]live
48523   2025-06-13T12:06:02.695721000-0400      event-datamicrosoft[.]live
48624   2025-06-13T12:07:02.882020000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com
48625   2025-06-13T12:07:02.949563000-0400      varying-rentals-calgary-predict[.]trycloudflare[.]com

Possible exfiltration

This right here looks like exfiltrated data; we see some base64 in the info section.

It goes in one direction from the infected host to malicious domains.

I right-click on packet 44292, the first POST, then I go to Follow, then click on TCP Stream. The content is obfuscated.

I can see that this domain was not detected as malicious by the API, but it is flagged as malicious when manually submitted on the website. So the VirusTotal API is not as reliable, or I’ll need to find what’s wrong in the Python script. I would have to look for a better tool if we’re talking automation.

I right-click on packet 44562 with another IP. Then I go to Follow, then click on TCP Stream.

Here, I recognize the malicious domain that was flagged.

Incident Response & Remediation Plan

This is very general. It’s what came to mind. It could be developed.

Forensic Imaging

• Take images of .133 and the DC (.3).

Containment

• .133 should be quarantined, no shut down just isolation.
• Other machines in the network should be monitored for unusual activity and traffic.

Remediation

• For the DC (.3) and .133, we should deploy new machines of the cleanest saved versions which will be hardened once we find the initial access. Redeploying a clean, hardened copy is safer than reverting to a snapshot of a compromised machine (see 3–2–1 backup rule).
• Run integrity checks.

Access Control & Hardening

• We need to review Role-Based Access Controls, while following the principle of least privilege. We can look at the groups again to make sure only the people who should have access to the DC do, like the domain admins. We can look at rgaines’ memberships, all users while we’re at it. We need to make sure users can’t install anything.

Password Reset

• All users will have to reset their passwords.
• Maybe enable MFA if it’s not already done for privileged accounts.

Auditing & Alerting

• We need to enable auditing for every logon attempt on the DC, we can even create alerts (many failed logons, wrong user, logons outside of regular hours…).

Root Cause Analysis

• We need to find the source of the incident to know if rgaines went to a malicious website, clicked on a malicious email link, or downloaded a malicious executable to install an app/software. Is it rgaines who was unaware or an insider threat?

Awareness & Training

• We will also have to plan on giving a mandatory workshop to all workers, modeled on our results, and reminding them of the basics. We would also include a quiz and a phishing simulation.

Automation

• Ideally, I would automate the URL extraction from the pcap, the URL scan, isolating the malicious URLs, and the extraction again of the time the URLs were accessed from the pcap to help see the timeline.