The Greenholt Phish | CTF Writeup

the link for the room : https://tryhackme.com/room/phishingemails5fgjlzxc

Scenario : A sales executive at Greenholt PLC has reported a suspicious email received from a known customer. The message raised several red flags: a generic greeting, an unexpected request for a money transfer, and an unsolicited attachment. According to the employee, this behavior does not align with the customer’s usual communication style. Concerned that the email may be malicious, the message has been escalated to the SOC (Security Operations Center) for further investigation. Your goal is to analyze the provided email sample and determine whether it is legitimate or part of a phishing attempt.

Objectives :

• Analyze the provided email to identify and extract key artifacts
• Investigate the message source to determine its origin and authenticity
• Use analysis tools to assess the potential maliciousness of the email

Lab Access :

THM lab access

you can connect using open vpn directly on your machine or the easy way you can just deploy THM virtual machine by clicking on (start machine)

Q1- What is the Transfer Reference Number listed in the email's Subject line?

we will begin our analsis with .eml file located on the desktop of our deployable maching by opening it with thunderbird ..

Right after we open it we can see its content and we got the answer for our first question ..

ANS : 09674321

Q2- What is the display name of the sender?

as shown in the previos Screen shot in the top left

ANS : Mr. James Jackson

Q3- What is the sender’s email address?

right under the sender name we can see his email

ANS: info@mutawamarine.com

Q4- What email address will receive a reply to this email?

we can clearly relize that the reply is not gonna be sent to the same email address which the email originated from ..

ANS: info.mutawamarine@mail.com

Q5- What is the originating IP address of this email?

for this part we will need to analyze the email header and we can do that by clicking on More > View Source option and then locate the originating IP address ..

ANS: 192.119.71.157

Q6- Who is the owner of the originating IP?

i have searched virus total for this one as its helpful when it comes to threat intelligence

ANS: Hostwinds LLC

Q7- What is the full SPF record for this domain?

To find the SPF record, I searched for the domain ‘mutawamarine.com’ on MXToolbox

ANS: v=spf1 include:spf.protection.outlook.com -all

Q8- What is the complete DMARC record for this domain?

on the same tool as the previous question we will change spf lookup to DMARC lookup ..

and here is the result :

ANS: v=DMARC1; p=quarantine; fo=1

Q9- What is the file name of the attachment found in the email?

as we can see in the bottom of the email .. the attachment file

ANS: SWT_#09674321__PDF.CAB

Q10- Download the attachment to your virtual environment.

Using the sha256sum command, what is the SHA256 hash of the file?

we can get the hash by downloading the attached file and using the following command on the terminal : sha256sum SWT_#09674321__PDF.CAB

ANS: 2e91c533615a9bb8929ac4bb76707b2444597ce063d84a4b33525e25074fff3f

Q11- What is the attachment’s file size in KB ?

looking up the hash on virus total on the details page like in the screen shot below

we can clearly see the filesize in kelobytes

ANS: 400.26 KB

Q12- What is the actual file type of the attachment?

on the same section as the previous we can see the file type

ANS: RAR