Jojo’s Hospital | KC7 Walkthrough

Module link: https://kc7cyber.com/challenges/195

Happy Hunting 🕵️🕵️🕵️

Crypto - but the bad kind

Question 1: How many hours did the hackers give the hospital to pay the ransom?

Answer: 72 hours

Question 2: What was the name of the ransomware group?

Answer: Lockbyte

Question 3: The slogan was: we spend your money, so ____

Answer: you don’t have to

Use this to answer questions 4 and 5.

Question 4: How much did the hackers ask the patients to pay?

Answer: $10,000

Question 5: What very important unique identifier number did the ransomware operators threaten to release?

Answer: social security number

Question 6: How many total files were encrypted at the hospital?

Answer: 6420

Question 7: How many unique hostname’s had files encrypted on them?

Answer: 321

Question 8: What was the Sha256 hash of this ransom file?

Use this for questions 9–11

Answer: 97c348e95c8a8aeb8808f76434d73a92bbcb6b4586788365762b22624990b018

Question 9: What was the full path of this ransom file?

Answer: C:\Users\andavis\Documents\We_Have_Your_Data_Pay_Up.txt

Question 10: On how many hosts (machines) was this ransom file seen?

Answer: 1

Question 11: What hostname was the ransom note seen on?

Answer: AMFB-MACHINE

Question 12: What is the name of the employee whose host has the ransom note?

Answer: Anthony Davis

Question 13: Run the query above. How many process events were executed on Anthony’s machine during this time period?

Answer: 14

Question 14: What was the name of the ransomer file mentioned?

For questions 14 and 15

Answer: lockbyte_ransomer.exe

Question 15: When the attackers copied the ransomer file to the network share, what new name did they give it?

Answer: spread_ransomware.exe

Question 16: What tool did the attackers use to steal the data? This will be a .exe file

Answer: patient_data_exporter.exe

Question 17: What information did the attackers put into patient_data_1.zip? Provide the full path of the network share \\something\like\this

Answer: \jojos-hospital-server\important_data\patient_records

Question 18: What information did the attackers put into patient_data_2.zip? Provide the full path of the network share \\something\like\this

Answer: \jojos-hospital-server\important_data\archive\patient-records

Question 19: What information did the attackers put into patient_data_3.zip? Provide the full path of the network share \\something\like\this

Answer: \jojos-hospital-server\important_data\old-patient-data

Question 20: What domain (e.g. abcd.com) did the attackers send the stolen data to?

Answer: secure-health-access.com

Question 21: What command did they use to clear their tracks? Copy and paste the full command.

I made use of time beyond which the former command was run

Answer: cmd.exe /c del C:\Users\andavis\Documents\patientdata*.zip

Question 22: What domain was the patient data exporter file downloaded from?

Answer: secure-health-access.com

Question 23: When was the patient data exporter file downloaded? (copy and paste the exact timestamp)

Answer: 2024–06–17T14:22:29.000Z

Question 24: How many distinct IPs does the domain secure-health-access.com resolve to?

Answer: 2

Question 25: Which one of these IPs ends with the digit 1?

Answer: 203.0.113.1

Question 26: Which one of these IPs ends with the digit 2?

Answer: 203.0.113.2

Question 27: What additional domain name is associated with these IP addresses?

Answer: emr-help.net

Question 28: How many requests did the hackers make to our website from these IPs?

Answer: 37

Question 29: The hackers were curious about how to bypass ___ at Jojo’s hospital.

Answer: security

Question 30: What was the first web request the hackers made using the term patient? (hint: it was a search). Paste the full url.

Answer: https://jojoshospital.org/search=JoJo%27s+Hospital+patient+records

Question 31: When did this login occur?

Answer: 2024–05–20T00:00:00.000Z

Question 32: Which IP address did the actors use for the login?

Answer: 203.0.113.1

Question 33: Whose account did the hackers login to? (provide a first and last name)

There’s a username provided in the result of the last query, I queried the Employees data table with the associated username.

Answer: Anthony Davis

Sharks in the hospital water

Question 1: Whose credentials did the hackers use to access the hospital’s network? (Enter first and last name)

Answer: Anthony Davis

Question 2: What was the domain name observed in the sponsored search result?

Answer: raisinkanes.com

Question 3: What is the legitimate domain for Raising Cane’s?

Answer: raisingcanes.com

Question 4: How many web requests do we see going to the fake raisinkanes domain?

Answer: 26

Question 5: How many unique employees were seen browsing to the fake raisinkanes domains? (hint distinct the src_ip)

Answer: 24

Question 6: Which of the malicious domains used for redirection starts with the word “nothing”?

Answer: nothing-to-see-here.net

Question 7: Which of the malicious domains used for redirection starts with the word “totally”?

Answer: totally-legit-domain.com

Question 8: What is the name of the docx file they are redirected to?

Answer: Raisin_Kane_Promo_Offer.docx

Question 9: What is the name of the pdf file they are redirected to?

Answer: Raisin_Kane_Free_Meal_Voucher.pdf

Question 10: What is the hostname of the first person to download the suspicious docx file?

Answer: RQJQ-MACHINE

Question 11: When did this download occur? (copy and paste the timestamp)

Answer: 2024–05–01T09:56:50.000Z

Question 12: What was the Sha256 hash of the file?

Answer: bd886046266b909a8ca5f19f16e5606baf73194a70632c81fdc44ef39ba29712

Question 13: Which browser was used to download this file? (look at the process_name)

Answer: chrome.exe

Question 14: What was the name of the malicious file dropped by the attackers?

Answer: cobaltstrike.exe

Question 15: Which command (process_commandline) shows the execution of the Raisin_Kane_Promo_Offer.docx file? (copy and paste the whole command)

Answer: “C:\Program Files\Microsoft Office\Office16\WINWORD.EXE” “C:\Users\evbrowne\Downloads\Raisin_Kane_Promo_Offer.docx”

Question 16: What IP address do the hackers connect to using cobalt strike?

This answers question 17 as well

Answer: 93.238.22.122

Question 17: Over what port do the hackers connect to that IP address?

Answer: 50050

Question 18: What was the first discovery command issued by the hackers? (hint: it has to do with a system)

Answer: systeminfo

Question 19: How many of these short discovery commands did the attackers run?

Answer: 6

Question 20: What is Anthony Davis’ hostname?

Answer: AMFB-MACHINE

Question 21: When did the attackers connect to their IP address using cobalt strike on Anthony Davis’ machine?

Answer: 2024–05–14T12:24:45.000Z

Question 22: What was the name of this scanning tool?

Answer: advanced-ip-scanner.exe

Question 23: What was the name of the file the attackers exfiltrated to learn about the network? (hint: ___.pdf)

Answer: network_diagrams.pdf

Question 24: What was the name of the file the attackers took that would have contained usernames and passwords?

Answer: credentials.txt

Question 25: Before stealing this file, the attackers first compressed them into a zip file. This allowed the files to be smaller so they would attract less attention.

What was the name of this zip file?

Answer: important_network_info.zip

Question 26: The attackers once again used a curl command to upload the compressed zip file to a known attacker domain name.

Which domain did the attackers send the zip to?

Answer: nothing-to-see-here.net

JoJo’s Hospital was targeted by hackers who used a fake advertisement to trick hospital employees into downloading harmful files. This allowed the first hacker group, SharkFin7, to access the hospital’s network and steal information. SharkFin7 then sold this access to the LockByte ransomware group. LockByte used this access to lock important files and demanded money from the hospital and its patients to unlock them.

By investigating this attack, we learned important skills to detect, analyze, and respond to cyber threats. We saw how careful monitoring and quick action can help protect important data and keep services running smoothly.

Thank you for sticking around, if you found this walkthrough helpful in anyway please leave a reaction.

Thank you 😊