FOR101 [Forensics]

Email Analysis

The challenge provided us with a Users.zip file which contains files within the user's directory. Going into the Downloads folder to find potential IOCs or Indication of Compromise, there happens to be a folder called Outlook Files.

Within the folder contains an .eml file, which stands for Electronic Mail. An extension used when an email is downloaded.

To analyse it, emlAnalyzer is used, you can get the tool by installing it through pip

By using emlAnalyzer followed by the -i switch and the .eml file, emlAnalyzer will parse through the file and extract and display any URLs and attachments that are in the email.

To extract the .zip file within the email, the --extract-all switch is added into the command.

To read what is in the email, the --text is used, which reveals the password to the .zip file.

VBA Macro Deobfuscation

Unzipping the .zip file with the password provided we are given a .xlsm file called Credits69.xlsm.

As we know from the challenge description, this file is potentially dangerous and may contain macros which are then executed on the victim's machine. Because of the file type, we can use oletools, specifically olevba to extract the macros if there are any within the suspicious file. oletools can be installed through pip.

It is best to add the --deobf for deobfuscation and --decode switches when using olevba to deobfuscate and decode any strings if any.

The following VBA Macros were extracted:

From here, it's a mess I know, and there are no tools to deobfuscate this automatically. For that reason, manual deobfuscation is needed. Don't panic, this can be simplified through a methodology, which is to replace variable names and function names. If you know any programming languages, you would know functions will start with a Function tag in some programming languages, followed by the function name and parameters for arguments.

So, by replacing the variables and function names one by one, you will get this function which is used repetitively within the script.

I will let ChatGPT tell you what it does:

  1. variable_3 and variable_4 are strings that represent a mapping of characters. Each character in variable_3 corresponds to a character at the same position in variable_4.

  2. The function iterates over each character in the input string function1_arg.

  3. For each character in function1_arg, it finds the position of the character in variable_3 using InStr.

  4. If the character is found in variable_3 (variable_2 > 0), it takes the corresponding character from variable_4 and appends it to variable_6.

  5. If the character is not found in variable_3, it appends the original character from function1_arg to variable_6.

  6. Finally, the function returns the transformed string stored in variable_6.

The last part of the function contains several For loops that do not seem to serve any meaningful purpose since they reassign values to variable_1, variable_9, variable_11, and variable_13 but do not affect the outcome of the function. These loops can be considered redundant or possibly a mistake.

So the function was then simplified by ChatGPT:

I then told ChatGPT to give me a Python script that simulates what the VBA script does:

Going through where the function was used and the strings parsed into the function one by one, we come across this string when decoded.

PowerShell Deobfuscation

Going to that link reveals a PowerShell script:

If you ever seen typical PowerShell payloads before, they involve Base64 encoding, so let's copy the Base64 encoded string into CyberChef and see what it gives us!

PowerShell uses a different encoding than the usual UTF-8, instead it uses UTF-16LE

Once decoded, there is a second set of Base64 encoded strings! So, let's rinse and repeat.

This time, there is no need to decode the text. However, we can see what seems to be a PowerShell script that uses the Invoke-WebRequest module to send a POST request to a C2 server. What strikes out to me is the $qwedfaz variable which stores an array of decimals.

Combining all the decimals together and decoding it through CyberChef gives us a URL.

Going to that URL gives us the flag!

PreviousPhantom Script Intrusion [Forensics]NextOLE - Dirty Laundry [Forensics]

Last updated