•
Incident Analysis Report – Suspicious Outbound Traffic
CHƯƠNG 1 Scenario
This morning, the monitoring system detected abnormal outbound network traffic
patterns from several workstations. Preliminary analysis conducted by the IT department
identified a potential security compromise related to the exploitation of a vulnerability
in software X.
This report aims to identify and analyze the following information:
•
Question 1: What directory contains the malicious file path?
•
Question 2: When was the malicious file downloaded?
•
Question 3: What is the content of the malicious PowerShell scripts (2 .ps1 files
and 1 .bat file)?
•
Question 4: Which CVE vulnerability was exploited?
Tools used: AutoSpy, Visual Studio Code
Question 1: Directory Containing the Malicious File Path
After investigation, the following malicious file was identified:
File name: SANS SEC401.pdf
File path: C:\Users\Administrator\Downloads\Telegram Desktop\SANS
SEC401.rar
SHA-256 hash:
d1a55bb98b750ce9b9d9610a857ddc408331b6ae6834c1cbccca4fd1c50c4fb8
Question 2: Time the Malicious File Was Downloaded
The download timestamp of the malicious file is:
Date & Time: Saturday, February 3, 2024 – 2:33:20 PM
Question 3: Content of the Malicious PowerShell Scripts
The malicious content was discovered inside the file SANS SEC401.pdf.cmd,
which is embedded within the archive SANS SEC401.rar after extraction.
Observed Malicious Behavior and Paths
The script is heavily obfuscated and drops multiple files into the system. The
following suspicious paths and artifacts were identified:
C:\Windows\Temp
Download from: http://172.18.35.10:8000/amanwhogetsnorest.jpg
Saved as:C:\Windows\Temp\amanwhogetsnorest.jpg
Dropped scripts:
C:\Windows\Temp\z.ps1
C:\Windows\Temp\run.bat
C:\Windows\Temp\Eventlogs.ps1
Scheduled task persistence:
C:\Windows\System32\Tasks\whoisthebaba
Interaction with:C:\Downloads
Analysis of run.bat
The file run.bat was located at:
C:\Windows\Temp\run.bat
Its contents were encoded using non-standard characters (appearing as Chinese
characters), which ultimately led to the discovery of another PowerShell script:
Related file: run.ps1
Analysis of run.ps1
The run.ps1 file contains a long obfuscated Base64-encoded payload. The script
performs the following actions:
Reverses the Base64 string.
Decodes the string into PowerShell code.
Dynamically executes the decoded payload using:
Decoded Payload Behavior (Using CyberChef)
After decoding the obfuscated content, the following malicious actions were
identified:
Output file creation:
$env:UserProfile\AppData\Local\Temp\BL4356.txt
Internal network scanning:
Performs ICMP (ping) scans on the range:
192.168.1.1 – 192.168.1.99
Logs results of online and offline hosts to:
AppData\Local\Temp\BL4356.txt
Data exfiltration:
Sends collected data via HTTP to:
192.168.1.5:8000
Question 4: Exploited CVE
Based on the analysis, the exploited vulnerability is identified as:
CVE:
CVE-2023-38831.A.gen!Camelot
Conclusion
The incident involved a malicious archive masquerading as a PDF file, delivered
through a compressed RAR file. Upon execution, it deployed multiple obfuscated
scripts, established persistence via scheduled tasks, scanned the internal network, and
exfiltrated reconnaissance data to an external server.
This activity strongly indicates post-exploitation reconnaissance and data exfiltration
behavior, consistent with malware leveraging CVE-2023-38831.