# REvil Corp

### Task 1 - Investigating the Compromised Endpoint

What is the compromised employee's full name?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FfUzvMb8UeoIZsUQrLEoH%2FScreenshot%20from%202022-01-23%2016-11-51.png?alt=media\&token=c1f77119-8f86-4294-a498-a8d79f0ed682)

```
John Coleman
```

What is the operating system of the compromised host?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FBZjfxYcWFSx96jiM0cCA%2FScreenshot%20from%202022-01-23%2016-12-36.png?alt=media\&token=0989336b-30c7-411b-98fb-e30edfe64b09)

```
Windows 7 Home Premium 7601 Service Pack 1
```

What is the name of the malicious executable that the user opened?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FgTMpG7UPpMqgFduhfnfL%2FScreenshot%20from%202022-01-23%2016-16-49.png?alt=media\&token=c94f2bac-d866-46ef-9cbd-76e637f71e16)

```
# Go to "File Download History", you will find this answer
winrar2021.exe
```

What is the full URL that the user visited to download the malicious binary? (include the binary as well)

```
http://192.168.75.129:4748/Documents/WinRAR2021.exe
```

What is the MD5 hash of the binary?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2F23z7ojZQch4GbLfgiBtX%2FScreenshot%20from%202022-01-23%2016-20-35.png?alt=media\&token=6cf0767c-b941-40e5-93e2-3c7a4e09e8e5)

```
890a58f200dfff23165df9e1b088e58f
```

What is the size of the binary in kilobytes?

```
164
```

What is the extension to which the user's files got renamed?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FfCkSpx0AiAzCq0DTBjyc%2FScreenshot%20from%202022-01-23%2016-22-27.png?alt=media\&token=323b1256-e07d-4f1c-8747-152e741e76a3)

```
.t48s39la
```

What is the number of files that got renamed and changed to that extension?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FurDw4ghLRRk0zestxoqS%2FScreenshot%20from%202022-01-23%2016-26-15.png?alt=media\&token=3c78478c-d92b-4f36-8905-b710f9204855)

```
48
```

What is the full path to the wallpaper that got changed by an attacker, including the image name?

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2F6VR05ZNTRCa89s77Xkqr%2FScreenshot%20from%202022-01-23%2016-37-14.png?alt=media\&token=64d32d52-3f63-4f63-997f-454bf19fac52)

```
C:\Users\John Coleman\AppData\Local\Temp\hk8.bmp
```

The attacker left a note for the user on the Desktop; provide the name of the note with the extension.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FPK6KTGndzcvbjpaCRXmP%2FScreenshot%20from%202022-01-23%2016-39-43.png?alt=media\&token=780519ff-188b-4519-8f7c-973117cae790)

```
t48s39la-readme.txt
```

The attacker created a folder "Links for United States" under C:\Users\John Coleman\Favorites\ and left a file there. Provide the name of the file.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2Fhp5qzkOkDRau5bdq7Ob9%2FScreenshot%20from%202022-01-23%2016-41-37.png?alt=media\&token=b64d8460-c572-4b26-b3a7-71854dd24096)

```
GobiernoUSA.gov.url.t48s39la
```

There is a hidden file that was created on the user's Desktop that has 0 bytes. Provide the name of the hidden file.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FOs25gptWtLTYcRDTIzs6%2FScreenshot%20from%202022-01-23%2016-42-52.png?alt=media\&token=786c2727-90d7-4c7d-a633-0c0181a0f239)

```
d60dff40.lock
```

The user downloaded a decryptor hoping to decrypt all the files, but he failed. Provide the MD5 hash of the decryptor file.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FUM8vIFGbDEYprBWWuVqf%2FScreenshot%20from%202022-01-23%2016-45-11.png?alt=media\&token=c6d7f6af-293c-4e63-a03c-dd27489a0d0e)

```
f617af8c0d276682fdf528bb3e72560b
```

In the ransomware note, the attacker provided a URL that is accessible through the normal browser in order to decrypt one of the encrypted files for free. The user attempted to visit it. Provide the full URL path.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FBExOpBJEnhVWS7UOpMr0%2FScreenshot%20from%202022-01-23%2016-48-11.png?alt=media\&token=251dc820-2e31-4284-8592-99e7734c7a08)

```
http://decryptor.top/644E7C8EFA02FBB7
```

What are some three names associated with the malware which infected this host? (enter the names in alphabetical order)

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2Ftg2r5wnKjjz7Q2Q7gA1m%2FScreenshot%20from%202022-01-23%2016-57-40.png?alt=media\&token=e4765aff-f33c-410d-a488-b54a946da118)

```
# https://www.joesandbox.com/analysis/366350/0/html
REvil,Sodin,Sodinokibi
```
