CyberDefenders - Silent Breach WriteUp

Lab: https://cyberdefenders.org/blueteam-ctf-challenges/silent-breach/ 1. What is the MD5 hash of the potentially malicious EXE file the user downloaded? Navigating to the Downloads' folder we can see right way a suspicious executable which attempts to camouflage as a PDF. Get-FileHash -Algorithm md5 .\IMF-Info.pdf.exe Answer 336A7CF476EBC7548C93507339196ABB 2. What is the URL from which the file was downloaded? Since it has the Zone.Identifier metada it means the MOTW was applied to the file, therefore there are high changes this file was download via a browser. Accordingly with Microsoft https://learn.microsoft.com/en-us/dotnet/api/system.security.securityzone?view=windowsdesktop-10.0 we also know with "ZoneId=3" that the file was download from the internet. Answer http://192.168.16.128:8000/IMF-Info.pdf.exe 3. What application did the user use to download this file? Due to previous discoveries we will check the History file from the installed browsers: Exported the History file from