LetsDefend - Presentation As a Malware#

Start Investigation#

What was the general name / category of the malicious file in the analyzed ppt file?

Generated filehash using anything you have or upload it directly into VirusTotal Looking at answer format, the answer is VB

1
VB:Trojan

Which of the url addresses it communicates with has been detected as harmful by sandboxes?

Lets go to Relations tab There is one url that has the most vendors flagged as malicious, look like it tried to download suspicious lnk file

1
http://onedrive.linkpc.net/Ali/Yasine/IDMan.lnk

What is the name of the htm file that drops to disk?

Scroll down to Dropped Files section There is a file that has htm extension which match answer format of this question

1
hdkjashdkasbctdgjsa[1].htm

Which process is running to persistent under mshta.exe after the relevant malware runs?

Go to Processes Tree section under Behavior Tab There is a task scheduler process that could be used to stay persistence here so the answer is

1
schtasks.exe

If there was a snort IDS in the environment at the time of the incident, which rules would it match?

Go to Crowdsourced IDS rules Under Behavior Tab

1
EVENT_CTE_HEADER

Summary#

On this challenge, we learn how to analyze a malicious PPX file on VirusTotal which we will go through

• threat label
• contact urls/domains
• file dropped
• persistent behavior
• IDS Snort rules