Securebug.se CTF Loki 2021 write up

Secret Document - Forensics

 

A Classified.docx file is given.

However, this files is not docx file.

 

This file is pcap file.

 

Rename .docx to .pcapng, then convert pcapng to pcap (https://pcapng.com/) (for using networkminer).

 

---

 

Open a Projan.pcap with networkminer.

The windows Defender detect a malware.

 

Upload goog1e_born_help.exe to virustotal.

ponmocup

반응형

---

ImposterApp - forensics

A memdump file is given.

imageinfo

Win8SP0x64

 

pstree

chrome, ie ,cmd, powershell, calc

-> chromehistory, iehistory, cmdscan, clipboard ... : nothing

 

R-studio

calc.exe is suspicious.

procdump -p 2816

 

flag.