Zumpyx's Blog

BFT

SherlocksVery Easydfirmft
← Sherlocks

BFT

Pasted-image-20240618154300.png

In this Sherlock, you will become acquainted with MFT (Master File Table) forensics. You will be introduced to well-known tools and methodologies for analyzing MFT artifacts to identify malicious activity. During our analysis, you will utilize the MFTECmd tool to parse the provided MFT file, TimeLine Explorer to open and analyze the results from the parsed MFT, and a Hex editor to recover file contents from the MFT.

在这部《神探夏洛克》中，您将熟悉 MFT（主文件表）取证。您将了解用于分析 MFT 项目以识别恶意活动的知名工具和方法。在我们的分析过程中，您将使用 MFTECmd 工具解析提供的 MFT 文件，利用 TimeLine Explorer 打开并分析解析的 MFT 的结果，以及利用十六进制编辑器从 MFT 恢复文件内容。

任务列表

1、西蒙·斯塔克（Simon Stark）于2月13日成为袭击者的目标。他从一封电子邮件中收到的链接下载了一个ZIP文件。他从链接下载的ZIP文件的名称是什么？

Simon Stark was targeted by attackers on February 13. He downloaded a ZIP file from a link received in an email. What was the name of the ZIP file he downloaded from the link?

Stage-20240213T093324Z-001.zip

2 、检查最初下载的 ZIP 文件的区域标识符内容。此字段显示从中下载文件的 HostUrl，作为我们调查/分析中有价值的入侵指标 （IOC）。从中下载此 ZIP 文件的完整主机 URL 是什么？

Examine the Zone Identifier contents for the initially downloaded ZIP file. This field reveals the HostUrl from where the file was downloaded, serving as a valuable Indicator of Compromise (IOC) in our investigation/analysis. What is the full Host URL from where this ZIP file was downloaded?

https://storage.googleapis.com/drive-bulk-export-anonymous/20240213T093324.039Z/4133399871716478688/a40aecd0-1cf3-4f88-b55a-e188d5c1c04f/1/c277a8b4-afa9-4d34-b8ca-e1eb5e5f983c?authuser

3、执行恶意代码并连接到 C2 服务器的恶意文件的完整路径和名称是什么？

What is the full path and name of the malicious file that executed malicious code and connected to a C2 server?

C:\Users\simon.stark\Downloads\Stage-20240213T093324Z-001\Stage\invoice\invoices\invoice.bat

4、分析先前标识的文件的 $Created 0x30 时间戳。此文件是何时在磁盘上创建的？

Analyze the $Created0x30 timestamp for the previously identified file. When was this file created on disk?

2024-02-13 16:38:39

5、在许多调查方案中，查找 MFT 记录的十六进制偏移量非常有用。从问题 3 中找到 stager 文件的十六进制偏移量。

Finding the hex offset of an MFT record is beneficial in many investigative scenarios. Find the hex offset of the stager file from Question 3.

16E3000

6、每个 MFT 记录的大小为 1024 字节。如果磁盘上的文件大小小于 1024 字节，则可以直接存储在 MFT 文件本身上。这些文件称为 MFT 驻留文件。在 Windows 文件系统调查期间，查找可能驻留在 MFT 中的任何恶意/可疑文件至关重要。这样我们可以找到恶意文件/脚本的内容。找到问题 3 中标识的恶意暂存器的内容，并使用 C2 IP 和端口回答。

Each MFT record is 1024 bytes in size. If a file on disk has smaller size than 1024 bytes, they can be stored directly on MFT File itself. These are called MFT Resident files. During Windows File system Investigation, its crucial to look for any malicious/suspicious files that may be resident in MFT. This way we can find contents of malicious files/scripts. Find the contents of The malicious stager identified in Question3 and answer with the C2 IP and port.

43.204.110.203:6666

前期准备

工具准备

数据整理

  • MFTECmd
MFTECmd.exe -f $MFT --dr --csv . --csvf mft.csv
  • TimeLine Explorer

使用 TimeLine Explorer 打开导出的 mft.csv 文件

分析

问题 1 提到是 simon stark 用户，搜索他的下载目录

Pasted-image-20240711085909.png

结合时间以及文件类型可以找到，他从链接下载的 Zip 文件是 Stage-20240213T093324Z-001.zip

Zone Id Contents 字段可以分析文件来源

Pasted-image-20240711090123.png

发现文件来源：https://storage.googleapis.com/drive-bulk-export-anonymous/20240213T093324.039Z/4133399871716478688/a40aecd0-1cf3-4f88-b55a-e188d5c1c04f/1/c277a8b4-afa9-4d34-b8ca-e1eb5e5f983c?authuser

在下载的压缩包路径下搜索恶意文件

Pasted-image-20240711090755.png

发现 bat 文件用于执行恶意代码，文件路径为：C:\Users\simon.stark\Downloads\Stage-20240213T093324Z-001\Stage\invoice\invoices\invoice.bat 文件的创建时间为：2024-02-13 16:38:39 文件创建时间要看 Created0x30 字段

Pasted-image-20240711091822.png

MFT 记录的十六进制偏移量用 **Entry Number ** 计算，[Entry Number] * 1024

>>> hex(23436 * 1024)
'0x16e3000'

HTB 的答案需要去掉 0x：16e3000

导出驻留文件可以使用命令：

MFTECmd.exe -f '.\$MFT' --de 23436-9

Pasted-image-20240711093157.png

C2 的 IP 和端口是：43.204.110.203:6666

Hints

  1. None
  2. None
  3. Identify any suspicious file related to the initially downloaded ZIP file. Look for MFT records with suspicious extensions and timestamps around the ZIP download time.
  4. None
  5. In MFT records, find the Entry Number value for the file in question. Multiply that number by 1024 (since this is the size of each record). The result is the offset in Decimal. Convert it to hex to find your answer.
  6. Open the MFT file in any hex editor tool of your choice. Then, either search for or jump to the offset identified in the previous question to find the stager file contents. For example, in the HxD (Hex editor) tool, go to the search tab and click the “go to” button, which opens up a prompt where you can input either hex or decimal offset to navigate to the relevant location.