【TryHackMe】MAL: Researching：Walkthrough

# 概要

TryHackMe「MAL: Researching」のWalkthroughです。

https://tryhackme.com/r/room/malresearching

# Task3

## **Q1**.*Name the term for an individual piece of binary*

**A**.**Bit**

## **Q2**.*What are checksums also known as?*

**A**.**Hashes**

## **Q3**.*Name the algorithm that is next in the series after SHA-256*

**A**.**SHA-512**

## **Q4**.*According to this task, how long will you need to hash 6 million files before a MD5 hash collision occurs?*

**A**.**100 Years**

## **Q5**.*Who developed the MD5 algorithm?*

**A**.**Ronald Rivest**

# Task4

## **Q1**.*Name the key term for the type of malware that Emotet is classified as*

**Hint**.*Look at the room's thumbnail for a hint!*

**A**.**trojan**

## **Q2**.*Research time! What type of emails does Emotet use as its payload?*

**A**.**spam emails**

## **Q3**.*Begin analysing the report, what is the timestamp of when the analysis was made?*

**Hint**.*Copy and paste exactly how it is listed on the report*

Any.runレポートの`Analysis date`項目を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/78e34028-8bf2-48a5-ea2c-78fedf5b6336.png)

**A**.**9/16/2019, 13:54:48**

## **Q4**.*Name the file that is detected as a "Network Trojan"*

`Behavior activities`の`EMOTET was detected`を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/4563ba48-823e-2d73-9168-ec12548022d0.png)

**A**.**easywindow.exe**

## **Q5**.*What is the PID of the first HTTP GET request?*

`Network activity`の`HTTP requests`項目を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/92bcc658-eda2-7d86-9da7-e65a1bfb5155.png)

**A**.**2748**

## **Q6**.*What is the only DNS request that is made after the sample is executed?*

`DNS requests`の項目を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/98a59abb-76d5-4c9b-0248-238a1c3b8a83.png)

**A**.**blockchainjoblist.com**

# Task5

## **Q1**.*Using the HashTab tool, what is the MD5 checksum for "LoginForm.exe"?*

**Hint**.*You can copy and paste over RDP!*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/e44be80a-2ff0-f88b-a43a-e94eec79516d.png)

**A**.**FF395A6D528DC5724BCDE9C844A0EE89**

## **Q2**.*Using Get-FileHash in Powershell, retrieve the SHA256 of "TryHackMe.exe"*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/950c6987-feab-6009-4921-a17f0a9caab4.png)

**A**.**6F870C80361062E8631282D31A16872835F7962222457730BC55676A61AD1EE0**

## **Q3**.*What would be the syntax to retrieve the SHA256 checksum of "TryHackMe.exe" using CertUtil in Powershell?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/8ac9f6f4-bc3d-729e-707d-2a3732c5aa92.png)

**A**.**CertUtil -hashfile TryHackMe.exe SHA256**

# Task6

## **Q1**.*Navigate to the "Details" tab, what is the other filename and extension reported as present?*

`DETAILS`の`Names`項目を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/a89eeb5e-82d0-5e30-803c-93c88e807596.png)

**A**.**HxD.exe**

## **Q2**.*In the same "Details" tab, what is the reported compilation timestamp?*

`Portable Executable Info`の`Compilation Timestamp`を確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/de5c5407-3fbc-32c4-a2c0-e63fbacb24a2.png)

**A**.**2020-02-28 11:16:36**

## **Q3**.*What is the THM{} formatted flag on the report?*

**Hint**.*Look through the tabs!*

`COMMUNITY`タブを確認します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/388523bf-87e4-bca9-c4e1-6de6f98588c9.png)

**A**.**THM{TryHackMe_Malware_Series_Research_Flag}**