UFO-1 - HackTheBox Sherlock
elc4br4
Escenario
https://attack.mitre.org/groups/G0034/
Task 1
T1: According to the sources cited by Mitre, in what year did the Sandworm Team begin operations?
El grupo Sandworm comenz贸 sus operaciones en el a帽o 2009.
Task 2
T2: Mitre notes two credential access techniques used by the BlackEnergy group to access several hosts in the compromised network during a 2016 campaign against the Ukrainian electric power grid. One is LSASS Memory access (T1003.001). What is the Attack ID for the other?
En Mitre disponemos de un apartado donde aparecen todas las campa帽as asociadas a este grupo, donde veremos la campa帽a del a帽o 2016, Ukraine Electric Power Attack.
Si clickamos sobre dicha campa帽a tendremos m谩s informaci贸n al respecto, como por ejemplo, las t茅cnicas utilizadas por el grupo Sandworm durante la misma.
Si clicamos en el bot贸n mostrado en la imagen inmediatamente superior se nos abrir谩 una p谩gina donde podremos visualizar todas las t茅cnicas utilizadas durante la campa帽a, y en nuestro caso debemos buscar por "Credential Access Techniques".
Sabemos que de las dos t茅cnicas utilizadas por el grupo, una de ellas es "LSASS Memory Access (T1003.001)", por lo que solo queda la t茅cnica "Brute Force T1110"
Task 3
T3: During the 2016 campaign, the adversary was observed using a VBS script during their operations. What is the name of the VBS file?
Durante la campa帽a de 2016 se observ贸 el uso de un script VBS, y debemos averiguar el nombre del script utilizado.
De nuevo observaremos las t茅cnicas utilizadas por este grupo durante dicha campa帽a y veremos la siguiente:
El grupo utiliz贸 un script VBS para facilitar la transferencia de otras herramientas.
El nombre del script utilizado es ufn.vbs.
Task 4 & Task 5
T4: The APT conducted a major campaign in 2022. The server application was abused to maintain persistence. What is the Mitre Att&ck ID for the persistence technique was used by the group to allow them remote access?
T5: What is the name of the malware / tool used in question 4?
El grupo utiliz贸 una webshell denominada Neo-REGEORG para mantener el acceso.
Utilizaron la t茅cnica "T1505.003" para generar persistencia.
Task 6 & Task 7
T6: Which SCADA application binary was abused by the group to achieve code execution on SCADA Systems in the same campaign in 2022?
T7: Identify the full command line associated with the execution of the tool from question 6 to perform actions against substations in the SCADA environment.
Sandworm ejecut贸 un binario de la aplicaci贸n MicroSCADA scilc.exe para enviar una lista predefinida de instrucciones SCADA especificadas en un archivo definido por el adversario, s1.txt. El comando ejecutado C:\sc\prog\exec\scilc.exe -do pack\scil\s1.txt aprovecha el software SCADA para enviar mensajes de comando no autorizados a subestaciones remotas.
Abusaron del binario scilc.exe para ejecutar c贸digo en los sistemas SCADA.
El comando que ejecutaron fue
C:\sc\prog\exec\scilc.exe -do pack\scil\s1.txt.
Task 8
T8: What malware/tool was used to carry out data destruction in a compromised environment during the same campaign?
El grupo Sandworm utiliz贸 una herramienta para eliminar informaci贸n una vez dentro del entorno comprometido.
Esta herramienta utilizada por el grupo se denomina CaddyWiper.
Task 9
T9: The malware/tool identified in question 8 also had additional capabilities. What is the Mitre Att&ck ID of the specific technique it could perform in Execution tactic?
El ID de la t茅cnica es T1106.
Task 10
T10: The Sandworm Team is known to use different tools in their campaigns. They are associated with an auto-spreading malware that acted as a ransomware while having worm-like features .What is the name of this malware?
El nombre del malware que utilizaba este grupo de ciberdelicuentes se denomina NotPetya.
Task 11
T11: What was the Microsoft security bulletin ID for the vulnerability that the malware from question 10 used to spread around the world?
Task 12
T12: What is the name of the malware/tool used by the group to target modems?
El grupo utilizada la herramienta AcidRain.
Task 13
T13: Threat Actors also use non-standard ports across their infrastructure for Operational-Security purposes. On which port did the Sandworm team reportedly establish their SSH server for listening?
Task 14
T14: The Sandworm Team has been assisted by another APT group on various operations. Which specific group is known to have collaborated with them?
Subscribe to my newsletter
Read articles from elc4br4 directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by
elc4br4
elc4br4
Cybersecurity Student