반응형 HashCalc4 Puzzle #6: Ann’s Aurora The PuzzleAnn Dercover is after SaucyCorp’s Secret Sauce recipe. She’s been trailing the lead developer, Vick Timmes, to figure out how she can remotely access SaucyCorp’s servers. One night, while conducting reconnaissance, she sees him log into his laptop (10.10.10.70) and VPN into SaucyCorp’s headquarters.Leveraging her connections with international hacking organizations, Ann obtains a 0-day.. 2026. 6. 3. Puzzle #5: Ms. Moneymany’s Mysterious Malware The puzzle:It was a morning ritual. Ms. Moneymany sipped her coffee as she quickly went through the email that arrived during the night. One of the messages caught her eye, because it was clearly spam that somehow got past the email filter. The message extolled the virtues of buying medicine on the web and contained a link to the on-line pharmacy. “Do people really fall for this stuff?” Ms. Mone.. 2026. 6. 3. Puzzle #2: Ann Skips Bail After being released on bail, Ann Dercover disappears! Fortunately, investigators were carefully monitoring her network activity before she skipped town.“We believe Ann may have communicated with her secret lover, Mr. X, before she left,” says the police chief. “The packet capture may contain clues to her whereabouts.”You are the forensic investigator. Your mission is to figure out what Ann emai.. 2026. 6. 3. strange-program 문제 볼라틸리티 플러그인 windows.psscan를 이용하여 살아있는 프로세스를 확인하려고 했다. 수집한 psscan에서 explor3r.exe 수상한 프로세스를 확인할 수 있습니다. windows.filescan 플러그인 결과에서 explor3r.exe.img 파일을 추출하였다. strings를 이용하여 해당 파일의 문자열 추출하였다. 문자열을 보면, 바탕화면에 있는 .pdf 파일을 찾아 삭제하는 것을 알 수 있다. 해당 악성 프로세스가 종료된 시간이 UTC 시간이므로 한국 시간으로 변경 후 입력하여 UNIX Timestamp 확인하였다. HashCalc 도구를 이용하여 MD5 해시 값을 확인하였다. 2025. 11. 24. 이전 1 다음 반응형
