search

Hypercraft

A medium-level challenge focused on malware analysis and de-obfuscating malicious code.

hashtag
CHALLENGE DESCRIPTION

This email seems to have come from one of our agents, Axel Knight, but Axel has been missing for weeks, and we believe him to be compromised. The email claims to have information that could be vital to our winning this war, but before we use it, we want to make sure it is safe to open. Analyze the given email and see if it's real, or if it's just the Arodorians trying to phish us, and find the flag.

hashtag
Evidence

  • hypercraft.eml

hashtag
Solution

The challenge give us a .eml file which is an electronic mail format or email in plain text. so I will read it by using cat command line

The challenge provides us with a .eml file, which is an email in plain text format. I will read it using the cat command.

cat hypercraft.eml

Content-Type: multipart/mixed; boundary="===============2174251299668768024=="
MIME-Version: 1.0
Delivered-To: gabriel.wolfe@mod.zenium.htb
From: axel.knight@mod.zenium.htb
To: gabriel.wolfe@mod.zenium.htb
Subject: Urgent - Plans for Arodorian Hypercraft

--===============2174251299668768024==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

Many Zeniumites died to recover the information provided here. Attached you'll find the schematics for the latest hypercraft spaceship under development by the Commonwealth of Arodor Maximus. These plans are more sophisticated than we expected, and show that we are at extreme risk of losing the race, and ultimately, our freedom. Please get these to our top engineers immediately, of all hope for the Zenium is lost.

I'm uploading this over a low-quality long-distance link. If the cloud copy is corrupted, try the download. You must get these plans to leadership. You're our only hope.

-- Axel
--===============2174251299668768024==
Content-Type: application/octet-stream
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="[TOP SECRET] Arodorian Hypercraft.pdf.html"

PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuLXVzIj4KPGhlYWQ+Cjx0aXRsZT48L3RpdGxl
Pgo8L2hlYWQ+Cjxib2R5PgoJPG1haW4gY2xhc3M9ImJ3a3l0Y25sIiBpZD0ianphc2pucGMiIGRh
dGE9IkppcExkeVFzTmpRcWRYTS9OQzQ3Qnd0MEtrc0FWMFVOUHpnMEozSXpLRmN5S3k4WWNqRWNL
aTlWTkRJMktYQXlPQ3gvS1RBL1pCQjlNaWhCVzE5cUhRSUxDMWtKSHl0NVVUd3lIQUJjUDB3aExq
OElOaFE2Qkc0Q0F3UVhXeVFpTkNJaWRpQmlWQWd5SkRjS0JURXJVZ0o1QWprMlBXSjNJREl2SWlz
N0FTNHlMbnBIRUFvVERDRnhYeVUvQ2hRU1lFbzJBRDBNUUFBbEN3Y01CQjgwZFVaTkp3ZCtCenNJ
VGdBTEJnMEZSaFUvUzBnOEVqbHlOa05PWGxKOE4yMHFJQTVYZGowd0N3SjNFbHNVQmtKRVp4dEFO
azAzTVExWWR3eGRFbHN0T1JvYlJTeEROQXh2UURBT1d4UWpSVlpWQkZ3ZkdWd0NTUUJXRmdVVkNC
MFVXeXNvVG4xVFhBVmFJQnRvSUQ0T01rWmdkeFZPQUY0R1NEb1FRdzRDSFRkYk94SVlYQUU5RGg4
aUNod3dBaGxGVndZdFVFbzFIRmtOQmlNTmZ4WmFWRkk0S1RkSEh4c0ZYM3MrRlJGYmRTUWFJUWxP
VEI0WUd5TUdMVzVFUmhNcUhoNUtHMTgrVjFSWkkxUmJTRDlkU2k0R0V6a1JFd2QwQVFrZFhGRmJI
eklOS2p4WFZTODVQUlpUUUg0UEhCMERIUWhuUEFFbkFuWU1HQjBCQ0VZTEJoSWpUVHdPQnlBTkNn

...

dW9zY3Zka3JjcmZvZXZpdGlpZmV4c2h1Y3VtYWJidmxiZGxndmhpa3Jxc3VheXN6ZG1qZWRldGxt
b3dheHBmZHFub3phcHRkYmlrY2R5d3Ntd3pnaWh6aXhwdGFxbmpyZGFwamtldnJ6cWR6cnRzbXZm
bWFzZml4aHd5aG56dWVyaW1zdXFseWx6ZWxtbmFyc20iPjwvZGl2PjwvYm9keT4KPC9odG1sPgo=

--===============2174251299668768024==--

This email was sent from axel.knight@mod.zenium.htb, a person who has been reported missing for a week. The content seems suspicious, as the sender tries to convince the recipient that the email contains an important attachment and urges them to download it. Additionally, the sender asks the victim to spread the suspicious attachment. To determine whether the attachment is malicious, we need to extract it from .eml file.

I will use EML Extractorarrow-up-right to complete this task. After successfully cloning the project, I used the following command line to extract the attachment:

After running the command, we received a folder named Urgent - Plans for Arodorian Hypercraft, which contains a file called [TOP SECRET] Arodorian Hypercraft.pdf.html.

Now, I will conduct the static analyst on this suspicious file. First, I will get the MD5 hash value of this file then search this value in Virustotal.

Virustotal result

According to VirusTotal, this file was labeled as trojan.cryxos/leonem. When I researched the Behavior tab, I realized that this file drops another file named [TOP SECRET] Arodorian Hypercraft.pdf.js.

Files Dropped

To achieved this js file, we need to perform dynamic analyst

!!!!NOTE!!!!: To complete this task, we need to run the file in an isolated Windows environment that has no internet connection, and with Windows Defender turned off. Be sure to take a clean snapshot of your environment before running the malware, so you can revert to a clean state once you've finished the analysis.

We will trigger the file by double-clicking on it. A webpage will open, and a file named '[TOP SECRET] Arodorian Hypercraft.pdf.js' will be downloaded.

webpage
javascipt file

Let's take a look at the code inside.

TOP SECRET javacript code

We can observe that the code has been obfuscated. To make it more readable, I have removed unnecessary comments and cleaned up the code, as shown below.

With the readable version, we can easily understand what the code is doing. The attacker attempts to assign an encoded value to a variable, and the rest of the code tries to decode the value of the uwetjyhi variable. We can see that the cyfgvptr() function is called with a decoded text parameter, which seems to execute the parsed code. Therefore, we will print the parameter out.

Save the cleaned code to a JavaScript file and run it. The result will print out a new JavaScript code

Upon examining the code, I noticed it contains many redundant variables that are not used in the program. Therefore, I will remove these unnecessary variables to make the code easier to read. Below is the cleaned version of the code.

With the cleaner code, I have quick summary of this:

  • The function xhhwtarcadepz will decode the encoded message that is passed to it.

  • Variable bxmanhtn contains the encoded message

  • Variable ynvjonvw will contains the output of xhhwtarcadepz function (a readable message)

  • The variable ugerrorfkln seems to execute the result from the variable ynvjonvw. The execution is triggered after a certain duration.

Therefore, I will print out the ynvjonvw variable and comment out the execution section

Run the javascript and we will see the result

We can notice that an powershell script will be executed in this code. However, this script is encoded. I will use Cyberchef to decode it

Cyberchef decode powershell script

Quick summary:

  • Function UYcxq will decode the encoded message

  • After decode process by function UYcxq, the result will be save in variables: EUMlmXNyUGzzOO, suQQsIgl, XSxNApVe, aetRsdf, tkqrmLSfPD

  • The code will set up new scheduled Task to run the malicious

We can use powershell to print out all the command line that was obfucated

We will print out the value that was saved in those variable. This will be done by run the code below in the powershell

Flag: HTB{l0ts_of_l4Y3rs_iN_th4t_1}

PreviousMediumNextInterstellar C2

Last updated