Forum Discussion

-jlo-'s avatar
-jlo-
Icon for Bronze II rankBronze II
29 days ago

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

For this lab I need to rebuild the PowerShell script using the three parts found in the PowerShell operational logs.  Which I am able to do fairly easily but when I am required to obtain the MD5 hash...
defensive cyber
  • RobN's avatar
    RobN
    27 days ago

    I think you have the artifacts right as you posted the same code I did. If you paste it into cyberchef and then look at the right hand side and click on crlf, try changing it to line feed (see screenshot) and then delete all the red marks that show up. This should give the correct hash (if you select md5 from the cyberchef recipe menu).

     

TillyCorless's avatar
TillyCorless
Icon for Community Manager rankCommunity Manager

Hi -jlo- welcome to The Human Connection! Thanks for sharing one of the approaches you've taken by removing white spaces and return characters. I will speak with the lab author and come back to you, but in the meantime, can you share some other approaches you've tried and which haven't worked so far? 


-jlo-'s avatar
-jlo-
Icon for Bronze II rankBronze II
29 days ago

Thanks Tilly for your response.  I wish I could go into EVERY approach to my problem, I've tried hashing a file modified 100s of times by adding, removing spaces in trying to find the correct sequence.  

From the lab, there are 3 separate parts/logs that need to be combined and created into a script.  From there, one must find the MD5 hash of this file but leaving one character in/out will throw the sum/hash up.   

Attached is a screenshot of my SPLUNK pull and the 3 message blocks I need to combine to recreate the script.  I'm assuming all I need to combine is the 3x message fields and NOT the other SPLUNK fields.  Anyways - not sure if my response was helpful.  

 

  • RobN's avatar
    RobN
    Icon for Bronze II rankBronze II
    27 days ago

    I have the same issue with this. I pasted the details into cyberchef and ran md5 from the left hand column. I tried removing spaces manually to clean up the code and and checked the hash afterwards but this didn't work. The lab advises recreating the file by joining the parts to do a md5sum check but windows defender flags it as a virus each time too.