Forum Discussion

-jlo-'s avatar
-jlo-
Icon for Bronze II rankBronze II
17 days ago

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

For this lab I need to rebuild the PowerShell script using the three parts found in the PowerShell operational logs.  Which I am able to do fairly easily but when I am required to obtain the MD5 hash...
defensive cyber
  • RobN's avatar
    RobN
    14 days ago

    I think you have the artifacts right as you posted the same code I did. If you paste it into cyberchef and then look at the right hand side and click on crlf, try changing it to line feed (see screenshot) and then delete all the red marks that show up. This should give the correct hash (if you select md5 from the cyberchef recipe menu).

     

CyberSharpe's avatar
CyberSharpe
Icon for Bronze III rankBronze III
15 days ago

I used cyber chef for this. Making sure I didn’t have any additional spaces in between. I then created the file using the output save to function. Then ran an MD5SUM against it. 

  • -jlo-'s avatar
    -jlo-
    Icon for Bronze II rankBronze II
    15 days ago

    Thanks CyberSharpe for your response.  I have been using cyberchef but unfortunately in the environment that I am in I cannot save an actual file from the website, but I am able to copy/paste in the tools provided.  Either way, doing the joining natively on my box or using cyberchef (copy/paste) I am getting the same MD5 hash - which isn't working for the question. 

    A question if you have a moment, please.   I'm not looking for the answer here, but in your script is your first AND last line, respectively, these (below)?

    $EncodedCompressedFile = @'
    $Output | IEX

    • CyberSharpe's avatar
      CyberSharpe
      Icon for Bronze III rankBronze III
      14 days ago

      I believe you’re doing everything right, but you might be missing a newline after IEX. Give it a shot, and if it starts with ‘d12fd’, you’re on the right track!

      • RobN's avatar
        RobN
        Icon for Bronze II rankBronze II
        14 days ago

        I just left the script in as you displayed it but changed the crlf on the right hand side to line feed and removed all the red cr's from the text. This gave me the correct number of bytes and the hash beginning 250e4 which worked. I'd been presuming the space between the two @' & '@ and the base 64 was also meant to be removed hence the incorrect hash.