Post cover image

October 14, 2026

HawkEye lab — CyberDefenders Writeup

How to get each answer in Wireshark

By Sushma

6 min read

How to get each answer in Wireshark

Q1 to 3 (capture facts): Statistics > Capture File Properties gives packets, first packet time, and elapsed time. For UTC, use View > Time Display Format > UTC Date and Time of Day.

1 How many packets does the capture have?

None None

ANS:4003

2 At what time was the first packet captured (UTC)?

None

ANS:2019–04–10 20:37 (read the seconds from Wireshark in UTC)

3 What is the duration of the capture?

None

ANS: 01:03:41

Q4 to 6 (link level): Statistics > Endpoints > Ethernet, sort by packets. Filter eth.addr==00:08:02:1c:47:ae and read the OUI vendor, or use a MAC lookup site. The OUI belongs to HP, so search for HP's headquarters.

4 What is the most active computer at the link level?

None None

5 Manufacturer of the NIC of the most active system at the link level?

None None

MAC address 00:08:02 | MAC Address Lookup Vendor/Company: Hewlett Packard, MAC prefix/OUI: 00:08:02, address: 20555 State Highway 249, Houston TX 77070, US

None

MAC Address Lookup | MAC/OUI/IAB/IEEE Vendor Search MAC lookup tool searches MAC address or OUI in the MAC address vendor database. Perform MAC or OUI lookup or check…

Hewlett-Packard

6 Where is the headquarter of the company that manufactured the NIC of the most active computer at the link level?

None

palo alto

Q7 (hosts): Statistics > Endpoints > IPv4. The article finds four private addresses in the range, but the .255 is the broadcast address, so subtract it. That leaves three computers.

7 The organization works with private addressing and netmask /24. How many computers in the organization are involved in the capture?

None None

Q8 (hostname): Filter eth.addr==00:08:02:1c:47:ae && dhcp, open the first frame, and read Option 12 (Host Name).

8 What is the name of the most active computer at the network level?

None

Beijing-5cd1-PC

Q9 (DNS server): Filter dns. The destination of the victim's first query is the organization's DNS server.

9 What is the IP of the organization's DNS server?

None

Internet Protocol Version 4, Src: 10.4.10.132, Dst: 10.4.10.4

Q10 to 12 (the lure domain): frame.number == 204 shows the query. Use frame contains proforma-invoices.com to find the IP, then check the IP's country with AbuseIPDB or whois.

10 What domain is the victim asking about in packet 204?

None

11 What is the IP of the domain in the previous question?

None

12 Indicate the country to which the IP in the previous section belongs.

None

https://www.abuseipdb.com/check/217.182.138.150

Q13 (OS): Filter eth.addr==00:08:02:1c:47:ae && http.request, Follow TCP Stream, and read the User-Agent header.

13 What operating system does the victim's computer run?

None None

WINDOWS NT 6.1

Q14 and 15 (the file): Filter http.request.method == GET, and the file request stands out. Then File > Export Objects > HTTP (the article saves packet 3155) and hash it: md5sum tkraw_Protected99.exe, or certutil -hashfile ... MD5 on Windows.

14 What is the name of the malicious file downloaded by the accountant?

None None

tkraw_Protected99.exe

15 What is the md5 hash of the downloaded file?

None None 
┌──(kali㉿kali)-[~/Downloads/temp_extract_dir]
└─$ md5sum tkraw_Protected99.exe
71826ba081e303866ce2a2534491a2f7  tkraw_Protected99.exe

16 What software runs the webserver that hosts the malware?

None

VirusTotal VirusTotal

None None

Q17 (web server): Follow the HTTP stream to proforma-invoices.com and read the response Server: header.

17 What is the public IP of the victim's computer?

None None None None

Q18 (public IP): The malware checks its external IP through bot.whatismyipaddress.com (frame 3164). Add http.host as a column to find it. The response body contains the victim's public IP.

18 In which country is the email server to which the stolen information is sent?

None None None

United States

https://www.abuseipdb.com/check/23.229.162.69

Q19 to 23 (SMTP exfiltration): Filter ip.addr == 10.4.10.132 && smtp.req.

  • The destination IP is the mail server, so geolocate it for Q19.
  • Follow the TCP stream: the banner shows the server software (Q21), the recipient shows the account (Q22), and the AUTH exchange is base64-encoded, so decode it in CyberChef (From Base64) for the username and password (Q23, frame 3182 in the article).
  • Run whois on the domain for the creation date (Q20).

19 Analyzing the first extraction of information. What software runs the email server to which the stolen data is sent?

None None

Exim 4.91

20 To which email account is the stolen information sent?

None

sales.del@macwinlogistics.in

21 What is the password used by the malware to send the email?

None None

22 Which malware variant exfiltrated the data?

None 
HawkEye Keylogger - Reborn v9
Passwords Logs
roman.mcguire \ BEIJING-5CD1-PC

==================================================
URL               : https://login.aol.com/account/challenge/password
Web Browser       : Internet Explorer 7.0 - 9.0
User Name         : roman.mcguire914@aol.com
Password          : P@ssw0rd$
Password Strength : Very Strong
User Name Field   :
Password Field    :
Created Time      :
Modified Time     :
Filename          :
==================================================

==================================================
URL               : https://www.bankofamerica.com/
Web Browser       : Chrome
User Name         : roman.mcguire
Password          : P@ssw0rd$
Password Strength : Very Strong
User Name Field   : onlineId1
Password Field    : passcode1
Created Time      : 4/10/2019 2:35:17 AM
Modified Time     :
Filename          : C:\Users\roman.mcguire\AppData\Local\Google\Chrome\User Data\Default\Login Data
==================================================

==================================================
Name              : Roman McGuire
Application       : MS Outlook 2002/2003/2007/2010
Email             : roman.mcguire@pizzajukebox.com
Server            : pop.pizzajukebox.com
Server Port       : 995
Secured           : No
Type              : POP3
User              : roman.mcguire
Password          : P@ssw0rd$
Profile           : Outlook
Password Strength : Very Strong
SMTP Server       : smtp.pizzajukebox.com
SMTP Server Port  : 587
==================================================
None

Reborn v9

23 What are the bankofamerica access credentials? (username:password)

==================================================
URL               : https://www.bankofamerica.com/
Web Browser       : Chrome
User Name         : roman.mcguire
Password          : P@ssw0rd$
Password Strength : Very Strong
User Name Field   : onlineId1
Password Field    : passcode1
Created Time      : 4/10/2019 2:35:17 AM
Modified Time     :
Filename          : C:\Users\roman.mcguire\AppData\Local\Google\Chrome\User Data\Default\Login Data
roman.mcguire:P@ssw0rd$

Q24 : The email body is also base64. Decode it in CyberChef to read the HawkEye report, which names the variant and lists captured URLs, usernames, and passwords, including the Bank of America entry. The emails arrive about every 10 minutes by timestamp.

24 Every how many minutes does the collected data get exfiltrated?

None

10 minutes

Thanks for Reading:)