Squid Game | TryHackMe | Walkthrough

Task 2 Attacker 1

1.1) What is the malicious C2 domain you found in the maldoc where an executable download was attempted?

fpetraardella.band/xap_102b-AZ1/704e.php?l=litten4.gas

fpetraardella.band/xap_102b-AZ1/704e.php?l=litten4.gas

1. oledump.py attacker1.doc -s 4 -S is a command used to inspect a Microsoft Office document (often during malware analysis).

• oledump.py = Didier Stevens' tool for analyzing OLE files (such as legacy .doc, .xls, .ppt files).
• attacker1.doc = the Office document being analyzed.
• -s 4 = select stream 4 inside the OLE file.
• -S = display the stream's contents as strings (extract readable text from the selected stream).

Stream 4 contains a heavily obfuscated PowerShell command. The excessive use of [ characters immediately stands out and matches the obfuscation pattern identified in the previous analysis

2. Decode From Cyberchef

• Find & Replace → Replace [ with A
• From Base64
• Remove null bytes

1.2) What executable file is the maldoc trying to drop?

QdZGP.exe

QdZGP.exe

1.3) In what folder is it dropping the malicious executable? (hint: %Folder%)

%ProgramData%

%ProgramData%

The CommonApplicationData folder corresponds to the Windows %ProgramData% directory.

The script constructs a file path by retrieving the system's common application data directory (%ProgramData%) and appending the filename QdZGP.exe. As a result, the executable is dropped to:

C:\ProgramData\QdZGP.exe

C:\ProgramData\QdZGP.exe

1.4) Provide the name of the COM object the maldoc is trying to access.

ShellBrowserWindow

ShellBrowserWindow

The script defines the following CLSID:

$clsid = New-Object Guid 'C08AFD90-F2A1-11D1-8455-00A0C91F3880'

$clsid = New-Object Guid 'C08AFD90-F2A1-11D1-8455-00A0C91F3880'

A lookup of this CLSID shows that it corresponds to the ShellBrowserWindow COM object.

ShellBrowserWindow is a Windows COM object associated with Windows Explorer (Shell). Malware may attempt to access or instantiate this object to interact with the Windows shell, launch processes, manipulate Explorer windows, or execute code through trusted Windows components.

1.5) Include the malicious IP and the php extension found in the maldoc. (Format: IP/name.php)

176.32.35.16/704e.php

176.32.35.16/704e.php

1.6) Find the phone number in the maldoc. (Answer format: xxx-xxx-xxxx)

213-446-1757 x7135

213-446-1757 x7135

1.7) Doing some static analysis, provide the type of maldoc this is under the keyword "AutoOpen".

AutoExec

AutoExec

• AutoExec refers to VBA macros that execute automatically without requiring the user to manually run them.
• In Microsoft Word, AutoOpen is a special macro that runs automatically when the document is opened.
• Malware authors commonly use AutoOpen/AutoExec techniques to execute malicious code as soon as a victim opens the document.

1.8) Provide the subject for this maldoc. (make sure to remove the extra whitespace)

West Virginia Samanta

West Virginia Samanta

1.9) What time was the document last saved?

2019-02-07 23:45:30

2019-02-07 23:45:30

1.10) Provide the stream number that contains a macro.

8

8

1.11) Provide the name of the stream that contains a macro.

ThisDocument

ThisDocument

Task 3 Attacker 2

2.1) Provide the streams (numbers) that contain macros.

12, 13, 14, 16

12, 13, 14, 16

2.2) Provide the size (bytes) of the compiled code for the second stream that contains a macro.

13867

13867

The second macro stream (Stream 13) displays both the compiled code size and the compressed VBA size.

The -i option shows detailed information about VBA macro streams. For the second macro-containing stream (Stream 13), the compiled code size is reported as 13,867 bytes. This value represents the size of the compiled VBA P-code stored within the document.

2.3) Provide the largest number of bytes found while analyzing the streams.

63641

63641

2.4) Find the command located in the 'fun' field ( make sure to reverse the string).

cmd /k cscript.exe C:\ProgramData\pin.vbs

cmd /k cscript.exe C:\ProgramData\pin.vbs

We extract all VBA code using:

oledump.py attacker2.doc -s a -v

• Dumps the VBA code from stream a (hexadecimal for stream 10).
• -v displays the VBA source code.

grep "fun"

• Searches for lines containing the string fun.

rev

• Reverses each matching line character-by-character.

2.5) Provide the first domain found in the maldoc.

priyacareers.com/u9hDQN9Yy7g/pt.html

priyacareers.com/u9hDQN9Yy7g/pt.html

2.6) Provide the second domain found in the maldoc.

perfectdemos.com/Gv1iNAuMKZ/pt.html

perfectdemos.com/Gv1iNAuMKZ/pt.html

• -s a → Selects stream a (hexadecimal stream 10).
• -S → Extracts readable strings from the stream.
• grep -i http → Searches for strings containing http (case-insensitive).

2.7) Provide the name of the first malicious DLL it retrieves from the C2 server.

www1.dll

www1.dll

2.8) How many DLLs does the maldoc retrieve from the domains?

5

5

2.9) Provide the path of where the malicious DLLs are getting dropped onto?

C:\ProgramData

C:\ProgramData

2.10) What program is it using to run DLLs?

rundll32.exe

rundll32.exe

-s a →Selects stream a (hexadecimal stream 10)

-S→Displays extracted strings from the selected stream

grep -i run→Searches for occurrences of the word run (case-insensitive)

2.11) How many seconds does the function in the maldoc sleep for to fully execute the malicious DLLs?

15

15

Search sleep calls:

• WScript.Sleep(15000)
• 15000 ms = 15 seconds

2.12) Under what stream did the main malicious script use to retrieve DLLs from the C2 domains? (Provide the name of the stream).

Macros/Form/o

Macros/Form/o

Finally, we need to determine which stream contains the Command-and-Control (C2) retrieval logic.

Using a YARA string search:

• The YARA rule searches for the string priyacareers.com across all streams in the document.
• A match is found in the stream named Macros/Form/o.
• Since this stream contains the C2 domain reference, it is the location that holds the C2 retrieval logic responsible for contacting the remote server.

Task 4 Attacker 3

3.1.) Provide the executable name being downloaded.

1.exe

1.exe

• -s a Selects stream a (hexadecimal stream 10).
• -S Extracts readable strings from the selected stream.
• grep exe Searches for strings containing exe.

3.2) What program is used to run the executable?

Certutil

Certutil

Certutil is a legitimate Windows command-line utility used for certificate management. However, it is also a well-known dual-use tool that attackers frequently abuse to:

• Download files from remote servers
• Encode or decode payloads
• Transfer malicious files
• Evade detection by leveraging a trusted Windows binary

3.3 ) Provide the malicious URI included in the maldoc that was used to download the binary (without http/https).

8cfayv.com/bolb/jaent.php?l=liut6.cab

8cfayv.com/bolb/jaent.php?l=liut6.cab

3.4 ) What folder does the binary gets dropped in?

ProgramData

ProgramData

Searching for http strings directly with oledump does not reveal the download URL. To emulate the VBA macro and uncover hidden strings, we use ViperMonkey:

ViperMonkey executes the macro logic in a safe emulated environment and reveals the actual URI constructed at runtime.

• The URL is not stored in plain text within the document.
• The macro dynamically builds or obfuscates the URI, preventing simple string searches from finding it.
• ViperMonkey emulates the macro execution and reconstructs the final URL.

3.5) Which stream executes the binary that was downloaded?

A3

A3

To determine which stream is responsible for executing the payload, we can search for a known executable name using a YARA string match:

• --yara=#s#1.exeSearches all streams for the string 1.exe.
• attacker3.docSpecifies the malicious document to analyze.

The presence of 1.exe in Stream A3 indicates that this stream contains code related to the execution of the payload. This makes Stream A3 the stream responsible for launching or referencing the executable.

Task 5 Attacker 4

4.1) Provide the first decoded string found in this maldoc.

MSXML2.XMLHTTP

MSXML2.XMLHTTP

4.2 ) Provide the name of the binary being dropped.

DYIATHUQLCW.exe

DYIATHUQLCW.exe

4.3) Provide the folder where the binary is being dropped to.

TEMP

TEMP

4.4) Provide the name of the second binary.

bin.exe

bin.exe

4.5) Provide the full URI from which the second binary was downloaded (exclude http/https).

gv-roth.de/js/bin.exe

gv-roth.de/js/bin.exe

1.Run show oledump and then start with steam 7 ,indicating it contained VBA macros.

2. We found multiple uses of an XORI function, which is a common XOR-based obfuscation.

3. Decode from cyberchef

• From Hex → convert hex to bytes
• XOR → apply key to reveal the original string

5. Identification of the First Binary

Among the decoded strings, one value was identified as a Windows executable named DYIATHUQLCW.exe.

Rationale: Malicious VBA macros frequently drop executable files onto the victim's system to facilitate the execution of subsequent payloads. By decoding the obfuscated strings generated by the XORI function, the name of the executable was successfully recovered.

6. Identification of the Drop Location

Analysis of the decoded strings revealed that the macro utilized the TEMP directory as the destination for storing the dropped binary.

Rationale: Malware commonly leverages temporary directories to store malicious files because these locations are typically writable by standard users and may attract less scrutiny. This behavior was evident from the decoded VBA code.

7. Identification of the Second Binary

Further examination of the decoded strings revealed a second executable named bin.exe.

Rationale: Decoding the obfuscated strings in sequence enabled the reconstruction of the malware's execution workflow and the identification of additional payloads referenced by the macro.

8. Identification of the Full URI for the Second Binary

One of the decoded strings contained the URL associated with the second executable:

Methodology: The URI was recovered by decoding the obfuscated VBA strings using CyberChef and reviewing the resulting plaintext values.

Rationale: Identifying the download location of malicious binaries is essential for understanding the malware's delivery mechanism, infrastructure, and potential command-and-control (C2) communications.

Task 6 Attacker 5

5.1) What is the caption you found in the maldoc?

CobaltStrikeIsEverywhere

CobaltStrikeIsEverywhere

• oledump.py attacker5.doc → Analyze the OLE Word document.
• -s a → Select stream A (hexadecimal stream ID).
• -S → Dump the stream contents as text.
• | grep -i caption → Search for the word "caption" (case-insensitive).

Methodology: By extracting and reviewing the VBA source code, we located a string variable associated with the document's caption field.

Significance: The caption provides a strong indication of the command-and-control (C2) framework leveraged by the malware. In this case, the string explicitly references Cobalt Strike, a well-known adversary simulation and post-exploitation framework that is frequently abused by threat actors. The discovery of this caption further confirms the malicious nature of the document and provides valuable context for the subsequent stages of analysis.

5.2) What is the XOR decimal value found in the decoded-base64 script?

35

35

Decoding the Base64 + XOR Payload

we noticed that the document contains a Base64-encoded script, which may also be XOR-obfuscated. To safely emulate the VBA macros without actually executing the malware, we use Vipermonkey:

vmonkey attacker5.doc

vmonkey attacker5.doc

• Base64-encoded script: A script whose contents have been encoded using Base64 to hide the original code.
• XOR-obfuscated: The data may have been further concealed using an XOR operation with a key, making it harder to read directly.
• Payload: The malicious code or data that the malware ultimately wants to execute.
• Vipermonkey: A malware analysis tool that emulates VBA macro execution in Microsoft Office documents, allowing analysts to observe macro behavior safely without running the malware.

In malware analysis, Vipermonkey is commonly used to:

• Reveal hidden PowerShell commands.
• Extract and decode Base64/XOR-obfuscated payloads.
• Identify URLs, dropped files, and other indicators of compromise (IOCs).
• Understand what the macro would do on a victim's system without infecting a real machine.

1.Run Command

2. Decode From CyberChef

• from Base64 decode
• Remove null bytes

3. Decode From CyberChef

• from Base64 decode
• Gunzip

5.3) Provide the C2 IP address of the Cobalt Strike server.

176.103.56.89

176.103.56.89

5.4 ) Provide the full user-agent found.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)

Identifying the C2 Server

The decoded script revealed a Cobalt Strike Command-and-Control (C2) server. By further analyzing the script and applying the XOR key, we were able to extract the IP address and User-Agent used by the malware:

C2 IP: 176.103.56.89 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)

Understanding the C2 infrastructure enables defenders to:

• Block malicious communications between infected hosts and the attacker's server.
• Identify potentially compromised systems by monitoring connections to the C2 IP address.
• Create Indicators of Compromise (IOCs) for threat detection and incident response.
• Recognize similar malware behaviors and attack patterns in future investigations.

Key Terms

• C2 (Command-and-Control) Server: A server used by attackers to send commands to and receive data from compromised machines.
• Cobalt Strike: A legitimate red-team tool that is frequently abused by threat actors for post-exploitation activities and remote control of infected systems.
• User-Agent: A string that identifies the client software making a network request. Malware often disguises itself as a legitimate browser to avoid detection.
• IOC (Indicator of Compromise): Artifacts such as IP addresses, domains, file hashes, or User-Agents that can help identify malicious activity.

5.5) Provide the path value for the Cobalt Strike shellcode.

/SjMR

/SjMR

5.6) Provide the port number of the Cobalt Strike C2 Server.

8080

8080

5.7) Provide the first two APIs found.

LoadLibraryA, InternetOpenA

LoadLibraryA, InternetOpenA

Shellcode Analysis with SCDBG

To analyze the extracted shellcode, I used the following command:

scdbgc -f ~/Downloads/download.dat -s -1

scdbgc -f ~/Downloads/download.dat -s -1

Although SCDBG could not fully emulate the payload because execution jumped to an invalid memory address, the extracted shellcode and embedded strings provided enough information to identify the command-and-control (C2) infrastructure used by the malware.