Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID

Summary: Unit 42 published the answers to its Wireshark quiz built on a packet capture of an IcedID (Bokbot) infection in an Active Directory environment in April 2023, in which one of three Windows clients was infected. The pcap shows the host at 10.4.19.136 sending an HTTP GET to hxxp://80.77.25.175/main.php at 15:31:08 UTC, receiving a 302 redirect to a Firebase Storage URL that delivered a password-protected ZIP containing Scan_Inv.exe, an IcedID installer that then fetched a gzip binary from skigimeetroc.com at 15:35:39 UTC before HTTPS command-and-control traffic began to askamoshopsi.com and skansnekssky.com.

Key Takeaway: The installer's cookie carried the victim's hostname and Windows account name in hex, and the BackConnect traffic that followed enumerated three clients logged in to the domain controller for boogienights.live and listed the victim's disk drives - the kind of reconnaissance that precedes ransomware in a high-value environment.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related