{"id":796,"date":"2025-12-09T22:14:00","date_gmt":"2025-12-09T22:14:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=796"},"modified":"2025-12-09T18:15:04","modified_gmt":"2025-12-09T18:15:04","slug":"aoc2025-room-6-malware-analysis-egg-xecutable","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=796","title":{"rendered":"AoC2025 Room 6 – Malware Analysis – Egg-xecutable"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/malware-sandbox-aoc2025-SD1zn4fZQt
Created by: tryhackme, cmnatic, SecurityNomad<\/p>\n\n\n\n

“The town of Wareville remains quiet in the middle of the night. While the residents of Wareville are nicely tucked up in bed, blissfully unaware, the SOC team at The Best Festival Company (TBFC)<\/em> remain alert, poised and ready for whatever may face them.
Monitoring their screens, armed with a freshly poured mug of hot cocoa, the elves of the SOC watch their dashboards diligently.”<\/p>\n\n\n\n

Go ahead and start your machine and read the material while it loads. This room has a Medium difficulty and the Objectives look fun so I bet we are going to learn a lot today!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

THM does a great job at detailing everything needed to understand the steps and processes to obtain our answers. I would suggest reading the material then going back to the step where we should start opening up PeStudio and launching our executable to get an idea of what is expected.<\/p>\n\n\n\n

Per THM Echo, “PeStudio is a static analysis tool designed for examining Windows executable files (PE files). It provides insights into various attributes of the executable, including file checksums, imported\/exported functions, and embedded resources. By analyzing these elements, users can identify potential malware characteristics or suspicious behavior without executing the file, making it a valuable asset in malware analysis and reverse engineering.”<\/p>\n\n\n\n

“Static analysis:<\/strong> What is the SHA256Sum of the HopHelper.exe?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When you see the sha256 hash, make sure you right click > copy value to just obtain the hash to copy and paste over to the THM input box.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Static analysis:<\/strong>\u00a0Within the strings of HopHelper.exe, a flag with the format THM{XXXXX} exists. What is that flag value? Note, this can be found towards the bottom of the strings output.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now on to dynamic analysis! “Regshot is a widely used utility, especially when analysing malware on Windows. It works by creating two “snapshots” of the registry\u2014one before the malware is run and another afterwards. The results are then compared to identify any changes.” Take the 1st shot, run the malware as instructed, then run the 2nd shot.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

You know when it’s done when the “2nd shot” tab becomes clickable. Now it’s time to run the executable!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Curse you King Malhare!!!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we are going to run our 2nd shot to compare it with the first.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Once it finishes, it will open up a txt file for us. Ctrl + F HopHelper to see what the executable has done to our system. Eventually, you will notice a Run path. This means persistence for the executable, so even if you reboot, it will start back up afterwards! This is also the flag for the question “What registry value has the HopHelper.exe modified for persistence?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now on to Procmon! “Next, we will explore using ProcMon (Process Monitor) from the Sysinternals suite to investigate today’s sample. Process Monitor is used to monitor and investigate how processes are interacting with the Windows operating system. It is a powerful tool that allows us to see exactly what a process is doing. For example, reading and writing registry keys, searching for files, or creating network connections.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After you open this, re-run the executable file again, then stop the monitoring of procmon.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

We are still getting a lot of results, so let’s add another filter.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

We now see the filtered results, and it’s not good news. Sinister activity is afoot!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

For the bonus question regarding the web panel. Copy and paste this in Chrome as http:\/\/breachblocker-sandbox\/.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

So that’s that! THM links to other rooms I’ll definitely check out later: https:\/\/tryhackme.com\/room\/staticanalysis1 and https:\/\/tryhackme.com\/room\/basicdynamicanalysis.<\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/malware-sandbox-aoc2025-SD1zn4fZQtCreated by: tryhackme, cmnatic, SecurityNomad “The town of Wareville remains quiet in the middle of the night. While the residents of Wareville are nicely tucked up in bed, blissfully unaware, the SOC team at The Best Festival Company (TBFC) remain alert, poised and ready for whatever may face them.Monitoring their screens, armed with a freshly poured mug of hot […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-796","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=796"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/796\/revisions"}],"predecessor-version":[{"id":817,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/796\/revisions\/817"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}