Questions

• What is the file type inside the phishing email attachment? Answer: onenote
• ApplicationReject_70161(Jan31).one designed to trick victim user click on which file type? Answer: hta
• What is the embedded URL?
• What is the full path of the created registry key after the victim clicks on the attachment inside ApplicationReject_70161(Jan31).one? Answer:

HKCU\SOFTWARE\Firm\Soft\Name

• Identify the full file path metadata inside ApplicationReject_70161(Jan31).one attachment

ANSWER: z:\BUILD\ONE\attachment.hta

• What is the content of h1 tag inside ApplicationReject_70161(Jan31).one attachment? Answer:

5cd5058bca53951ffa7801bcdf421651

QakBot Malware|

During an incident, you find a Phishing Email with an email attachment that targets your organization. Your goal is analyzing this malicious attack and identifying Indicators of Compromise (IOCs).

File Link: Download Password: infected

Or you can directly connect to the machine.

File location: C:\Users\LetsDefend\Downloads\ Password: infected

Start Investigation