Module: INTRODUCTION TO MALWARE ANALYSIS - (addtional_samples.zip Download)

HTB Content Academy
,
1

Download additional_samples.zip from this module’s resources (available at the upper right corner) and transfer the .zip file to this section’s target. Unzip additional_samples.zip (password: infected) and use IDA to analyze orange.exe. Enter the registry key that it modifies for persistence as your answer. Answer format: SOFTWARE____

&&&

Download additional_samples.zip from this module’s resources (available at the upper right corner) and transfer the .zip file to this section’s target. Unzip additional_samples.zip (password: infected) and use IDA to analyze orange.exe. Enter the name of the function that is holding the name of the file intrenat.exe that orange.exe drops as your answer. Answer format: sub_4XXXX3

These two questions within the code analysis section require you to download a zip file from the HTB academy webpage in order to decompile and analyse the requested .exe’s within IDA. As an individual who uses Mac and the Parrot/RDP instance provided I am not sure how to get the .zip file across to the Windows instance. I tried:

  1. Signing into my academy.htb account via windows; No internet connection
  2. Signing into my academy.htb linux and scp’ing; Port 22 is closed.
  3. Downloading on my Mac and installing my own Windows VM; my Mac refused the download due to “dangerous file”.

How am I supposed to complete this section? :confused: I spent 100 squares on this mf.

2
  1. On your host machine: download the zip file into a temp folder.
    1a - Inside terminal type: wget URL-of-zip-file
  2. Open terminal and go to temp folder - get IP address
  3. Type the following command in terminal: python -m http.server
  4. Go to VM - open browser and navigate to http://HOST-IP:8000/
  5. Download into VM and good hunting
2 Likes
3

You can also use wget in the pwnbox with the resource url, unzip it and share that folder with the remote connection to the working machine.

  1. on pwnbox use wget https://academy.hackthebox.com/storage/resources/additional_samples.zip
  2. unzip it with unzip [file route]
  3. use share file with the remote conn (with remmina is easy)
  4. continue with the lab

im also a little stuck identifying the registry key edited.

4

Hi all, thank you for your suggestions. They helped and I’ve passed this one now.

I guess in retrospect it’s an obvious answer but I appreciate it none the less.

6

This module is crazy hard o.O. @x46uck did you look for every function?

7

Didn’t manage/understand how to get the step3 correctly, can you give a bit more info on how to get this workin in the pwnbox?

8

Making a http.server and accessing it on the VM works fine, just like @sampaio.veiga described.

9

Hello, the http server from my kali vm is not working on the target machine. http://host-ip:8000/ only works on my kali vm. Any tips?

10

nvm figured it out. it was my firewall. thank you!

11

For the first question, I dug through all the functions and spent 5 hours. The answer is no where to be found but there is a clue: Hkey. Utilize all resources! GLHF.

12

I use chat gpt and i founded answer

image
image799×784 34.5 KB

13

image
image452×599 11 KB

name of the function that is holding the name of the file intrenat.exe are in picture