Sherlock Scenario
- Forela needs your help! A whole portion of our UNIX servers have been hit with what we think is ransomware. We are refusing to pay the attackers and need you to find a way to recover the files provided.
Category: Malware-Analysis
Difficulty: Easy
File:- lockpick1.zip

Pasted image 20251204143911.png

By extracting lockpick1.zip file, we get one another bescrypt.zip and after extracting it using password given in the DANGER.txt we get elf binary which is linux executable.

Task 1#

Please confirm the encryption key string utilized for the encryption of the files provided?#

Pasted image 20251204150950.png

Here is the decompiled code of main,

1
undefined8 main(void)
2
{
3
  process_directory("/forela-criticaldata/","bhUlIshutrea98liOp");
4
  return 0;
5
}

Here is the decompiled code of process_directory,

Pasted image 20251204151514.png

1
void process_directory(char *param_1,undefined8 param_2)
2

3
{
4
  int iVar1;
5
  char *pcVar2;
6
  char local_418 [1024];
7
  dirent *local_18;
8
  DIR *local_10;
9

10
  local_10 = opendir(param_1);
11
  if (local_10 == (DIR *)0x0) {
12
    printf("Error opening directory: %s\n",param_1);
13
  }
14
  else {
15
    while (local_18 = readdir(local_10), local_18 != (dirent *)0x0) {
16
      iVar1 = strcmp(local_18->d_name,".");
17
      if ((iVar1 != 0) && (iVar1 = strcmp(local_18->d_name,".."), iVar1 != 0)) {
18
        snprintf(local_418,0x400,"%s/%s",param_1,local_18->d_name);
19
        if (local_18->d_type == '\x04') {
20
          process_directory(local_418,param_2);
21
        }
22
        else if ((local_18->d_type == '\b') &&
23
                (((((pcVar2 = strstr(local_18->d_name,".txt"), pcVar2 != (char *)0x0 ||
24
                    (pcVar2 = strstr(local_18->d_name,".sql"), pcVar2 != (char *)0x0)) ||
25
                   (pcVar2 = strstr(local_18->d_name,".pdf"), pcVar2 != (char *)0x0)) ||
26
                  ((pcVar2 = strstr(local_18->d_name,".docx"), pcVar2 != (char *)0x0 ||
27
                   (pcVar2 = strstr(local_18->d_name,".xlsx"), pcVar2 != (char *)0x0)))) ||
28
                 ((pcVar2 = strstr(local_18->d_name,".csv"), pcVar2 != (char *)0x0 ||
29
                  ((pcVar2 = strstr(local_18->d_name,".json"), pcVar2 != (char *)0x0 ||
30
                   (pcVar2 = strstr(local_18->d_name,".xml"), pcVar2 != (char *)0x0)))))))) {
31
          printf("Encrypting: %s\n",local_418);
32
          encrypt_file(local_418,param_2);
33
        }
34
      }
35
    }
36
    closedir(local_10);
37
  }
38
  return;
39
}

param_2 is passed in encrypt_file function and param_2 is bhUlIshutrea98liOp which means this is the key for encryption of file,

1
encrypt_file(local_418,param_2);

1
bhUlIshutrea98liOp

Task 2#

We have recently received an email from wbevansn1@cocolog-nifty.com demanding to know the first and last name we have him registered as. They believe they made a mistake in the application process. Please confirm the first and last name of this applicant.#

encrypt_file function is doing simple XOR operation to encrypt a file using given key,

Pasted image 20251204152245.png

1
    for (local_20 = 0; uVar2 = local_20, (long)local_20 < (long)local_30; local_20 = local_20 + 1) {
2
      bVar1 = *(byte *)((long)local_38 + local_20);
3
      sVar4 = strlen(param_2);
4
      *(byte *)((long)local_38 + local_20) = bVar1 ^ param_2[uVar2 % sVar4];
5
    }

So simple take the key bhUlIshutrea98liOp and try to decrypt any file, let’s say complaints.csv.24bes and it works so i made simple decryptor.py to decrypt all the file,

Pasted image 20251204152026.png

Here is decryptor.py code,

1
import os
2

3
def decrypt_file(filename, key):
4
    try:
5
        with open(filename, "rb") as file:
6
            encrypted_data = file.read()
7

8
        print(f"Encrypted file size: {len(encrypted_data)}")
9

10
        # Decrypt using XOR with the key
11
        key_length = len(key)
12
        decrypted_data = bytearray(
13
            encrypted_data[i] ^ ord(key[i % key_length]) for i in range(len(encrypted_data))
14
        )
15

16
        # Generate original filename
17
        if filename.endswith(".24bes"):
18
            original_filename = filename[:-6]
19
        else:
20
            original_filename = filename + ".decrypted"
21

22
        print(f"Original filename generated: {original_filename}")
23

24
        try:
25
            with open(original_filename, "wb") as file:
26
                file.write(decrypted_data)
27
            print(f"Successfully wrote decrypted file: {original_filename}")
28
        except Exception as e:
29
            print(f"Error writing file {original_filename}: {e}")
30
    except Exception as e:
31
        print(f"Error decrypting file {filename}: {e}")
32

33
def decrypt_all_files(directory, key):
34
    for root, _, files in os.walk(directory):
35
        print(f"Checking directory: {root}")
36
        for file in files:
37
            print(f"Found file: {file}")
38
            if file.endswith(".24bes"):
39
                print(f"Decrypting: {file}")
40
                decrypt_file(os.path.join(root, file), key)
41

42
def main():
43
    directory = "."
44
    key = "bhUlIshutrea98liOp"
45
    print(f"Starting decryption in {directory} with key: {key}")
46
    decrypt_all_files(directory, key)
47
    print("Decryption process completed.")
48

49
if __name__ == "__main__":
50
    main()

Pasted image 20251204152939.png

Pasted image 20251204153047.png

So just simple apply this command so see is whether is there any related strings present,
- And i found the name related to this email,

1
cat * | grep -Rin 'wbevansn1@cocolog-nifty.com'

This string is present in forela_uk_applicants.sql file and in 872 line no,

1
(830,'Walden','Bevans','wbevansn1@cocolog-nifty.com','Male','Aerospace Manufacturing','2023-02-16'),

Pasted image 20251204153547.png

1
Walden Bevans

Task 3#

What is the MAC address and serial number of the laptop assigned to Hart Manifould?#

This info must be available in it_assets.xml file because it is asking about laptop,
So i tried to open that file but it seems very unappropriated so i used this tool to format it and i got this file,

1
xmllint --format it_assets.xml > formated_it_assets.xml

Pasted image 20251204154733.png

So i tried to find this name Hart Manifould and i got associated MAC Address and Serial Number,

Pasted image 20251204154947.png

1
E8-16-DF-E7-52-48, 1316262

Task 4#

What is the email address of the attacker?#

This is asking about attackers email which is written in ransom note of any file like this, complaints.csv.24bes_note.txt.

Pasted image 20251204155057.png

1
bes24@protonmail.com

Task 5#

City of London Police have suspicions of some insider trading taking part within our trading organization. Please confirm the email address of the person with the highest profit percentage in a single trade alongside the profit percentage.#

File will be most probably trading-firebase_bkup.json
For this task i used jq tool which is best for json filtration,
Here is command i used,

Pasted image 20251204160420.png

to_entries converts the object into an array of {key, value} objects
max_by(.value.profit_percentage) finds the entry with the highest profit percentage
.value.email prints email
.value.profit_percentage prints profit %

1
jq -r 'to_entries | max_by(.value.profit_percentage) | .value.email, .value.profit_percentage' trading-firebase_bkup.json

1
fmosedale17a@bizjournals.com, 142303.1996053929628411706675436

Task 6#

This data will be present on sales_forecast.xlsx file,

Pasted image 20251204160933.png

1
87,"Karylin","O'Hederscoll","kohederscoll2e@dagondesign.com","Female","8.254.104.208","Pakistan","Consulting Hours","8/7/2022",983,1957.61,503.49,494930.67,1924330.63,1429399.96,415

1
8.254.104.208

Task 7#

Which of the following file extensions is not targeted by the malware? `.txt, .sql, .ppt, .pdf, .docx, .xlsx, .csv, .json, .xml`#

Pasted image 20251204161323.png

1
else if ((local_18->d_type == '\b') &&
2
(((((pcVar2 = strstr(local_18->d_name,".txt"), pcVar2 != (char *)0x0 ||
3
(pcVar2 = strstr(local_18->d_name,".sql"), pcVar2 != (char *)0x0)) ||
4
 (pcVar2 = strstr(local_18->d_name,".pdf"), pcVar2 != (char *)0x0)) ||
5
((pcVar2 = strstr(local_18->d_name,".docx"), pcVar2 != (char *)0x0 ||
6
 (pcVar2 = strstr(local_18->d_name,".xlsx"), pcVar2 != (char *)0x0)))) ||
7
 ((pcVar2 = strstr(local_18->d_name,".csv"), pcVar2 != (char *)0x0 ||
8
((pcVar2 = strstr(local_18->d_name,".json"), pcVar2 != (char *)0x0 ||
9
 (pcVar2 = strstr(local_18->d_name,".xml"), pcVar2 != (char *)0x0)))))))) {
10
printf("Encrypting: %s\n",local_418);

1
.ppt

Task 8#

We need to confirm the integrity of the files once decrypted. Please confirm the MD5 hash of the applicants DB.#

Pasted image 20251204161443.png

1
f3894af4f1ffa42b3a379dddba384405

Task 9#

We need to confirm the integrity of the files once decrypted. Please confirm the MD5 hash of the trading backup.#

Pasted image 20251204161540.png

1
87baa3a12068c471c3320b7f41235669

Task 10#

We need to confirm the integrity of the files once decrypted. Please confirm the MD5 hash of the complaints file.#

Pasted image 20251204161606.png

1
c3f05980d9bd945446f8a21bafdbf4e7