According to MITRE ATT&CK, what previously known malware does DRATzarus share similarities with?
Bankshot
Which Windows API function does DRATzarus use to detect the presence of a debugger?
IsDebuggerPresent
Torisma is another piece of malware used by the Lazarus Group. According to MITRE, it has encrypted its C2 communications using XOR and which other method?
VEST-32
Which packing method has been used to obfuscate Torisma?
lz4 compression
Analyze the provided ISO file and identify the executable contained within it?
InternalViewer.exe
The executable found in the previous question was renamed. Can you identify its original name?
SumatraPDF.exe
According to VirusTotal, when was the EXE from the previous question First Seen In The Wild?(UTC)
2020-08-13 08:44:50
What packer was used to pack the executable from Question 6? (Full name)
Ultimate Packer for Executables
What is the full URL found within the macro in the document Salary_Lockheed_Martin_job_opportunities_confidential.doc?
Who is the author of the document Salary_Lockheed_Martin_job_opportunities_confidential.doc?
Mickey
Who last modified the above document?
Challenger
Analyze the “17.dotm” document. What is the directory where a suspicious folder was created? (Format: Give the path starting immediately after <USER>. Please pay attention to placeholder.)
\AppData\Local\Microsoft\Notice
Which suspicious file was checked for existence in that directory?