Advent Of Cyber 4 | Day 6 | It’s beginning to look a lot like phishing

Room

Advent Of Cyber 4

Question 1: What is the email address of the sender?

chief.elf@santaclaus.thm

Question 2: What is the return address?

murphy.evident@bandityeti.thm

Question 3: On whose behalf was the email sent?

Chief Elf

Question 4: What is the X-spam score?

3

Question 5: What is hidden in the value of the Message-ID field?

AoC2022_Email_Analysis

Question 6: What is the reputation result of the sender’s email address?

RISKY

Question 7: What is the filename of the attachment?

Division_of_labour-Load_share_plan.doc

Question 8: What is the hash value of the attachment?

Visit mansoorbarri.com/aoc4/ for the hash

Question 9: What is the second tactic marked in the Mitre ATT&CK section?

Defense Evasion

Question 10: What is the subcategory of the file?

macro_hunter