Labs / Capstone investigations
From a .js attachment to a named malware family
Decode a script attachment, decode the URL hidden inside it, find the download in the proxy log, then hash the recovered sample and match it to the intel feed. Five tools, one chain.
Briefing
A user reported an invoice email after double-clicking the attachment. EDR collected the file it dropped into cases/samples/.
Each step hands you the input for the next one: the mail gives the attachment, the attachment gives a URL, the URL gives a host and time in the proxy log, and the sample’s hash gives a name.
ir-ws · Capstone investigations
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.