Broken Envelope

Description

Blue Mountain Geotechnical is a Denver-based soils and rock-mechanics consultancy. A cryptolocker affiliate passed through the firm’s file shares and partly corrupted several project archives before IT lead Bela Srivastava pulled the plug. Project engineer Adalyn Proteau needs the site dispatch read before Monday’s client meeting.

Objective

The Cryptolocker (ransomware) corrupted files, which means the file structure is broken. The objective is to recover the site dispatch before a client meeting.

Flag Format

The flag should be in the format: SVIUSCG{This_is_a_Flag}

Tools Used

CyberChef

Methodology

I double clicked the zip file to unzip and found two files (dispatch file and readme file). Inside the unzipped folder, I clicked on the first file, project_dispatch.txt to review and analyze the document. I noticed the following string:

tag: U1ZJVVNDR3tibHVlbW91bnRhaW5femlwX2VvY2RfcmVidWlsZH0=

The tag was a combination of uppercase letters and numbers, which I was familiar with from a previous challenge. I remember that CyberChef would be able to help decode the string. I opened CyberChef, copied and pasted the string inside the Input box and added the Base64 Operation.

Base64 is a notation that encodes arbitrary byte data using a restricted set of symbols which can be used by humans and processed by computers.

This operation decodes data from an ASCII Base64 string back into its raw format. For example, aGVsbG8 becomes hello.

As soon as I addeded the operation Base64, the flag appeared in the Output box:

Flag

SVIUSCG{bluemountain_zip_eocd_rebuild}

MITRE ATT&CK

Reflections | Suggestions | What was the Attacker Doing?

Based on the challenge description, “A cryptolocker affiliate passed through the firm’s file shares and partly corrupted several project archives…”, the attacker appears to have deployed ransomeware that impacted the firm’s files. The following MITRE ATT&CK technique seemed most relevant:

Source: https://attack.mitre.org