# Challenge: Snapped Phish-ing Line (TryHackMe)

Link to challenge on TryHackMe: [Snapped Phish-ing Line](https://tryhackme.com/room/snappedphishingline)

As a member of the IT department at SwiftSpend Financial, you are responsible for assisting employees with technical concerns. What initially appeared to be a routine day quickly escalated when multiple employees across different departments reported receiving a suspicious email. Several users noted unusual characteristics in the message, and unfortunately, some had already submitted their credentials and were no longer able to access their accounts. With the potential for a wider compromise, the incident has been escalated for investigation. Your task is to analyze the available evidence, determine the scope of the attack, and uncover how the adversary operated.

## **Objectives**

*   Analyze the provided email samples to identify key artifacts
    
*   Investigate phishing URLs to understand redirection
    
*   Retrieve and examine the phishing kit used in the attack
    
*   Use CTI tools to gather intelligence on the adversary
    
*   Analyze the phishing kit to uncover additional indicators
    

## **Prerequisites**

It is suggested that you complete the previous four rooms of the [Phishing Analysis Module](https://tryhackme.com/module/phishing) to help prepare you for email analysis: 

*   Check out [Phishing Analysis Fundamentals](https://tryhackme.com/room/phishingemails1tryoe) for an overview of email communications and analysis
    
*   Explore [Phishing Emails in Action](https://tryhackme.com/room/phishingemails2rytmuv) to gain experience analyzing phishing emails
    
*   Go over [Phishing Analysis Tools](https://tryhackme.com/room/phishingemails3tryoe) to learn about tools that enable deeper email analysis
    
*   Cover [Phishing Prevention](https://tryhackme.com/room/phishingemails4gkxh) to learn about preventing, detecting, and mitigating email threats
    

### Answer the questions below

Begin reviewing the emails in the `phish-emails` folder on your desktop.  
Which individual received the email regarding a **Quote for Services Rendered**? `William McClean`

What email address was used by the adversary to send the phishing emails?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/d98ff06f-66be-4c08-ab90-48ca2f01af04.png align="center")

Investigate the attachment in the email addressed to Zoe Duncan.  
What is the root domain of the redirection URL found within the file? `kennaroads.buzz`

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/700679fb-50dd-42b6-88d3-4ab44cbcfb2b.png align="center")

Open the attachment in your VM web browser.  
Which company is the login page impersonating? `Microsoft`

Let’s check if the attacker left any files exposed on the same website.  
Navigate to the `/data` directory.  
What is the name of the archive file? `Update365.zip`

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/8ac02eec-d822-48c8-b8f0-7b927c827168.png align="center")

Download the phishing kit archive to your virtual environment.  
Using the `sha256sum` command, what is the `SHA256` hash of the file?

```markdown
shasum -a 256 Downloads/Update365.zip
ba3c15267393419eb08c7b2652b8b6b39b406ef300ae8a18fee4d16b19ac9686  Downloads/Update365.zip
```

Investigate the file hash from the previous question using [VirusTotal (opens in new tab)](https://www.virustotal.com/gui/home/search).  
Aside from **phishing**, what other threat category is assigned to the `ZIP` archive?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/9750e7c8-6af9-4a18-951f-a71a8710bb79.png align="center")

Review the VirusTotal Details page for the phishing kit.  
How many files are contained within the archive?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/0492c04c-f70b-46e1-9f90-3875fff6e03b.png align="center")

Let’s see if the attacker has exposed any captured credentials.  
Navigate to the `/data/Update365/` directory and investigate the log file.  
What is the email address of the user who submitted their credentials more than once?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f5d4a5e4-0d06-4be7-bb00-d75aa8cad40f.png align="center")

Extract the phishing kit archive and locate the `submit.php` file.  
What email address is used by the adversary to collect compromised credentials? `m3npat@yandex.com`

Return to the phishing URL and locate the `flag.txt` file.  
Using [CyberChef (opens in new tab)](https://gchq.github.io/CyberChef/#recipe=From_Base64\('A-Za-z0-9%2B/%3D',true,false\)Reverse\('Character'\)&ieol=CRLF) to decode the flag, what is the secret value?

`http://kennaroads.buzz/data/Update365/office365/flag.txt`

The secret is: `fUxSVV8zSHRfaFQxd195NExwe01IVAo=`

```markdown
}LRU_3Ht_hT1w_y4Lp{MHT

```

`THM{pL4y_w1Th_tH3_URL}`