Defensive Security Tooling: REMnux: Getting Started

In this article, I will write a write-up for REMnux: Getting Started that covers Machine Access, File Analysis, Fake Network to Aid Analysis, and Memory Investigation: Evidence Preprocessing.

What Python tool analyzes OLE2 files, commonly called Structured Storage or Compound File Binary Format? oledump.py
What tool parameter we used in this task allows you to select a particular data stream of the file we are using it with? -s
During our analysis, we were able to decode a PowerShell script. What command is commonly used for downloading files from the internet? Invoke-WebRequest
What file was being downloaded using the PowerShell script? Doc-3737122pdf.exe
During our analysis of the PowerShell script, we noted that a file would be downloaded. Where will the file being downloaded be stored? $TempFile
Using the tool, scan another file named possible_malicious.docx located in the /home/ubuntu/Desktop/tasks/agenttesla/ directory. How many data streams were presented for this file? 16
Using the tool, scan another file named possible_malicious.docx located in the /home/ubuntu/Desktop/tasks/agenttesla/ directory. At what data stream number does the tool indicate a macro present? 8
Download and scan the file named flag.txt from the terminal using the command sudo wget https://MACHINE_IP/flag.txt --no-check-certificate. What is the flag? Tryhackme{remnux_edition}
After stopping the inetsim, read the generated report. Based on the report, what URL Method was used to get the file flag.txt? GET
What plugin lists processes in a tree based on their parent process ID? PsTree
What plugin is used to list all currently active processes in the machine? PsList
What Linux utility tool can extract the ASCII, 16-bit little-endian, and 16-bit big-endian strings? strings
By running vol3 with the Malfind parameter, what is the first (1st) process identified suspected of having an injected code? csrss.exe
Continuing from the previous question (Question 6), what is the second (2nd) process identified suspected of having an injected code? winlogon.exe
By running vol3 with the DllList parameter, what is the file path or directory of the binary @WanaDecryptor@.exe? C:\\Intel\\ivecuqmanpnirkt615