Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis; email header forensics, obfuscated payload decoding, and adversary attribution
USBferry, Tropic Trooper, and ATT\&CK: A Practical CTI Exercise
Identifying Tactics, Techniques and Procedures of an APT
The scenario
A multinational technology company had been the target of several cyber attacks over the past few months. The attackers successfully exfiltrated sensitive intellectual property and disrupted the company’s operations.
Mission
As a CTI (Cyber Threat Intelligence) analyst, my task was to identify the Tactics, Techniques, and Procedures (TTPs) used by the threat group and gather as much information as possible about their identity and motive.
Tools provided
- Threat advisory report describing the APT (referred to as APT X in the exercise) and its malware
- OpenCTI
- ATT\&CK Navigator (with relevant techniques highlighted)
Questions & findings
What kind of phishing campaign does APT X use as part of their TTPs?
I found this in the threat advisory report.
- Answer: Spear-phishing emails
What is the name of the malware used by APT X?
Also documented in the threat advisory report.
- Answer: USBferry
What is the malware’s STIX ID?
I navigated to OpenCTI → Arsenal, searched for USBferry, selected the resulting card, and viewed the details.
- Answer:
malware--5d0ea014-1ce9-5d5c-bcc7-f625a07907d0
With the use of a USB, what technique did APT X use for initial access?
I checked the ATT\&CK Navigator’s Initial Access section and located the relevant technique.
- Answer: Replication through removable media
What is the identity of APT X?
I found additional names for APT X in the included link given in the provided on the threat advisory report. One of them seemed to fit what I was looking for.
- Answer: Tropic Trooper
On OpenCTI, how many Attack Pattern techniques are associated with the APT?
I searched OpenCTI → Threats for Tropic Trooper and viewed the APT card.
- Answer: 39 attack pattern techniques
What is the name of the tool linked to the APT?
From the Tropic Trooper details on OpenCTI, I selected Tools(on the right sidebar):
- Answer: BITSAdmin
Load up the Navigator. What is the sub-technique used by the APT under Valid Accounts?
I searched the Navigator for Valid Accounts, expanded sub-techniques and located the specific sub-technique.
- Answer: Local Accounts
Under what Tactics does the technique above fall?
From the Navigator, I viewed the tactics tied to Local Accounts by right clicking the sub-technique found in the previous question.
There seemed to be a lot of information on the resulting page, so again I searched on page, this time looking for “local accounts” and making sure the sub-technique name was included on the “Valid Accounts” technique.
After selecting it, it lead me to the information I was looking for:
- Answer: Initial Access, Persistence, Defense Evasion, and Privilege Escalation
What technique is the group known for using under the tactic Collection?
Using the ATT\&CK Navigator, I inspected highlighted techniques under the Collection tactic to determine which ones the group uses.
- Answer: Automated Collection
Conclusion
This exercise provided a valuable opportunity to simulate a real-world cyber threat investigation using tools like OpenCTI and ATT\&CK Navigator.
By analyzing the APT known as Tropic Trooper (APT X), I identified their primary TTPs, including spear-phishing and USB-based malware propagation through USBferry.
The process reinforced the importance of correlating intelligence across multiple sources to accurately attribute activity and understand threat behavior.
