how to identify compromised computer wireshark pcap

If you take a look at http traffic you can see the way order the pages loads. LEVEL 2 QUESTIONS: 1) What is the redirect URL that points to the exploit kit (EK) landing page? To find the IP addresses, we look at the IPv4 layer:ĥ) What is the domain name of the compromised web site?Ĭonsidering we identified the malicious site from web traffic (not the IP first) we have the domain. Within the HTTP Stream we find an iframe to 24corp-shop which we know is very suspicious, in that it redirects to the exploit. So with the information from above, let us take another look.

So in this case the domain cinihollandnl is very much our suspect. If we think of how exploit kits ‘generally’ work, they will have an initial website (sometimes a compromised good website) then redirect the victim to another site for an exploit to be launched. The MAC address of the destination host (172.16.165.165) can be found here:Ĥ) What is the IP address of the compromised web site?

I did look for NETBIOS traffic but it was nonexistent. Since we have the IP address of the victim we can look for traffic where a host name may be transferred.

So we can guess that 172.16.165.165 is the Windows VM that gets infected.Ģ) What is the host name of the Windows VM that gets infected? If youi look closely it sttempts to view the windows system drivers. Within the HTTP stream of this domain (trustandprobateealty) we see a lot of JavaScript that is obviously being obfuscated to make it unreadable. Looking at that traffic we see an iframe for standtrustandprobaterealtycom. But seems to look fine to me.īut if you look through the domains, it seems that is involved. Since the pages are wordpress, the page could be a malicious site.

How to identify compromised computer wireshark pcap