The Advent of Cyber: Day 6: Sandboxes - If I can't find a nice malware to use, I'm not going (TryHackMe)

In this article, we’ll cover the Sandboxes - If I can't find a nice malware to use, I'm not going, write-up as the Day 6 challenge of the Advent of Cyber event challenge. It was interesting to use YARA on Windows sandbox to detect malware using commands and to implement an evasion technique to bypass YARA rule detection. We’re still at Wareville for SOC-mas!

1. What is the flag displayed in the popup window after the EDR detects the malware? THM{GlitchWasHere}

   

   

   

2. What is the flag found in the malstrings.txt document after running floss.exe, and opening the file in a text editor? THM{HiddenClue}

   

   

3. If you want to more about sandboxes, have a look at the room FlareVM: Arsenal of Tools.

Thank you for reading this article. Please leave a comment with your thoughts, areas for improvement, other suggestions, and questions. Stay secure until the next one!