Windows bat File Forensics | CTF Walkthrough

In this video walk-through, we covered a scenario where we downloaded an attachment that turned out to be a Windows bat file. Inside the Windows bat file, we were able to echo out the Powershell commands it executes to the terminal. The Powershell command contained encryption keys and Initialization vector IV for an encryption algorithm AES in CBC mode. It was there to encrypt the actual windows.bat.exe that was getting executed everytime the bat file was opened. By using Cyberchef along with the decryption key, we were able to decrypt and save the original executable file that contained the flag. *********** Receive Cyber Security Field Notes and Special Training Videos https://www.youtube.com/channel/UCNSdU_1ehXtGclimTVckHmQ/join ********** Writeup https://motasem-notes.net/hackthebox-cyber-apocalypse-ctf-2023-writeups/ HackTheBox Relic Maps https://app.hackthebox.com/challenges/473 ******** Patreon https://www.patreon.com/motasemhamdan?fan_landing=true Instagram https://www.instagram.com/dev.stuxnet/ Twitter https://twitter.com/ManMotasem Facebook https://www.facebook.com/motasemhamdantty/ LinkedIn [1]: https://www.linkedin.com/in/motasem-hamdan-7673289b/ [2]: https://www.linkedin.com/in/motasem-eldad-ha-bb42481b2/ Website https://www.motasem-notes.net Backup channel https://www.youtube.com/channel/UCF2AfcPUjr7r8cYuMvyRTTQ My Movie channel: https://www.youtube.com/channel/UCilElKPoXEaAfMf0bgH2pzA ******