Windows BAT File Forensics | Step-by-Step CTF Walkthrough 🕵️‍♂️

In this video walk-through, we covered a scenario where we downloaded an attachment that turned out to be a Windows bat file. Inside the Windows bat file, we were able to echo out the Powershell commands it executes to the terminal. The Powershell command contained encryption keys and Initialization vector IV for an encryption algorithm AES in CBC mode. It was there to encrypt the actual windows.bat.exe that was getting executed everytime the bat file was opened. By using Cyberchef along with the decryption key, we were able to decrypt and save the original executable file that contained the flag.
***********
Receive Cyber Security Field Notes and Special Training Videos
https://www.youtube.com/channel/UCNSdU_1ehXtGclimTVckHmQ/join
**********
Writeup
https://motasem-notes.net/hackthebox-cyber-apocalypse-ctf-2023-writeups/
HackTheBox Relic Maps
https://app.hackthebox.com/challenges/473
********
Patreon
https://www.patreon.com/motasemhamdan?fan_landing=true
Instagram
https://www.instagram.com/dev.stuxnet/
Twitter
https://twitter.com/ManMotasem
Facebook
https://www.facebook.com/motasemhamdantty/
LinkedIn
[1]: https://www.linkedin.com/in/motasem-hamdan-7673289b/
[2]: https://www.linkedin.com/in/motasem-eldad-ha-bb42481b2/
Website
https://www.motasem-notes.net
Backup channel
https://www.youtube.com/channel/UCF2AfcPUjr7r8cYuMvyRTTQ
My Movie channel:
https://www.youtube.com/channel/UCilElKPoXEaAfMf0bgH2pzA
******