Discuss Isaca CCOA Exam Topic 1 Question 6

SIMULATION

Following a ransomware incident, the network team provided a PCAP file, titled ransom.pcap, located in the Investigations folder on the Desktop.

What is the full User-Agent value associated with the ransomware demand file download. Enter your response in the field below.

ASee the solution in Explanation

Suggested Answer: A

To identify the full User-Agent value associated with the ransomware demand file download from the ransom.pcap file, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to the Investigations folder located on the desktop.

Locate the file:

ransom.pcap

Step 2: Open the PCAP File in Wireshark

Launch Wireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > ransom.pcap

Click Open to load the file.

Step 3: Filter HTTP Traffic

Since ransomware demands are often served as text files (e.g., README.txt) via HTTP/S, use the following filter:

http.request or http.response

This filter will show both HTTP GET and POST requests.

Step 4: Locate the Ransomware Demand File Download

Look for HTTP GET requests that include common ransomware filenames such as:

README.txt

DECRYPT_INSTRUCTIONS.html

HELP_DECRYPT.txt

Right-click on the suspicious HTTP packet and select:

arduino

Follow > HTTP Stream

Analyze the HTTP headers to find the User-Agent.

Example HTTP Request:

GET /uploads/README.txt HTTP/1.1

Host: 10.10.44.200

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Step 5: Verify the User-Agent

Check multiple streams to ensure consistency.

Confirm that the User-Agent belongs to the same host (10.10.44.200) involved in the ransomware incident.

Answe r:

swift

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Step 6: Document and Report

Record the User-Agent for analysis:

PCAP Filename: ransom.pcap

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Related File: README.txt

Step 7: Next Steps

Forensic Analysis:

Look for more HTTP requests from the same User-Agent.

Monitor Network Activity:

Identify other systems with the same User-Agent pattern.

Block Malicious Traffic:

Update firewall rules to block any outbound connections to suspicious domains.

Get Premium CCOA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

An 10 months ago

Wait, is it really that easy to find?

Cammy 10 months ago

I think it’s a common browser string.

Eliseo 10 months ago

The User-Agent is usually in the HTTP headers.

Geoffrey 10 months ago

Totally agree, should be straightforward!

Myrtie 10 months ago

I’m not so sure it’s just in the headers…

Stephane 11 months ago

I feel like I’ve seen the User-Agent string before, but I’m a bit confused about whether it’s in the GET request or somewhere else in the packet details.

Cherilyn 11 months ago

This reminds me of a similar question we did in class about identifying malware signatures. I hope I can remember how to filter the traffic correctly.

Deja 11 months ago

I think the User-Agent is usually found in the HTTP headers, but I can't recall the exact steps to find it in Wireshark.

Audria 11 months ago

I remember we practiced analyzing PCAP files, but I’m not sure how to extract the User-Agent specifically.

Devorah 12 months ago

This is straightforward. I'll just extract the User-Agent from the relevant HTTP request in the PCAP file. Piece of cake!

Rupert 12 months ago

No problem, I've got this. I'll use a tool like Wireshark to dig into the PCAP and follow the HTTP conversations. The User-Agent should be in the request headers.

Nada 12 months ago

Wait, how do I find the ransomware demand file in the PCAP? I'm a bit confused on where to start with this one.

Tracie 1 year ago

Okay, let's see. I'm going to open the PCAP file and filter for the HTTP requests. That should give me the User-Agent information I need.

Cecilia 1 year ago

Hmm, this looks like a classic network forensics question. I'll need to analyze the PCAP file to find the User-Agent value associated with the ransomware demand file download.

Dorinda 1 year ago

That makes sense, the User-Agent value can give us clues about the type of device and browser used to download the ransomware.

Lino 1 year ago

I believe the User-Agent value in the ransom.pcap file is 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36'.

Dorinda 1 year ago

I agree, the User-Agent value can help us track down the source of the ransomware.

Lino 1 year ago

I think the User-Agent value is important for identifying the ransomware demand file download.

Tyra 1 year ago

Ha! Ransomware, huh? I bet the bad guys used the most generic User-Agent ever. Let's see what they've got.

Lorrie 1 year ago

Hmm, PCAP files always make me a little nervous. Hope I can find the answer in there somewhere.

Eleonora 1 year ago

↳ replying to Lorrie

Let's take it step by step and analyze the ransom.pcap file carefully.

Marguerita 1 year ago

↳ replying to Lorrie

I think we just need to focus on finding the User-Agent value associated with the ransomware demand file download.

Ezekiel 1 year ago

↳ replying to Lorrie

I know what you mean, PCAP files can be intimidating.

Arleen 1 year ago

The User-Agent value is definitely the key to solving this one. Can't wait to see what it is!

Irma 1 year ago

↳ replying to Arleen

I found the User-Agent value in the ransom.pcap file, it's 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'

Cecily 1 year ago

↳ replying to Arleen

I agree, let's check the ransom.pcap file to find out the full User-Agent value.

Matthew 1 year ago

↳ replying to Arleen

I think the User-Agent value might be something unique to the ransomware.

Isaca CCOA Exam - Topic 1 Question 6 Discussion