One File, Many Boxes
Company: Altyn Stroy LLP
Briefing
Altyn Stroy LLP is a construction company. An employee reported a suspicious message to the help desk. The question you need to answer is not 'is it suspicious' but 'how many mailboxes received it'.
That distinction matters: reach determines what happens next. One message means a conversation with one person. Ten mailboxes means a company-wide notice, a check of every workstation and work on the mail gateway.
You have a day's export of messages across all mailboxes in the domain altyn-stroy.example. The messages carry envelopes, check results and attachments with hashes.
Subjects and display names are in Russian, as in the real environment.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
Messages · 24
Pick a message to read its headers
Questions
0/7 · 0/110 points
Log in to save your progress and appear on the leaderboard.
What is the hash of the attachment that reached several mailboxes?
Format: 64 hexadecimal characters · 20 points
How many mailboxes received that attachment?
Format: Whole number · 20 points
Which domain did the campaign come from?
Format: Domain name · 15 points
What is the attachment called?
Format: File name with extension · 15 points
When did the first message of the campaign arrive? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
Which address were those messages received from?
Format: IPv4 address · 15 points
Which MITRE ATT&CK technique covers a message with a malicious attachment?
Format: Identifier like T1234.001 · 10 points