Analyse mémoire 5/5 - Le commencement

Description

The Device you identified confirms that the attacker injected themselves early in the boot sequence. However, both UEFI boot and SecureBoot were properly enabled on the system. To verify this, we collected metadata from the Windows EFI boot partition (FAT32) using the DFIR-Orc tool. See the attached file analyse-memoire-efi-fatinfo.csv. Identify the vulnerability that was exploited by the attacker and the file containing the initial malicious payload used in the attack.

The flag is in the format FCSC{<CVE_number>:<file_name>} where:

• <CVE_number> is the identifier of the exploited vulnerability, and
• <file_name> is the name of the file containing the initial malicious payload.

For example: FCSC{CVE-2022-4225:payload.bin}.

This challenge is part of a serie that should be solved sequentially:

• Analyse mémoire 1/5 - Exfiltration
• Analyse mémoire 2/5 - Origine de la menace
• Analyse mémoire 3/5 - Où est le pansement ?
• Analyse mémoire 4/5 - Un échelon de plus dans la chaîne
• Analyse mémoire 5/5 - Le commencement