https://cyberdefenders.org/blueteam-ctf-challenges/malware-traffic-analysis-2/
Q1: What is the IP address of the Windows VM that gets infected?
172.16.165.132
network miner show the os and we only have one windows
Q2: What are the IP address and port number that delivered the exploit kit and malware?
37.143.15.180:51439
in brim filter with the victim ip
Q3: What are the two FQDN's that delivered the exploit kit? comma-separated in alphabetical order.
open pcap with network miner and look with the ip from previous question you could also filter the ip with dns or http
Q4: What is the FQDN of the compromised website?
filter with the attacker ip and http