About Black Basta Task

CyberExam Contents
1

Hi,

I have find answers for “#TASK1 initial access” except “Which remote access service and port number did the attacker use to access the machine?” question. I have tried various combinations. My strongest evidence is “Source: 192.168.100.101:35610 → Dest: 192.168.100.121:3389”. Can anyone help about it? Where am I struggling?

2

Hi, if you analyze the security logs, you can observe that there is no successful authentication on the rdp port for the initial access