Tags: multithread
Rating: 2.0
Just a Brief solution:
It's a 7z SFX
The child process has some checks + antis
first its parent process name should be "003.exe" and other checks that leads to Exit or long sleeps ( BP on "Sleep" & "exit" to catch)
strings constructed using custom char maps and an index to every char
then it checks windows username and ComputerName using their md5 (not just hash, md5 is used to prevent direct string compare )
username should equa tol "Tr3nd" and ComputerName should be "M1cr0"
then it checks C:\ drive name (label) , that should be "TMTM-4704"
every func starts new thread and we see many switch between them
after passing all checks it prints flag , TMCTF{Thread-Traveler}
ps:
other strings also constucted:
Thread-
Process-
Traveller
Packer
<span>Hunter
</span>maybe it is a multi-flag challenge ( TMCTF{Thread-Hunter} , TMCTF{Process-Hunter} ... ) or the others are false flags.