When working on the Spearphishing With An Attachment Guided and Challenge labs, I am having difficulties with AnyRun. In EML, I submit the attachment hash to AnyRun but get well of 49K pages of results. It does not show one or two submissions. Even when there, if you submit the hash directly into the search or the file name, you do not get any results. In the guided exercise, I was able to ignore this section and work through it with Wazuh, but in the challenge exercise it says specifically you will find an address in AnyRun to work in Wazuh later. Need the AnyRun functionality either to work or mention a workaround to get the results you say will be returned. At any rate, I’ll work in Wazuh and see if I can backtrace and find the IP address that way.
Thank you for your help.
