The zip contains the executable which, when run, decrypts and executes further stages in memory.
Mandiant usually publishes a PDF with the intended solution path for every challenge. 7xisHeadTrick.zip
Navigating the custom VM loop in IDA Pro or Ghidra. Analysts look for the "fetch-decode-execute" cycle to understand how the custom bytecode is processed. The zip contains the executable which, when run,