Navigating the custom VM loop in IDA Pro or Ghidra. Analysts look for the "fetch-decode-execute" cycle to understand how the custom bytecode is processed.
Mandiant usually publishes a PDF with the intended solution path for every challenge. 7xisHeadTrick.zip
For the most comprehensive technical deep-dives, you should look at the official solutions and community walkthroughs: Navigating the custom VM loop in IDA Pro or Ghidra