Scenario

Advent of The Relics 1 - A Call from the Museum

Read the campaign introduction and supporting information at https://github.com/hackthebox/advent-of-the-relics

In this Sherlock your task is to analyze the suspicious email and its headers to trace its origin, then dissect the malicious attachment to understand its purpose. Your goal is to uncover indicators that lead to identifying part of the attacker's command-and-control infrastructure.

The scenario portrayed in this challenge is entirely fictional and created solely for educational and entertainment purposes. Any resemblance to actual persons, living or dead, organizations, or real events is purely coincidental and unintentional. All characters, scenarios, and data presented are products of imagination.

Executive Summary

A phishing email from a lookalike domain, relayed through legitimate Microsoft outbound infrastructure, carried a zip attachment whose password was given in the mail body. Inside sat a decoy PDF and a shortcut file that launched PowerShell. The script posted three host details to an attacker-controlled check-in endpoint, the last read from the registry, then downloaded and ran a second stage from another domain. The second-stage request authenticated with Basic credentials that the script assembled from fragments, so they only appear once the pieces are joined and decoded.

Artifacts

• Email: the .eml file in evidence/ → parse with Python’s email module or read the raw headers
• Attachment: zip extracted from the MIME body → unzip with the password from the mail body
• PDF: decoy document inside the zip → pdftotext
• LNK: shortcut inside the zip → strings (the PowerShell command line is stored in the shortcut’s arguments)

Initial Access

Read the From and Return-Path headers of the .eml. The sending domain is a one-character swap of the museum’s real domain, with a 1 standing in for the l. The display name looks plausible; the address does not.

python3 -I -c "import email,sys; m=email.message_from_file(open(sys.argv[1])); print(m['From'], m['Return-Path'])" evidence/*.eml

Hint: Compare the sender domain character by character with the organisation named in the body. The lookalike is the whole trick.

Received headers are stacked newest first, so the bottom entry is where the message entered the mail flow. It is a Microsoft Outlook outbound host, which is why the mail passed through legitimate infrastructure even though the sender domain is fake.

python3 -I -c "import email,sys; m=email.message_from_file(open(sys.argv[1])); print('\n'.join(m.get_all('Received')))" evidence/*.eml

Gotcha: Read the chain bottom-up. The top Received line is the victim’s own mail server, not the origin.

List the MIME parts and read the filename parameter on the attachment. It is a zip named like a routine health-clearance bundle.

python3 -I -c "import email,sys; m=email.message_from_file(open(sys.argv[1])); [print(p.get_filename()) for p in m.walk() if p.get_filename()]" evidence/*.eml

Decode the attachment from the MIME body and save it. The archive is encrypted, and the mail body hands the password to the recipient, a common trick that also keeps the zip out of gateway scanning. Extract it with that password, then run pdftotext on the PDF inside. The document code is printed in the text of Health_Clearance_Guidelines.pdf.

unzip -P Up7Pk99G -d work/x work/x/Health_Clearance-December_Archive.zip

pdftotext work/x/Health_Clearance_Guidelines.pdf - | head -40

Command and Control

The other file in the archive is a shortcut. Its target is PowerShell and the command line lives in the LNK arguments, so strings shows it directly. The script builds a POST to a health-status lookalike domain, and the path ends in a checkin endpoint.

strings -el work/x/*.lnk

Discovery

From Q5 we have the POST body. Its three fields are collected in order, and the last one comes from a Get-ItemProperty call on a Cryptography key, reading MachineGuid, the stable per-host identifier the operator uses to tell victims apart. The answer is the full key path including the value name.

strings -el work/x/*.lnk | grep -i -o 'gp HKLM[^;]*'

Command and Control

Further down the same PowerShell command, after the check-in, a second request fetches the next stage and runs it. The host is a different domain from the check-in server and imitates a forum on the campaign’s .htb.blue namespace.

strings -el work/x/*.lnk | grep -i -o 'http[^ "]*'

Credential Access

The second-stage request sends a Basic authorization header, but the value is not stored whole. The script concatenates several string fragments, so no single fragment decodes to anything useful. Join them in script order and base64-decode the result to get user:password.

echo '<joined base64 fragments>' | base64 -d

Tip: Fragments only make sense in the order the script concatenates them, not the order strings prints them.

Attack Summary

Phase	Action
Initial Access	Phishing email from a lookalike domain, relayed via Microsoft outbound mail servers
Initial Access	Password-protected zip delivered, password supplied in the mail body
Execution	Victim opens the shortcut, which launches PowerShell
Discovery	Script reads MachineGuid from the registry among the data it collects
Command and Control	Host details posted to the checkin endpoint
Command and Control	Second stage downloaded from another domain and executed
Credential Access	Second-stage request authenticated with Basic credentials built from fragments

IOCs

Type	Value
Sender	eu-health@ca1e-corp[.]org
Origin mail host	BG3O293MB0335.SRBL293.PROD.OUTLOOK.COM
Attachment	Health_Clearance-December_Archive.zip
Zip password	Up7Pk99G
Document code	EU-HMU-24X
C2 URL	hxxps[://]health-status-rs[.]com/api/v1/checkin
Second-stage domain	advent-of-the-relics-forum[.]htb[.]blue
Credentials	svc_temp:SnowBlackOut_2026!
Registry key read	HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Attachment	T1566.001	Zip attached to a lookalike-domain email
User Execution: Malicious File	T1204.002	Victim opens the shortcut
Command and Scripting Interpreter: PowerShell	T1059.001	LNK runs a PowerShell command line
System Information Discovery	T1082	MachineGuid and host details collected
Application Layer Protocol: Web Protocols	T1071.001	HTTPS POST check-in
Ingress Tool Transfer	T1105	Second stage downloaded and run
Unsecured Credentials: Credentials In Files	T1552.001	Basic credentials embedded in the script

Defender Takeaways

Lookalike domains pass on trusted infrastructure. The mail came through Microsoft’s own outbound servers, so reputation checks on the relay saw nothing wrong. Alert on sender domains that sit within one or two characters of your own or a partner’s, and judge the From domain rather than the relay.

Encrypted archives with the password in the body should be quarantined or flagged. The password hid the PDF and shortcut from attachment scanning. Treat password-protected zips from external senders as high risk and detonate them separately.

Shortcut files that launch PowerShell are a detection primitive. A .lnk arriving from an archive whose target is powershell.exe with a long argument string is easy to block or alert on. Restrict LNK execution from mail-delivered locations and log PowerShell script content.

Hardcoded credentials in a payload are intelligence. The fragment-joined Basic header looks obfuscated, but joining and decoding it recovers the credentials, which tie the second-stage host to this campaign and give a pivot for hunting.

Conclusion

The attack never needed an exploit: a convincing lookalike address, a zip password handed over in the mail, and one shortcut were enough to get PowerShell beaconing and fetching a second stage. Everything useful to a defender sat in the email headers and the shortcut’s command line.