CAMouflage

Scenario

In this Sherlock, players will investigate a cracked application infection chain by parsing MFT and USN Journal artifacts with MFTCmd, reconstructing execution timelines via Prefetch analysis with PECmd, deobfuscating a dropped batch script to uncover payload staging through extrac32 and AV evasion logic, and tracing an AutoIt-based StealC v2 loader’s C2 communication using Wireshark or Process Monitor.

Executive Summary

A user ran a fake “cracked” installer for a CAD package, and within seconds it dropped a burst of oddly named files into Temp. One was a heavily obfuscated batch script and another was a Microsoft Cabinet archive hidden behind a custom extension. The batch script unpacked the cabinet with the built-in extrac32, probed the process list for security products, copied the legitimate AutoIt interpreter under a new name and ran it against a script reassembled from the other dropped fragments. That script decrypted and decompressed a PE in memory, an infostealer that calls home over HTTP. Prefetch, the USN Journal, the BAM registry key and static analysis of the dropped files were enough to rebuild the chain without any event logs.

Artifacts

• KAPE collection: the evidence zip, unpacked to a Windows directory tree (C/Windows/prefetch, $MFT, $J, registry hives, user profile, Temp). Parse with the Zimmerman tools
• Prefetch: C/Windows/prefetch → PECmd. Run counts and the last eight run times per executable
• $MFT and $J: → MFTECmd. File creation and USN reason flags with sub-second timestamps
• SYSTEM hive: → RECmd or regipy. Holds the BAM key with a per-user, per-executable last-execution time
• Dropped files in Temp: the .wp5 files, analysed statically only (sha256sum, file, Python for deobfuscation, autoit-ripper for the AutoIt script)

Timestamp note: Answers use YYYY-MM-DD hh:mm:ss. Prefetch keeps up to eight previous run times, so the first execution is the oldest entry, not the LastRun column.

Execution

Parse the Prefetch folder and find the installer’s .pf entry (DOWNLOAD MASTERCAM X9 FULL CRACK PC.EXE). LastRun is the most recent execution and the earliest of the PreviousRun columns is the first one. The installer ran more than once, so the column you pick decides the answer.

PECmd -d C/Windows/prefetch --csv work/pf

Gotcha: LastRun is the wrong column here. Read PreviousRun0 onward and take the oldest timestamp.

Prefetch, $J, the MFT and the Windows Timeline database all give start, create and modify times, and no event logs were collected, so none of them hold an exit time. The answer is in the SYSTEM hive: the Background Activity Moderator key at ControlSet001\Services\bam\State\UserSettings\<user SID> stores one value per executable, named by full path, with a FILETIME for the last time that program ran or stopped. Under the Administrator’s SID, the entry for the installer in Downloads carries the termination time. This sits well after the first run from Q1 and after the whole drop burst from Q3.

python3 -I -c "from regipy.registry import RegistryHive; [print(v.name, v.value) for k in RegistryHive('SYSTEM').get_key('ControlSet001\\Services\\bam\\State\\UserSettings').iter_subkeys() for v in k.iter_values()]"

Gotcha: Every USN, Prefetch and Timeline timestamp around the installer looks like a plausible end time and none of them is. Those are file and launch events, not process exit.

From Q1 the installer started at 18:34:19. Parse $J with MFTECmd and look at FileCreate records from about six seconds later. A burst of .wp5 files appears in Temp, and the earliest create in that burst, at 18:34:25, is the first file dropped.

MFTECmd -f '$J' --csv work/mft

Hash everything in the dropped set and run file on each. Play.wp5 identifies as a Microsoft Cabinet archive despite the extension, so it is the .cab the question refers to.

sha256sum Temp/*.wp5

file Temp/Play.wp5

The first dropped file, Mysql.wp5 from Q3, is the batch script. Its variables are chopped and substituted so no command reads cleanly, so resolve the set substitutions with a short Python script and read the result. The extraction line uses the Windows extrac32 LOLBin against the cabinet from Q4.

python3 -I work/deob.py Temp/Mysql.wp5

Tip: The format mask ******** /* ****.*** *.* is the shape of the command: an 8-letter binary, a switch, a file name with a 3-letter extension, then a wildcard.

Defense Evasion

In the deobfuscated batch script from Q5, the AV checks are tasklist output piped into findstr against product names, split over two lines. A raw count of every string on those lines gives 8, and 7 is also wrong. The accepted value is 6. This one was reasoned rather than read straight from the script: the script does not make clear which strings on the findstr lines are excluded from the count, so 6 was reached by elimination from the over-counts.

python3 -I work/deob.py Temp/Mysql.wp5

Gotcha: A raw count of every string on the findstr lines overshoots. Expect the accepted number to be lower than the naive count.

The script copies a legitimate interpreter into a new folder under a different name, then launches it. The Prefetch parse backs this up with a MOSCOW.COM entry, an executable with a .com extension that has no business on a user machine.

PECmd -d C/Windows/prefetch --csv work/pf

The batch script’s copy command shows the source of Moscow.com: the AutoIt interpreter, copied into a new folder under the new name. Renaming a signed, legitimate interpreter is a masquerading trick to dodge name-based detections.

python3 -I work/deob.py Temp/Mysql.wp5

The batch script rebuilds the AutoIt script by concatenating several dropped fragments into one file, then hands it to Moscow.com. Reproduce the same concatenation in the same order and hash the result. The fragments are Runner, Art, Gba, Romania, Refugees, Authorization and Lock, each with the .wp5 extension.

cat Runner.wp5 Art.wp5 Gba.wp5 Romania.wp5 Refugees.wp5 Authorization.wp5 Lock.wp5 | sha256sum

Gotcha: Hashing any single fragment gives the wrong answer. The loaded file only exists once the pieces are joined in script order.

Command and Control

Decompile the rebuilt script from Q9 statically with autoit-ripper. Its strings are encoded by a custom routine, so decode them with a Python reimplementation to expose an RC4 key and an encrypted blob. Decrypting the blob and decompressing it with LZNT1 yields a PE (SHA-256 starting 268b44be). Looking that hash up on VirusTotal and opening the contacted domains relation lists the C2. VirusTotal files the payload under the Lumma family rather than the StealC named in the scenario, but the domain it contacts is the one the question wants. The domain came from the VirusTotal relations tab on the decrypted payload, not from reading the C2 string out of the decoded string table.

autoit-ripper K.exe work/autoit/

python3 -I rc4_lznt1.py blob.bin > payload.bin

Attack Summary

Phase	Action
Execution	User runs the cracked-app installer; Prefetch records the first run
Execution	A burst of .wp5 files, including a batch script and a CAB, is dropped into Temp
Defense Evasion	Batch script deobfuscates itself and unpacks the CAB with extrac32
Discovery	tasklist piped to findstr checks for security products
Defense Evasion	AutoIt interpreter copied and renamed to Moscow.com
Execution	Renamed interpreter runs an AutoIt script rebuilt from dropped fragments
Command and Control	Script decrypts an embedded PE, which contacts its C2 domain
Execution	Installer process ends; BAM records the termination time

IOCs

Type	Value
File (installer)	DOWNLOAD MASTERCAM X9 FULL CRACK PC.EXE
File (batch loader)	Mysql.wp5
File (CAB)	Play.wp5, SHA-256 35efc15a41cf54a51703711e0b117b1899e4698bed1a4fdae638ebb7a3a190e0
File (renamed interpreter)	Moscow.com (copy of AutoIt3.exe)
File (AutoIt script, rebuilt)	SHA-256 2b3d1561b9ae7fa2bd3f09dee28a327b5647a908113945cd2a943134822d18d0
File (decrypted payload)	SHA-256 starting 268b44be
Domain (C2)	crowfza[.]xyz

MITRE ATT&CK

Technique	ID	Description
User Execution: Malicious File	T1204.002	User ran a fake cracked-software installer
Command and Scripting Interpreter: Windows Command Shell	T1059.003	Obfuscated batch loader
Obfuscated Files or Information	T1027	Batch variables fragmented; AutoIt strings and payload encoded
Deobfuscate/Decode Files or Information	T1140	Cabinet extracted and payload decrypted at runtime
Software Discovery: Security Software Discovery	T1518.001	tasklist and findstr checks for AV/EDR products
Masquerading: Rename System Utilities	T1036.003	AutoIt3.exe copied as Moscow.com
System Binary Proxy Execution	T1218	extrac32 used to unpack the CAB
Application Layer Protocol: Web Protocols	T1071.001	Payload contacts its C2 domain

Defender Takeaways

Cracked-software installers are the delivery vector, so treat them as one. The entire chain started with a user running a fake crack from a user-writable path. Application control that blocks unsigned executables from Downloads and Temp stops it before the first drop.

An interpreter running under a different name is detectable by its original file name. Moscow.com is AutoIt3.exe with a new name. Detections keyed on PE metadata (OriginalFileName) or on a .com executable launching from a user profile folder catch this where name-based rules do not.

extrac32 extracting a cabinet from Temp is rare enough to alert on. Legitimate use of extrac32 on workstations is uncommon, and a batch script invoking it with /Y against a non-.cab extension is a strong staging signal.

Without event logs, Prefetch, the USN Journal and BAM carried the case. Prefetch supplied the run times and the renamed binary, $J the exact drop order and BAM the process end time. Collect process creation and termination events centrally so the case doesn’t depend on a registry key most responders forget to check.

Conclusion

A fake crack was enough to land an AutoIt-based loader and a decrypted infostealer that called out to its C2. Every stage used legitimate Windows or AutoIt binaries under new names and odd extensions, so the detections that matter are about names, paths and sequencing, not the binaries themselves.