Dream Job-1

Scenario

In this Sherlock, players will be introduced to the MITRE ATT&CK framework, which is a comprehensive tool used to research and understand advanced persistent threat (APT) groups. Specifically, players will focus on the APT group known as Lazarus Group. As they progress, players will get to explore various tactics, techniques, and procedures (TTPs) associated with Lazarus Group.

Executive Summary

Lazarus Group ran a recruiting-themed campaign that first surfaced in autumn 2019 and is tied to two sibling operations. Malicious code was launched through signed Windows binaries, and the operators moved sideways by phishing from mailboxes they already controlled. The payload was a custom RAT that called the Windows API directly to execute and used timing checks to sit quietly in sandboxes. Pivoting from the supplied hashes in VirusTotal tied one sample to a legitimate-looking browser executable name and another to a recruiting-themed lure document that reaches out to a staging URL for a second-stage document. This is an intelligence exercise rather than a host investigation: ATT&CK carries the campaign context and VirusTotal carries the indicators.

Artifacts

• IOCs.txt: IOCs.txt → plain text, three SHA-256 hashes to look up on VirusTotal (Q10 to Q14)
• MITRE ATT&CK: campaign page C0022 and software page S0694 → open in a browser, no local artifacts for Q1 to Q9

Note: Q1 to Q9 resolve from ATT&CK pages, so they carry no commands and cite their source inline. Q10 to Q14 use the hashes in IOCs.txt; the full attribute set from vt --json is what holds the dates and URLs.

Campaign Attribution

The ATT&CK campaign page for Operation Dream Job (C0022, https://attack.mitre.org/campaigns/C0022/) names the group in its header. The two-word format mask fits the group name.

Same C0022 page. The first-seen field gives a month and year, which matches the month year mask.

C0022 lists its associated campaigns next to the first-seen date. Operation North Star is one; the other is the remaining entry in that list.

Execution

The software list on C0022 includes one RAT, S0694 (https://attack.mitre.org/software/S0694/). That software page is the pivot for Q8 and Q9.

From Q7, the S0694 techniques table lists the execution entry as T1106. The name is two words, matching the ****** *** mask.

Defense Evasion

The techniques table on C0022 lists two System Binary Proxy Execution sub-techniques: T1218.010 (Regsvr32) and T1218.011. The second one is the answer.

Tip: Both are signed Microsoft binaries, so name-based allowlisting does nothing here. The command line and parent process separate abuse from normal use.

The S0694 page from Q7 lists Virtualization/Sandbox Evasion with its Time Based sub-technique (T1497.003). The answer has to fit the three-word mask, so it takes the wording used in the DRATzarus entry.

Gotcha: The technique page titles the sub-technique “Time Based Evasion”, but the mask **** ***** ****** only fits the DRATzarus entry’s wording.

Lateral Movement

C0022 has a single Lateral Movement entry: phishing sent from accounts the actors had already compromised.

From Q5, the ATT&CK entry for Internal Spearphishing carries the ID in the same C0022 techniques table.

Indicator Analysis

IOCs.txt holds three hashes. Look up the first one and read its meaningful_name. The name is a legitimate Windows executable, so the hash is a sample presented under a trusted filename rather than one with an obviously malicious name.

cat IOCs.txt

vt 7bb93be636b332d0a142ff11aedb5bf0ff56deabba3aa02520c85bd99258406f --json

Pull the full attribute set for the second hash and read creation_date. It is an epoch value (1589311577), so convert it to UTC to match the YYYY-MM-DD hh:mm:ss mask.

vt adce894e3ce69c9822da57196707c7a15acee11319ccc963b84d83c23c3ea802 --json

date -u -d @1589311577 '+%Y-%m-%d %H:%M:%S'

The pivot is the second hash from Q11. The file’s own attributes don’t name its parent, so switch to VirusTotal’s relationships: the execution_parents relation lists the files seen launching this sample. There’s exactly one, an ISO image with 34 detections, which fits the job-lure delivery: the “PDF reader” arrives inside a disk image named like a job description.

curl -s -H "x-apikey: $VT_KEY" "https://www.virustotal.com/api/v3/files/adce894e3ce69c9822da57196707c7a15acee11319ccc963b84d83c23c3ea802/execution_parents"

Look up the third hash and read its meaningful_name. It is a recruiting-themed document name, which matches the job-offer lure behind the campaign from Q1.

vt 0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1 --json

From Q13, the same sample’s contacted URLs list contains one URL ending in .docx, the second-stage document. The mask (*****://********************.***/**_***_*****.****) matches it. Of the answers here, this one was taken from the JSON output of the third-hash lookup and accepted by HTB.

grep -oE 'https?://[^"]+\.docx' vt_0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.json

Attack Summary

Phase	Action
Initial Access	Job-offer lures delivered as recruiting-themed documents
Execution	A lure document contacts a remote URL to fetch a secondary .docx
Defense Evasion	Malicious code run through Regsvr32 and Rundll32
Execution	DRATzarus runs code through the native Windows API
Defense Evasion	DRATzarus uses time-based checks to avoid sandbox analysis
Lateral Movement	Phishing sent from compromised internal accounts

IOCs

Type	Value
Malware family	DRATzarus (S0694)
Filename	Salary_Lockheed_Martin_job_opportunities_confidential.doc
Filename (hash 1)	IEXPLORE.EXE
URL	hxxps[://]markettrendingcenter[.]com/lk_job_oppor.docx
SHA-256 (hash 1)	7bb93be636b332d0a142ff11aedb5bf0ff56deabba3aa02520c85bd99258406f
SHA-256 (hash 2)	adce894e3ce69c9822da57196707c7a15acee11319ccc963b84d83c23c3ea802
SHA-256 (hash 3)	0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1

MITRE ATT&CK

Technique	ID	Description
System Binary Proxy Execution: Regsvr32	T1218.010	Signed binary used to run malicious code
System Binary Proxy Execution: Rundll32	T1218.011	Second proxy-execution binary used in the operation
Phishing: Internal Spearphishing	T1534	Lateral movement through phishing from compromised accounts
Native API	T1106	DRATzarus execution
Virtualization/Sandbox Evasion: Time Based Evasion	T1497.003	DRATzarus sandbox avoidance

Defender Takeaways

Hunt for Rundll32 and Regsvr32 loading unusual DLLs. Both are signed binaries, so allowlisting by name does not help. Alert on command lines that load DLLs from user-writable paths or remote locations, and on odd parent processes such as Office applications.

Watch for phishing sent from internal mailboxes. Mail from a trusted internal sender skips much of the gateway filtering and user suspicion. Flag internal messages with attachments or links that the sender’s account has never sent before, and make reporting an internal phish easy.

Expect sandbox-aware malware. Time-based checks can make a short detonation look clean. Allow longer run times and pair sandbox verdicts with static and behavioral analysis before calling a sample benign.

Block and alert on lure documents that fetch a second stage. The sample behind the third hash pulls a .docx from an external host, so web proxy logs for Office processes reaching uncategorised domains are a cheap detection. Add the staging domain to blocklists and hunt retroactively for it.

Tell staff about fake job offers. The campaign’s lure is a job opportunity, so recruiting-themed attachments belong in awareness training, especially for staff in the sectors the group targets.

Conclusion

Operation Dream Job shows a patient actor using a believable lure, signed system binaries and internal phishing to avoid every obvious control. Detection depends on behavior and sequencing, not on the reputation of any single binary.