Fruitzy

Scenario

In this Sherlock, players will analyze a real, ongoing phishing campaign designed to deliver remote access malware, which was investigated by the author of the Sherlock, CyberJunkie. The attack involves phishing, which ultimately installs an RMM tool on the system for remote access.

Executive Summary

A freshly registered domain served a phishing email posing as a party invitation. The victim clicked the link, was bounced through a PHP redirector, and downloaded an executable from a cloud storage CDN in Edge. They ran it, got no invitation, and scanned it with Microsoft Defender, which found nothing. In the background the executable had already installed a legitimate commercial RMM agent as a Windows service, giving the actor remote access, and the agent’s binaries carried backdated modification times that disagree with the NTFS filename timestamps. The whole chain sits in a KAPE triage collection: the mailbox message, Edge history, Amcache, Defender and System event logs, and the $MFT.

Artifacts

• Phishing email: .eml message in the collection → read the headers with a text editor
• Edge History: Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\History → sqlite3 (or DB Browser for SQLite), tables downloads and visits
• Amcache: Amcache.hve → AmcacheParser
• Event logs: Windows Defender/Operational and System EVTX → EvtxECmd
• $MFT: $MFT → MFTECmd

Timestamp note: the evidence zip holds a VHDX whose NTFS boot sector has zeroed jump bytes, so 7z, ntfs-3g and udisks refuse it. Patch a copy of the volume image and extract with dissect.ntfs; the original stays untouched.

python3 -I -m dissect.ntfs.tools.extract fs/0.img work/ntfs

Resource Development

Take the registrable domain from the redirector URL in Q2 and query its RDAP record through rdap.org. The registration event gives the creation date and time, about two weeks before the victim ran the payload, so the infrastructure was purpose-built for this campaign. Reference: https://rdap.org/domain/pomi.digital.

curl -s https://rdap.org/domain/pomi.digital | python3 -c 'import json,sys; print([e for e in json.load(sys.stdin)["events"] if e["eventAction"]=="registration"])'

Tip: WHOIS output often rounds to the date. RDAP gives the full timestamp this answer format needs.

Initial Access

Open the .eml in the collection and read the Subject: header. The lure is a social invitation attributed to a named sender, which fits the scenario’s “no invitation appeared” later on.

grep -m1 '^Subject:' *.eml

Edge’s History database records where the click led. The downloads table stores a tab_url, the page the download was started from, which is the redirect target. The visits table shows the same URL one hop after the email link.

sqlite3 History "select tab_url, target_path from downloads"

Gotcha: the downloads row also holds the final CDN host that actually serves the payload. That is where the file came from, not where the link redirected to, and it was rejected. The answer is the tab_url, a PHP endpoint.

Same downloads table, target_path column. Only one executable was downloaded in the session and it sits in the user’s Downloads folder.

sqlite3 History "select target_path, total_bytes from downloads"

Execution

Parse Amcache.hve and find the entry for the file from Q3. The FileKeyLastWriteTimestamp on its InventoryApplicationFile or file entry is the execution time Amcache gives you.

AmcacheParser -f Amcache.hve --csv work/amcache

Amcache stores only the SHA1 of the file. Pull it from the same row as Q4, then look the SHA1 up on VirusTotal, whose file page lists the SHA256 and the detection names used in Q11.

grep -i premium.exe work/amcache/*UnassociatedFileEntries.csv

Tip: this is why Amcache is worth parsing even when the sample itself is gone: the hash survives and VirusTotal can be searched by SHA1.

From Q5 the hash is known, so open it on VirusTotal and read the Names list on the Details tab. Besides premium.exe there is a short random-looking alternate filename the same binary has been submitted under.

Parse the Defender Operational log and look for the scan-start event (ID 1000) with the scan type Custom Scan. A custom scan is the user right-clicking the file, so it is the manual scan, not a scheduled or quick one. The event lands about three and a half minutes after the Amcache execution time.

EvtxECmd -d work/ntfs/evtx --csv work/evtx

Persistence

Service installs are System event 7045. Filter the EvtxECmd output for it around the execution time from Q4 and read the service name and image path. The new service appears seconds after the payload ran.

EvtxECmd -d work/ntfs/evtx --csv work/evtx

CentraStage is the original name of the Datto RMM agent, so the vendor follows from the service name in Q7. This is reference knowledge, not something read from an artifact.

Defense Evasion

Parse the $MFT and look at the RMM agent executables from Q7. The $STANDARD_INFORMATION modified time is set to a date weeks before the infection, while the $FILE_NAME timestamps still show the real creation one second after execution. That mismatch is the timestomp, and the $SI modified value is the answer.

MFTECmd -f '$MFT' --csv work/mft

Gotcha: Explorer and dir only show the $SI values, so the files look old and benign. Compare against $FN to see when they were really written.

Attack Summary

Phase	Action
Resource Development	Phishing domain registered
Initial Access	Party-invitation email with a link to the domain
Initial Access	Link redirects through a PHP endpoint to a CDN-hosted executable
Execution	Victim runs the download; Amcache records it
Execution	Victim scans the file with Defender and finds nothing
Persistence	Executable installs the Datto RMM agent as a service
Defense Evasion	Agent executables timestomped to an earlier date

Forensic Timeline

Timestamp (UTC)	Event
2026-02-09 07:56:40	Timestomped $SI modified time on the RMM executables
2026-02-20 01:06:05	pomi.digital registered
2026-03-04 16:44:33	Download executed, per Amcache
2026-03-04 16:44:34	RMM executables actually written ($FN)
2026-03-04 16:48:00	Manual Defender custom scan started

IOCs

Type	Value
Domain	pomi[.]digital
URL	hxxps[://]pomi[.]digital/premium/windows_download[.]php
URL (payload host)	hxxps[://]pub-d8a802dcdc114798b560cd3f305ee158[.]r2[.]dev/invite/premium.exe
File	premium.exe (also 5bxrx.exe)
SHA256	af240a2c2a4b42e3a130f47ccaab9aa2e20a1a586bc959ee9efd7475055ea7e3
Service	CentraStage

MITRE ATT&CK

Technique	ID	Description
Acquire Infrastructure: Domain	T1583.001	Phishing domain registered about two weeks before use
Phishing: Spearphishing Link	T1566.002	Party-invitation email with a link to the redirector
User Execution: Malicious File	T1204.002	Victim ran the downloaded executable
Create or Modify System Process: Windows Service	T1543.003	RMM agent installed as a service
Remote Access Software	T1219	Datto RMM used as the remote access channel
Indicator Removal: Timestomp	T1070.006	RMM executables given an earlier modified time

Defender Takeaways

Block or alert on RMM installs you did not deploy. A 7045 for an RMM agent on a machine that is not managed by that vendor is a clean, low-noise detection. Allowlist the RMM products you own and alert on every other one.

Treat newly registered domains in email links as suspicious. The phishing domain was about two weeks old when it was used. Mail gateways that score on domain age or hold such links for detonation would have caught this before the click.

Compare $SI and $FN timestamps when hunting. The actor backdated the agent files, but the $FILE_NAME attributes still hold the real write time. A check for $SI earlier than $FN on files in program directories finds this class of timestomping.

A clean Defender scan is not a clean file. The victim’s manual scan found nothing because the payload was a legitimate signed RMM agent behind a thin loader. Detection has to key on behaviour, such as an unexpected service install right after a download, rather than on signatures alone.

Conclusion

The actor never needed custom malware: a convincing invitation, a throwaway domain and a legitimate RMM agent gave them persistent remote access that signature scanning would not flag. The evidence that gave it away was behavioural, a service install seconds after a download and file timestamps that contradict each other.