Heartbreaker-Continuum

Scenario

Players in this Sherlock scenario will be investigating a malicious binary file that was executed by the victim. The file displays traits similar to the Love Bug virus, and players must analyze its impact on the system. This scenario is part of a trio of interconnected Sherlocks, but can also be enjoyed on its own.

Executive Summary

A romance-themed lure pointed the victim at a download that looked like an image but was a Windows executable. The executable was a PowerShell script compiled into an EXE, with the script stored as reversed base64 inside the binary. Once decoded, the script opened a decoy image to keep the victim calm, profiled the host and domain, and copied every Office document, PDF and mail store under C:\Users into a public staging folder. It zipped the folder, pulled down a portable WinSCP, and pushed the archive to an external SFTP server with hardcoded credentials. The final stage harvested the victim’s Outlook contacts and mailed the same lure onward, which is how the worm-like Love Bug behaviour in the scenario plays out.

Artifacts

• Binary: Superstar_MemberCard.tiff.exe → hash with sha256sum, parse headers with pefile, pull strings with strings
• Embedded script: a PowerShell script inside the PE, recovered and decoded with Python (or CyberChef)

Timestamp note: The PE TimeDateStamp is an epoch value. Convert it as UTC and submit in YYYY-MM-DD hh:mm:ss form.

Execution

Hash the sample as delivered. The format mask only shows the last character, so the full 64 hex digits are needed.

sha256sum Superstar_MemberCard.tiff.exe

The creation time lives in the COFF header’s TimeDateStamp. Read it with pefile and convert the epoch as UTC.

python3 -I -c "import pefile; p=pefile.PE('Superstar_MemberCard.tiff.exe'); print(p.FILE_HEADER.dump_dict()['TimeDateStamp'])"

Gotcha: pefile prints the stamp with a UTC suffix already, but any tool that renders it in local time will shift the answer.

SizeOfCode in the optional header gives the combined size of the code sections. A script-in-EXE wrapper like this one stays small because the payload is data, not code.

python3 -I -c "import pefile; p=pefile.PE('Superstar_MemberCard.tiff.exe'); print(p.OPTIONAL_HEADER.SizeOfCode)"

Defense Evasion

The sample carries the traits of a script compiled to an EXE (PS2EXE style). Running strings over it surfaces the original script name, with the .ps1 extension, next to the PowerShell host strings.

strings -a Superstar_MemberCard.tiff.exe | grep -i '\.ps1'

The script body is held in a variable assigned a long string, $sCrt. Find that variable in the raw bytes and report where the assignment starts, not where the encoded data inside the quotes starts.

strings -a -t x Superstar_MemberCard.tiff.exe | grep -F '$sCrt'

Gotcha: The base64 data begins 9 bytes later, after $sCrt = ". Reporting that data offset is rejected; the expected value is the start of the variable assignment.

The string in $sCrt is not valid base64 as stored. Reversing it first and then base64-decoding it yields readable PowerShell, so the scheme is base64 with a string reversal on top. The mask ending in 4 already points to the base number.

python3 -I decode.py Superstar_MemberCard.tiff.exe  # regex out the $sCrt string, reverse it, base64-decode to decoded.ps1

Command and Control

In the decoded script, the first action downloads a decoy .tiff from the attacker’s host and opens it. The same cmdlet is reused later to fetch a portable WinSCP, this time with a Wget user agent.

grep -n 'Invoke-' decoded.ps1

Extract every IPv4 from the decoded script. Two addresses appear: one serves the decoy image and the lure link on port 9000, the other is the SFTP destination inside the WinSCP script. The WinSCP download URL is a legitimate software mirror, not an IoC for this question.

grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' decoded.ps1 | sort -u

Collection

The script defines $targetDir, creates it if missing, and writes the profiling output (username, DC info, local users, AV, processes, shares, GPO results) into it before copying matching documents in. It is also the folder that gets zipped.

grep -n 'targetDir' decoded.ps1 | head

A Get-ChildItem -Recurse over C:\Users with a list of document, mail and archive extensions, copying every hit to the staging folder with no user interaction, is Automated Collection. This answer was reasoned from the script’s behaviour against the ATT&CK technique list rather than read from an artifact, and HTB accepted it.

Exfiltration

After Compress-Archive zips the staging folder, the script downloads portable WinSCP, writes a maintenanceScript.txt with an inline open sftp://user:password@host/ line, and runs it to put the archive. The password sits in that here-string in cleartext.

grep -n 'sftp://' decoded.ps1

Attack Summary

Phase	Action
Initial Access	Lure email links to a .tiff.exe download on an attacker host (port 9000)
Execution	Compiled PowerShell script runs; payload decoded from reversed base64 held in $sCrt
Defense Evasion	Double extension and a decoy .tiff opened to hide the execution
Discovery	Username, DC info, local users, AV product, user processes, SMB shares, GPO results written to the staging folder
Collection	Recursive copy of Office, PDF, mail and OpenDocument files from C:\Users into C:\Users\Public\Public Files
Collection	Outlook contacts exported to Contacts.csv
Exfiltration	Staging folder zipped, portable WinSCP fetched, archive pushed over SFTP with hardcoded credentials
Impact / Propagation	Lure email sent on to the victim’s contacts
Defense Evasion	Staging folder and WinSCP directory deleted

IOCs

Type	Value
SHA256	12daa34111bb54b3dcbad42305663e44e7e6c3842f015cccbbe6564d9dfd3ea3
File	Superstar_MemberCard.tiff.exe
Original script	newILY.ps1
IP (payload and lure host)	44.206.187[.]144
URL	hxxp[://]44[.]206[.]187[.]144:9000/Superstar_MemberCard[.]tiff[.]exe
IP (SFTP exfil)	35.169.66[.]138
SFTP account	service / M8&C!i6KkmGL1-#
Path	C:\Users\Public\Public Files
Path	C:\Users\Public\HelpDesk-Tools (portable WinSCP and maintenanceScript.txt)

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Link	T1566.002	Email lure with a download link to the executable
Masquerading: Double File Extension	T1036.007	.tiff.exe presented as an image
Command and Scripting Interpreter: PowerShell	T1059.001	Embedded script run by the compiled wrapper
Obfuscated Files or Information: Command Obfuscation	T1027.010	Script stored as reversed base64
Ingress Tool Transfer	T1105	Invoke-WebRequest pulls the decoy and portable WinSCP
Automated Collection	T1119	Recursive copy of documents and mail stores to the staging folder
Archive Collected Data: Archive via Utility	T1560.001	Compress-Archive zips the staging folder
Exfiltration Over Alternative Protocol	T1048	WinSCP SFTP upload to an external host

Defender Takeaways

An executable with an image extension should never reach a user. The lure link ended in .tiff.exe, and Windows hides known extensions by default. Block double-extension attachments and downloads at the mail and web gateway, and turn on “show file extensions” through policy.

Script-in-EXE wrappers hide PowerShell from the usual hooks. The code arrives as data in a PE and the script text only exists after decoding. Script Block Logging and AMSI still see it at runtime, so make sure both are on and that the logs reach the SIEM; hunt for PowerShell hosts spawned from user-writable download folders.

A staging folder under C:\Users\Public is a cheap detection. Hundreds of document copies landing in one folder, followed by Compress-Archive, is an unusual burst for a normal user. File-creation telemetry on that path, combined with the archive creation, would have flagged this before the upload.

Unapproved file-transfer tools pulling from a mirror are a signal. Downloading portable WinSCP with a Wget user agent and running it with an inline credentialed sftp:// script is rare in a managed estate. Alert on WinSCP.com executing from C:\Users\Public and on SFTP egress to hosts outside an allowlist.

Outlook automation from a script should be alerted on. Closing Outlook, then opening it through Outlook.Application COM to read contacts and send mail, is how the lure spreads laterally. Restrict programmatic access to the mailbox and watch for COM-driven sends from PowerShell.

Conclusion

The sample stole the victim’s documents and mail, shipped them to an external SFTP server with credentials left in plain text, and then used the victim’s own contact list to spread the same lure. Nothing in it was sophisticated; a reversed base64 string was the whole of the obfuscation, which is why static analysis alone gave up every answer.