Heartbreaker

Scenario

This Sherlock involves players investigating a phishing email and Windows events that mirror the characteristics of the Love Bug virus. The story kicks off when the victim receives a suspicious email and falls for the trap. This scenario is part of a trio of interconnected Sherlocks, but can also be enjoyed on its own.

Executive Summary

A phishing email from an external ProtonMail address lured the victim into downloading an executable disguised as a membership card. Once run, the binary behaved like a worm: it mailed an identical lure to every contact in the victim’s address book. In the same minute it queried the domain controller with a built-in tool, copied the victim’s Outlook data file into a staging folder, zipped the staged files, and pulled WinSCP from a software download site into a folder named to look like IT tooling. A WinSCP script then shipped the archive off the machine. The Outlook data file also held a draft with the victim’s AWS access keys in plain text, so the exfiltrated data carried live cloud credentials.

Artifacts

• Outlook OST: the victim’s mailbox cache → parse with pypff (libpff-python), since no PST tooling was installed. Dump full transport headers, because the default truncation hides the Bcc list
• Sysmon event logs: Microsoft-Windows-Sysmon%4Operational.evtx and the rest of the winevt\logs folder → EvtxECmd with --maps. Covers process creation (EID 1), file create (EID 11) and DNS (EID 22)
• Prefetch: Windows\prefetch → PECmd
• $MFT: → MFTECmd
• Browser profiles: Edge History and Firefox places.sqlite / formhistory.sqlite → sqlite3 on copies

Timestamp note: Everything in the Sysmon and prefetch data is UTC. Mail headers carry a local offset (+0800), so convert before submitting. Task answers are YYYY-MM-DD hh:mm:ss.

Initial Access

The mailbox is an OST, so parse it directly. A short pypff script walks every folder and prints sender, subject and transport headers. The inbox holds one message that stands out: a “fingers crossed” style love lure. Its From and Return-Path headers carry the same external address.

python3 -I work/pff/dump.py OST > work/pff/out.txt

The body of the same message links to a raw IP on a non-standard port. Two other artifacts back it up: a Sysmon EID 1 for Firefox launched with the URL on its command line, and the Firefox places.sqlite history. The filename is a double extension, an image-looking name over an .exe.

sqlite3 work/ff/places.sqlite "select url from moz_places"

Gotcha: The format hint shows hxxp, but the answer field wants the real scheme, http.

Execution

Prefetch gives the run time without any log parsing. Parse the prefetch folder and read LastRun for the downloaded executable. The Sysmon process-creation event for the same image lands on the same second.

PECmd -d evidence/Windows/prefetch --csv work/pf

The victim used more than one browser, so check each. Firefox keeps typed search terms in formhistory.sqlite under the searchbar-history field and in places.sqlite; Edge keeps them in keyword_search_terms. The search after the download is the one to report.

sqlite3 work/edgehist.sqlite "select term from keyword_search_terms"

sqlite3 work/ff/formhistory.sqlite "select fieldname, value from moz_formhistory"

Credential Access

Back in the dumped mailbox, a Gmail Drafts item titled “IAM” holds the access key ID and secret key in plain text in the body. Copy both values straight from the dump rather than retyping, since the secret is case sensitive.

grep -n -i -B2 -A6 'IAM' work/pff/out.txt

From Q4 we know the keys sit in a draft inside the Outlook data file. The Sysmon file-create events show the binary copying that mailbox cache into a staging folder under C:\Users\Public before archiving it. This one is reasoned rather than read from a single artifact: the draft is stored in the mailbox cache, and the cache is the file that was staged. The answer is that file’s extension.

EvtxECmd -d evidence/Windows/System32/winevt/logs --csv work/evtx --csvf evtx.csv --maps tools/ez/EvtxeCmd/Maps

Lateral Movement

The sent copy of the lure sits in the OST’s Sent Mail folder. Its Date header is in the sender’s local zone (+0800), so subtract eight hours to get UTC.

grep -n -i -A12 'Sent' work/pff/out.txt

Gotcha: The header shows 18:47:51. Reporting it without the offset conversion is eight hours out.

The worm used Bcc, so the recipient list only exists in the full headers of the sent item. This is why the dump has to print untruncated transport headers. Count the unique addresses in Bcc and leave out the victim’s own mailbox.

grep -n -i 'Bcc' work/pff/out.txt

Discovery

Five seconds after the binary started, prefetch shows a signed Windows domain-trust utility running. Sysmon DNS events resolve the domain controller around the same time, and a DCinfo.txt output file appears in the staging area.

PECmd -d evidence/Windows/prefetch --csv work/pf

Command and Control

Filter the parsed Sysmon data for DNS queries (EID 22) where the image is the malicious binary. A lookup of a software download site fires a couple of seconds after the staging archive is written, and a WinSCP.zip is dropped straight afterwards.

EvtxECmd -d evidence/Windows/System32/winevt/logs --csv work/evtx --csvf evtx.csv --maps tools/ez/EvtxeCmd/Maps

Defense Evasion

Follow the WinSCP drop in the Sysmon file-create events. WinSCP.exe is written under C:\Users\Public inside a folder with an IT-support sounding name, which is the hiding place. The MFT confirms the same path.

MFTECmd -f '$MFT' --csv work/mft

Naming a folder after a legitimate help-desk toolkit so a file transfer client blends in is disguising a binary as something benign. That is the Masquerading technique (T1036). This was reasoned from the behaviour in Q11, not read from an artifact.

Collection

The binary staged its loot in C:\Users\Public\Public Files and then wrote a WB-WS-01.zip archive at 10:45:18. Count the distinct Sysmon file-create events in the staging folder before that timestamp. That count is a minimum, because the archive contents themselves were not recoverable. This is a derived number rather than a value read from the zip.

grep -i 'Public Files' work/evtx/evtx.csv

Exfiltration

The Sysmon EID 1 two seconds after the WinSCP DNS lookup shows the binary running the console variant of WinSCP against a script file in the hiding folder. Copy the CommandLine field verbatim, quotes included.

EvtxECmd -d evidence/Windows/System32/winevt/logs --csv work/evtx --csvf evtx.csv --maps tools/ez/EvtxeCmd/Maps

Attack Summary

Phase	Action
Initial Access	Victim receives a love-themed lure from an external ProtonMail address with a link to a double-extension executable
Execution	Victim downloads and runs the binary
Execution	Victim searches the web for the lure’s theme afterwards
Discovery	Binary queries the domain controller with nltest.exe
Collection	Binary copies the OST and other files into C:\Users\Public\Public Files and zips them
Command and Control	Binary resolves a software download site and pulls WinSCP
Defense Evasion	WinSCP is dropped into a fake HelpDesk-Tools folder
Exfiltration	WinSCP.com runs a script to upload the archive
Lateral Movement	Binary mails the same lure to 58 contacts via Bcc

Forensic Timeline

Timestamp (UTC)	Event
2024-03-13 10:45:02	Malicious binary executed
2024-03-13 10:45:07	nltest.exe runs
2024-03-13 10:45:18	WB-WS-01.zip staging archive created
2024-03-13 10:45:23	DNS lookup of us.softradar.com from the binary
2024-03-13 10:45:25	WinSCP.com runs with the maintenance script
2024-03-13 10:47:51	Lure mailed to the victim’s contacts

IOCs

Type	Value
Email	ImSecretlyYours@proton[.]me
URL	hxxp[://]44[.]206[.]187[.]144:9000/Superstar_MemberCard.tiff.exe
File	Superstar_MemberCard.tiff.exe
Domain	us[.]softradar[.]com
Folder	C:\Users\Public\HelpDesk-Tools
Folder	C:\Users\Public\Public Files
File	WB-WS-01.zip
File	C:\Users\Public\HelpDesk-Tools\maintenanceScript.txt
AWS access key ID	AKIA52GPOBQCK73P2PXL

MITRE ATT&CK

Technique	ID	Description
Phishing: Spearphishing Link	T1566.002	Lure email linking to a hosted executable
User Execution: Malicious File	T1204.002	Victim ran the downloaded binary
Unsecured Credentials: Credentials In Files	T1552.001	AWS keys stored in plain text in a mailbox draft
Internal Spearphishing	T1534	Binary mailed the lure to the victim’s contacts
System Network Configuration Discovery	T1016	nltest.exe against the domain controller
Ingress Tool Transfer	T1105	WinSCP downloaded from a software site
Masquerading	T1036	WinSCP hidden in a HelpDesk-Tools folder
Archive Collected Data	T1560	Staged files zipped before exfiltration
Exfiltration Over Alternative Protocol	T1048	Scripted WinSCP transfer

Defender Takeaways

Plain-text secrets in mailbox drafts are as exposed as the mailbox. The AWS keys were sitting in an Outlook draft, and the OST was staged and shipped with everything else. Rotate keys found in mail during triage, and use a secrets manager or short-lived credentials so a copied mailbox is not also a cloud compromise.

Double extensions and a raw-IP download on a high port should never reach execution. The lure pointed at Superstar_MemberCard.tiff.exe on port 9000 of a bare IP. Web filtering on uncategorised IP destinations, and showing file extensions, would have broken the chain at the click.

Sysmon covered the entire intrusion on its own. Process creation, file create and DNS events gave the run time, the staging archive, the tool download and the exfiltration command within a 25-second window. Alert on a user-profile executable that resolves a download site and then writes an archive-and-transfer tool into C:\Users\Public.

Public profile folders with IT-sounding names are a hiding spot worth hunting. A transfer client under C:\Users\Public\<name> is out of place for a managed workstation. Application control that only allows WinSCP from approved paths would have stopped it, and WinSCP.com /script= from a non-standard directory is a clean detection.

A mass send from a single workstation needs its own alert. One message with a large Bcc list, sent seconds after an unsigned binary started, is the worm’s signature. Outbound recipient-count thresholds on mail flow would have caught the propagation.

Conclusion

One click on a disguised executable let the binary scout the domain, stage and archive the victim’s files, install a hidden file transfer client, exfiltrate the lot and mail itself to 58 contacts, all inside about three minutes. The decisive evidence was Sysmon plus the OST, which is also where the victim’s cloud keys were left exposed.