Hijacked

Scenario

In this Sherlock, players are expected to utilize different forensic tools on a memory image from a compromised workstation to analyze a full cyber attack and obtain necessary information.

Executive Summary

A user at Forela read a phishing email in a Firefox webmail tab. The sender posed as a colleague and attached a password-protected zip with a second protected zip inside it, with both passwords given in the message body. Opening the archive with WinRAR dropped an HTA whose embedded PowerShell was an Empire stager, which gave the attacker a foothold over the first C2. For privilege escalation a DLL from the user’s Temp folder was injected into a svchost service process, which spawned a rundll32 that beaconed to a second C2. The attacker then used certutil to pull a batch script that harvested office documents and archived them with a password, installed TeamViewer for persistence and created a local backdoor account. The tradecraft and regional targeting point to a known China-nexus group.

Artifacts

• Memory image: Dump.mem (7.6 GB) → Volatility 3 for processes, network and file carving, strings for anything that never became a structured object
• First.zip: First.zip → the malicious attachment, AES-encrypted and nested. Open it with 7z, since unzip can’t handle AES (method 99)

Tool note: strings in both ASCII and UTF-16LE (-el) was the most productive tool on this image. The phishing email, the certutil URL, the batch stager and the RAR password all surfaced there before any plugin found them.

Initial Access

No mail client in the process list, so the mail was read in a browser. strings over the dump shows Zoho Mail URLs (mail.zoho.eu) in the memory of the firefox.exe profile, which names the browser.

strings -a -n8 Dump.mem > s8.txt; strings -a -n8 -el Dump.mem > s16.txt; grep -a 'mail.zoho' s8.txt s16.txt | head

With the webmail identified in Q2, search the UTF-16 strings for the Zoho message rendering. The sender sits in browser memory as a display name plus address.

grep -a 'forela.co.uk' s16.txt | grep -ai 'alonzo'

The subject sits in the same Zoho message fragment recovered for Q3. Read the lines around the sender hit in s16.txt.

grep -a -B3 -A8 '[email protected]' s16.txt | head -40

The WinRAR command line in the process list references the downloaded archive in the user’s Downloads folder, and the Zoho message lists the same name as its attachment.

vol -f Dump.mem windows.cmdline | grep -i winrar

The email body is still in browser memory, so searching the strings for zip near pass recovers the wording the attacker used. The passwords are confirmed by extraction: the outer First.zip opens with the first, the nested Second.zip with the second. zip2john plus rockyou is the fallback if the body had not survived.

grep -aiE '(zip|archive).{0,25}pass' s8.txt s16.txt

7z x -pforela1234 First.zip && 7z x -pforela123 Second.zip

Gotcha: unzip fails on these archives because they use AES encryption (method 99). Use 7z.

Extracting the nested archives from Q10 yields a single file, an HTA. Its body is a PowerShell launcher with -enc, identical to the command line of the powershell.exe process found in Q1.

ls -la; head -c 600 SystemHealthCheck.hta

Hash the HTA extracted from the two zips in Q10.

md5sum SystemHealthCheck.hta

Word was open when the image was taken. The command line of WINWORD.EXE (PID 9888) carries the document path as its argument.

vol -f Dump.mem windows.cmdline | grep -i winword

Find the docx in filescan, carve it with dumpfiles using the virtual address, then unzip the docx and read the first heading out of word/document.xml.

vol -f Dump.mem -o dump windows.dumpfiles --virtaddr <docx offset>

unzip b.docx -d docx && python3 -I -c "import re,sys;print(re.findall(r'<w:t[^>]*>([^<]+)', open(sys.argv[1],encoding='utf8').read())[:5])" docx/word/document.xml

The last paragraph of the document recovered in Q6 states that the Pakistan operation will be fully under way by a specific date. Print the document text and read it from the end.

python3 -I -c "import re,sys;print(re.findall(r'<w:t[^>]*>([^<]+)', open(sys.argv[1],encoding='utf8').read())[-3:])" docx/word/document.xml

Execution

Walk the process list after WinRAR opened the archive. A powershell.exe started right after it, with -noP -sta -w 1 -enc and a long base64 blob, the shape of an Empire launcher. That blob matches the one inside the HTA from Q9.

vol -f Dump.mem windows.pslist > pslist.txt; vol -f Dump.mem windows.cmdline > cmdline.txt; grep -i 'powershell' cmdline.txt

Command and Control

Decode the -enc argument from PID 9620 (UTF-16LE base64). The script is an RC4-decrypting launcher that sets a Cookie header and requests /news.php, the default Empire stager layout.

grep 9620 cmdline.txt | grep -oE '[A-Za-z0-9+/=]{200,}' | base64 -d | iconv -f utf-16le -t utf-8 > ps_dec.txt

The decoded stager from Q12 holds the server address as a second base64 string. netscan confirms it: the connection is owned by the PowerShell process 9620.

vol -f Dump.mem windows.netscan | grep -E '9620|powershell'

After the escalation in Q13 the svchost process has a rundll32.exe child (PID 3932). Rundll32 is the LOLBin, and netscan shows it connected out on port 4444 to a different address from Q16.

vol -f Dump.mem windows.netscan | grep 3932

Command lines that never reached the process list still sit in memory. Searching the strings for certutil finds a -urlcache -f download of a batch file from a third address.

grep -aE 'certutil|net user' s8.txt s16.txt

Privilege Escalation

Look for a service host that is the parent of the second-stage rundll32 (PID 3932). It is an svchost.exe started with -k UnistackSvcGroup, a service group that is not part of a stock Windows install, and it has a user-writable DLL loaded.

vol -f Dump.mem windows.pslist | grep -E 'svchost|rundll32'

List the DLLs loaded in the service host from Q13. Every other module comes from System32; one comes from the user’s Temp folder.

vol -f Dump.mem windows.dlllist --pid 4352

A DLL from a user-writable Temp path loaded into a privileged svchost process, with a child beacon appearing from it, is DLL injection under Process Injection. This was reasoned from the module list in Q14 rather than read from a single artifact, and HTB accepted it.

Gotcha: UnistackSvcGroup is a known DLL search-order hijacking target (HackTricks writable SYSTEM PATH DLL hijacking), which pulls you toward the T1574.x family. None of those fit: the evidence shows a DLL placed in Temp and loaded into a running service process, not a missing-DLL lookup being satisfied.

Collection

The downloaded batch script from Q18 is still in memory in readable form. Search for the operation tag and the LootDocs staging folder, then read the for /r loops that copy files by extension in the order they appear.

grep -anE 'PK-OPR24|LootDocs' s8.txt s16.txt

The same script archives the staging folder with Rar.exe a. The -p switch carries the password in clear on the command line.

grep -aE 'Rar\.exe' s8.txt s16.txt

Persistence

The process list contains TeamViewer_Service and TeamViewer.exe, and the strings show bitsadmin and certutil downloads around the install. TeamViewer is not part of the victim’s normal software, so it is the attacker’s remote access channel.

vol -f Dump.mem windows.pslist | grep -i teamviewer

The account creation command never turned up in the strings, so go to the SAM. hashdump lists the local accounts, and RID 1003 is helpdesk, which is not a normal user on this host. Crack its NT hash against rockyou to get the password.

vol -f Dump.mem windows.hashdump

hashcat -m 1000 nt.txt /usr/share/dict/rockyou.txt

Attribution

This was reasoned, not read from an artifact. The combination that pointed to this group was a document-harvesting script tagged with a Pakistan-themed operation name, a lure about South Asian expansion, Empire for the foothold and a remote access tool for persistence, plus the character-count mask on the answer.

Tip: Nothing in the memory image names the actor. Take the operation tag, the targeting region and the document-collection tooling to threat-intel reports and match on those.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Nested, password-protected archives defeat mail scanning by design. Giving the passwords in the same message is a strong lure signal. Block or quarantine encrypted archives from external and look-alike senders, and flag a user opening an archive in WinRAR and a script host spawning PowerShell seconds later.

Encoded PowerShell with -noP -sta -w 1 -enc is a detection primitive on its own. The Empire launcher left its full command line in memory and in the process tree. Script block logging and command line auditing would have caught it at the first stage.

A DLL in a user Temp folder loaded by svchost should never happen. Alert on image loads into service hosts from user-writable paths, and on service groups that are not in a baseline. The -k UnistackSvcGroup group name alone was a lead.

certutil with -urlcache and Rar.exe with -p are cheap to detect. Both leave their secrets (a URL and a password) in command lines. Alert on LOLBin downloads and on unapproved archivers running on user machines.

Unapproved remote access tools and new local accounts need an inventory check. TeamViewer on a workstation outside the software list, and a helpdesk account with a weak, crackable password, were both persistence the attacker could use after the C2 was burned.

Conclusion

The attacker went from one phishing click to SYSTEM-level reach, document theft and two independent persistence routes, and almost every step was a built-in or commodity tool. A single memory image still held the email, the stager, both C2s and the archive password, which is why volatile evidence should be collected before the host is cleaned.