Lockpick4.0

Scenario

Forela.org’s IT Helpdesk has been receiving reports from employees experiencing unusual behaviour on their Windows systems. Within 30 minutes, the number of affected systems increased drastically, with employees unable to access their files or run essential business applications. An ominous ransom note appeared on many screens, asking the users to communicate with the ransomware group’s customer service department. It became apparent that Forela.org was under a significant ransomware attack. As a member of Forela.org’s Incident Response (IR) team, you have been assigned a critical task. A ticket has been created for you to reverse engineer the ransomware that has compromised Forela.org’s Windows systems. Your objective is to fully understand the ransomware’s capabilities and extract any Indicators of Compromise (IOCs) to feed into the organization’s detection tools, preventing further infection.Analysis of an advanced multi-stage ransomware payload targeting the Windows operating system.

Executive Summary

The ransomware arrived as a password-protected archive holding a VHDX image. Inside was a JavaScript dropper that decoded an embedded image and a PowerShell stage, and hid a Defender-named executable and a DLL in NTFS alternate data streams. The PowerShell stage checked for local administrator membership, used a CMSTP INF to bypass UAC, excluded its working files from Defender and launched the signed Defender binary, which sideloaded the malicious DLL. The DLL carried layered anti-debugging, XOR-obfuscated strings and an AES-encrypted configuration with the target extensions, the C2 host and the ransom note. All of it was recovered statically; nothing was executed.

Artifacts

• malware.zip: password-protected archive; the password is in DANGER.txt. Open with unzip -P
• defenderscan.vhdx: virtual disk inside the archive. List and extract with 7z
• defenderscan.js: the dropper on the disk, with alternate data streams attached
• stage1.ps1: PowerShell recovered from a base64 blob in the dropper
• msmpeng.exe / mpsvc.dll: the signed Defender binary and the malicious DLL, both stored as ADS on the dropper. Parse with pefile and objdump

Timestamp note: The case has no timestamps to anchor a timeline, so this page has no Forensic Timeline section.

Execution

Unpack the archive with the password from DANGER.txt and list the VHDX with 7z. The disk holds defenderscan.js plus alternate data streams. The script decodes a base64 blob, b64img, and writes it to disk as redbadger.webp before anything else, then decodes a second blob, b64s, into the PowerShell stage. Extract the first blob, decode it and hash the decoded file.

7z x defenderscan.vhdx
md5sum redbadger.webp

Privilege Escalation

stage1.ps1 opens with a function that gates the rest of the script on group membership. It runs whoami /groups and matches the output against a well-known SID. That SID is the built-in local Administrators group, so the check is the ransomware’s test for local administrator rights.

grep -n 'whoami' stage1.ps1

When the admin check fails, stage1.ps1 writes an INF file and runs cmstp.exe /au against it. CMSTP auto-elevates and executes the INF’s install section, which is the classic UAC bypass. Microsoft Connection Manager Profile Installer maps to System Binary Proxy Execution: CMSTP.

grep -n 'cmstp' stage1.ps1

Note: this is a reference-knowledge mapping from the observed cmstp.exe /au behaviour, and the question asks about privilege elevation. CMSTP is catalogued under defense evasion, but it is the technique the actor used to elevate.

Defense Evasion

The dropper’s ADS holds msmpeng.exe, the Windows Defender engine binary, which the script launches after setting up the sideload. Parse its Authenticode certificate directory with pefile and read the signer subject.

python3 -I -c "import pefile,sys; p=pefile.PE(sys.argv[1]); d=p.OPTIONAL_HEADER.DATA_DIRECTORY[4]; print(hex(d.VirtualAddress), d.Size)" msmpeng.exe
strings -a msmpeng.exe | grep -i 'Microsoft Corporation'

The DLL has three distinct debugger checks. The first calls IsDebuggerPresent. The second walks the process list with the Toolhelp API to check the parent process. The last installs a handler with SetUnhandledExceptionFilter and triggers an int3 (near 0x180001eb0), so a debugger swallows the exception and the handler never runs.

objdump -d --start-address=0x180001eb0 --stop-address=0x180001f40 mpsvc.dll

Note: the count and the API were reasoned from the three checks found in disassembly plus the answer format, not read from a single labelled artifact. HTB accepted it.

Persistence and Execution of the Payload

mpsvc.dll is the payload msmpeng.exe loads. List its export table: it has a single export, which is where execution lands once the signed binary loads the DLL.

python3 -I -c "import pefile,sys; p=pefile.PE(sys.argv[1]); [print(e.name) for e in p.DIRECTORY_ENTRY_EXPORT.symbols]" mpsvc.dll

The signed msmpeng.exe resolves mpsvc.dll from its own directory rather than from System32, so the attacker’s copy is loaded in its place. That is DLL hijacking through the search order.

Note: reasoned from the Defender binary plus a same-folder DLL, not read from an artifact. The sideload is often labelled DLL Side-Loading (T1574.002), but HTB accepted the search-order sub-technique.

Impact

List mpsvc.dll’s PE resources with pefile and pull resource 10/101. It is AES-256-CBC encrypted, with the 32-byte key stored as the first 32 bytes of the blob and the 16-byte IV as the next 16. Decrypt it statically; the config is JSON-like and its fileExtensions field lists the targets in storage order.

python3 -I -c "import pefile,sys; p=pefile.PE(sys.argv[1]); [print(r.id) for r in p.DIRECTORY_ENTRY_RESOURCE.entries]" mpsvc.dll

The extension appended to encrypted files is not in the config. It is a 6-byte string, 23b63f4c2973, XOR-decoded at runtime in the function at 0x180004f80 with an 8-byte key 0x656173452549d30d. Decode it offline.

objdump -d --start-address=0x180004f80 --stop-address=0x180005040 mpsvc.dll

Command and Control

The server name is another XOR-obfuscated string in the DLL, at 0x18004e390, with a dword (0x9896dfb0) and byte (0x1f) tail and an 8-byte key 0x91219b1ff7f5f1d5. strings finds nothing, so decode it by hand from the data section.

objdump -s --start-address=0x18004e390 --stop-address=0x18004e3c0 mpsvc.dll

Once the config from Q7 is decrypted, its html_content field is the ransom note. The note points victims to the group’s customer-service portal on a Tor onion address with a port.

grep -o 'html_content.*' cfg.bin

Attack Summary

Phase	Action
Execution	Dropper JS decodes redbadger.webp and a PowerShell stage
Privilege Escalation	stage1.ps1 checks for the local Administrators SID
Privilege Escalation	CMSTP INF run through cmstp.exe /au bypasses UAC
Defense Evasion	Defender exclusions set; Defender engine binary and DLL hidden in ADS
Execution	Signed msmpeng.exe sideloads mpsvc.dll, entry via its export
Defense Evasion	Three anti-debug checks and XOR-obfuscated strings in the DLL
Command and Control	Payload contacts its C2 FQDN; ransom note points to an onion portal
Impact	Files matching the configured extensions are encrypted and renamed

IOCs

Type	Value
MD5 (first dropped file)	2c92c3905a8b978787e83632739f7071
File	defenderscan.js, stage1.ps1, msmpeng.exe, mpsvc.dll
Domain	api[.]ltchealthcare[.]co
Onion portal	yrwm7tdvrtejpx7ogfhax2xuxkqejp2qjb634qwwyoyabkt2eydssrad[.]onion:9001
Encrypted extension	.evil

MITRE ATT&CK

Technique	ID	Description
Command and Scripting Interpreter: JavaScript	T1059.007	The dropper is defenderscan.js
Command and Scripting Interpreter: PowerShell	T1059.001	Base64-decoded stage1.ps1
System Binary Proxy Execution: CMSTP	T1218.003	cmstp.exe /au with a crafted INF to elevate
Impair Defenses: Disable or Modify Tools	T1562.001	Defender exclusions added by the PowerShell stage
Hijack Execution Flow: DLL Search Order Hijacking	T1574.001	Signed msmpeng.exe loads the malicious mpsvc.dll
Obfuscated Files or Information	T1027	XOR strings and an AES-encrypted config
Debugger Evasion	T1622	Three anti-debugging checks in the DLL
Data Encrypted for Impact	T1486	Files with the configured extensions are encrypted
Application Layer Protocol: Web Protocols	T1071.001	Payload talks to its C2 host

Defender Takeaways

A signed Microsoft binary running from a user-writable folder is the sideload tell. msmpeng.exe launching from outside the Defender install path, or loading mpsvc.dll from its own directory, is detectable with image-load telemetry. Alert on Defender component names outside ProgramData\Microsoft\Windows Defender and Program Files.

Alternate data streams hid the real payload. The binary and DLL lived as streams on a script file, so a listing of the folder showed only the dropper. Hunt for executables with ADS and for process creation paths containing a colon.

cmstp.exe /au should be rare. CMSTP with an INF argument from a script host has almost no legitimate use on endpoints. Block or alert on it and on any process that adds Defender exclusions.

Static triage was enough here. Obfuscated strings, an AES-encrypted config with its key stored in front of it, and the sideload chain were all recoverable without detonation, so the IOCs here can reach detection tooling quickly.

Conclusion

The ransomware layered a script dropper, a UAC bypass, a signed Defender binary and a hidden DLL, then kept its targets, C2 and ransom note encrypted in one resource. Every stage was recoverable statically, and the sharpest detection points were the sideload and the CMSTP call, not the encryption itself.