// HackTheBox · writeup

OpSalwarKameez24-2: Magic-Show

HackTheBox Medium EvtxECmdPECmdMFTECmdAmcacheParserImpacket secretsdumppypykatzhashcatPython

DFIR

← sherlocks challenge page → proof of completion →

Scenario

StoreD Technologies’ System Administrators have observed several machines on the network unexpectedly rebooting to apply Windows updates during working hours. According to the organization’s update policy, these updates should only occur overnight. As a member of StoreD Technologies’ incident response team, your task is to investigate whether this unusual activity is linked to an ongoing security incident. System logs and a memory dump from one of the affected Windows 11 machines have been collected to assist in your investigation.

Executive Summary

A domain user’s credentials were used to reach a Windows 11 workstation from another internal host, first over the network and then through a remote desktop session. The actor disabled AMSI in PowerShell, ran PowerUp to hunt for local misconfigurations, and escalated by installing a service binary dropped under C:\ProgramData. As SYSTEM they created a local backdoor account, then ran a Windows Downdate tool that replaced protected system files to roll back security components, which let them bypass Credential Guard and pull domain credentials. The domain administrator’s cached logon hash sat in the SECURITY hive and cracked offline, and the backdoor account’s password fell to the same wordlist attack against the LSASS dump.

Artifacts

Windows event logs: logs/*.evtx → EvtxECmd, then filter the CSV
Prefetch: prefetch/ → PECmd
$MFT and $J: → MFTECmd
Amcache.hve: → AmcacheParser
Registry hives: SAM, SECURITY, SYSTEM → secretsdump.py -sam -security -system LOCAL
PowerShell history: ConsoleHost_history.txt for arjun.patel and Chhupa → read directly
Memory: lsass.DMP → pypykatz lsa minidump

Timestamp note: Four questions want YYYY-MM-DD hh:mm:ss in UTC. EvtxECmd already writes UTC.

Initial Access

Q1 — At what time did the compromised account first authenticate to the workstation? (UTC)

Parse every log with EvtxECmd and filter Security 4624 for STORED\arjun.patel, the account whose PSReadline history shows the attack. The earliest hit is a type 3 network logon from WORKSTATION1. Everything later hangs off that account.

EvtxECmd -d logs --csv work/evtx

grep ",4624," work/evtx/*.csv | grep -i arjun.patel | sort | head

Click flag to reveal 2024-10-22 15:25:57

Q2 — What protocol did the threat actor use to access the workstation?

The type 3 logon from Q1 is followed by a 4624 with logon type 10, RemoteInteractive, which is what Remote Desktop produces.

grep ",4624," work/evtx/*.csv | grep -i arjun.patel | grep -i "LogonType: 10"

Click to reveal answer rdp

Q3 — What was the last logon type logged when the threat actor established a remote desktop session on the workstation?

An RDP session writes several 4624 events as it connects and reconnects. Sort the actor’s 4624s by time and read the logon type on the last one.

grep ",4624," work/evtx/*.csv | grep -i arjun.patel | sort | tail

Gotcha: The question asks for the last logon logged, not the first. Reading from the top of the list gives a different type.

Click flag to reveal 10

Lateral Movement

Q4 — What was the IP address of the workstation the threat actor pivoted through to access the internal network?

The same 4624 events carry the source in RemoteHost. Both the network logon and the RDP logon come from WORKSTATION1, and its address is on the event.

grep ",4624," work/evtx/*.csv | grep -i arjun.patel | grep -oE "WORKSTATION1[^,]*|10\.10\.[0-9.]+" | sort -u

Click to reveal answer 10.10.0.81

Defense Evasion

Q5 — At what time did the threat actor first attempt to bypass a feature of Windows Defender? (UTC)

Filter PowerShell script block events (4104) for arjun.patel. The earliest interesting block sets amsiInitFailed through reflection, the classic AMSI bypass and the first attempt to defeat a Defender feature.

grep ",4104," work/evtx/*.csv | grep -i amsiInitFailed | sort | head -1

Click flag to reveal 2024-10-22 21:49:29

Q10 — What is the original name of the exploit binary the threat actor used to bypass several Windows security features?

Prefetch shows a DD.EXE with nine recorded runs, which marks a renamed binary. strings against it exposes module names from the Windows Downdate project, so the original name is that tool’s executable.

PECmd -d prefetch --csv work/pf

strings -a dd.exe | grep -i downdate

Click to reveal answer windows_downdate.exe

Q11 — What time did the threat actor first run the exploit? (UTC)

Read the DD.EXE prefetch row. Prefetch keeps only the last eight run times and this file recorded nine runs, so the oldest retained timestamp is the earliest run the artifact can prove. Amcache and the MFT were checked as well and agree the binary arrived earlier.

PECmd -f prefetch/DD.EXE-*.pf

Gotcha: Amcache first-seen and the .pf creation time both land near 22:02, but the wanted value is the earliest run time stored inside the prefetch file.

Click flag to reveal 2024-10-22 22:31:43

Q12 — Which account owns the files manipulated by the exploit?

This one was reasoned rather than read straight from an artifact. The tool’s config.xml targets securekernel.exe, a protected system file, and files of that kind are owned by TrustedInstaller. The format mask (15 letters ending in r) fits that name too.

Click to reveal answer TrustedInstaller

Q13 — The threat actor managed to exfiltrate some domain credentials, which Windows security feature did they bypass using the exploit?

Also reasoned rather than read from a single artifact. The tool replaces securekernel.exe, the secure kernel behind virtualization-based protection of LSASS secrets, and the logs show Device Guard state being queried. Rolling that component back defeats the feature shielding the domain credentials.

Click flag to reveal Credential Guard

Discovery

Q6 — What is the name of the tool the threat actor used to enumerate the workstation for misconfigurations?

The PSReadline history for the compromised account shows PowerUp.ps1 being loaded and Invoke-AllChecks run.

cat ConsoleHost_history.txt

Click to reveal answer PowerUp

Privilege Escalation

Q7 — What is the name of the executable the threat actor used to elevate their privileges?

Parse the $MFT and look at files created between the PowerUp run and the account creation. C:\ProgramData\Light.exe appears at 21:51:16 and is registered as the binary of a service, which runs as SYSTEM.

MFTECmd -f '$MFT' --csv work/mft

grep -i light work/mft/*.csv | head

Click flag to reveal light.exe

Persistence

Q8 — At what time did the new user get created? (UTC)

Security 4720 records account creation. The new account is Chhupa, created about a minute after the service binary appeared, and the creator is the computer account WORKSTATION9$.

grep ",4720," work/evtx/*.csv

Click to reveal answer 2024-10-22 21:52:24

Q9 — What was the SID of the user that created the new user?

The same 4720 event holds SubjectUserSid. A computer account as creator fits the SYSTEM-level service from Q7.

grep ",4720," work/evtx/*.csv | grep -oE "S-1-5-[0-9-]+" | sort -u

Click flag to reveal S-1-5-18

Q15 — What is the password set by the threat actor for their generated user?

Pull the NT hash for Chhupa out of lsass.DMP with pypykatz, then crack it with hashcat mode 1000 against rockyou.

pypykatz lsa minidump lsass.DMP > work/pk.txt

hashcat -m 1000 hash.txt /usr/share/dict/rockyou.txt

Click flag to reveal Password123

Credential Access

Q14 — What is the NT hash of the domain administrator compromised by the Threat Actor?

The domain administrator is not in the LSASS dump. The credential is a cached domain logon (DCC2) in the SECURITY hive. Run secretsdump on the hives, crack the DCC2 entry with hashcat mode 2100 against rockyou, then take the MD4 of the recovered password to get the NT hash.

secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL

hashcat -m 2100 dcc.txt /usr/share/dict/rockyou.txt

Gotcha: The DCC2 value is not the NT hash. The NT hash is the MD4 of the cracked password.

Click to reveal answer ae974876d974abd805a989ebead86846

Attack Summary

Phase	Action
Initial Access	`arjun.patel` authenticates to the workstation over the network from `WORKSTATION1`
Lateral Movement	RDP session (logon type 10) pivoting through `10.10.0.81`
Defense Evasion	AMSI bypass in PowerShell
Discovery	PowerUp `Invoke-AllChecks` against the workstation
Privilege Escalation	Service binary dropped in `C:\ProgramData` and run as SYSTEM
Persistence	Local account `Chhupa` created by SYSTEM
Defense Evasion	Windows Downdate tool renamed `dd.exe` replaces protected files, bypassing Credential Guard
Credential Access	Domain admin cached logon hash cracked from the SECURITY hive; backdoor password cracked from LSASS

Forensic Timeline

Timestamp (UTC)	Event
2024-10-22 15:25:57	First network logon for `arjun.patel` from `WORKSTATION1`
2024-10-22 21:49:29	First AMSI bypass script block
2024-10-22 21:51:16	`Light.exe` created in `C:\ProgramData`
2024-10-22 21:52:24	Account `Chhupa` created by SYSTEM
2024-10-22 22:31:43	Earliest retained run of `dd.exe`

IOCs

Type	Value
Pivot host	`WORKSTATION1` (`10.10.0[.]81`)
Compromised account	`STORED\arjun.patel`
Backdoor account	`Chhupa`
File	`C:\ProgramData\Light.exe`
File	`dd.exe` (renamed Windows Downdate)
Tool	`PowerUp.ps1`

MITRE ATT&CK

Technique	ID	Description
Valid Accounts: Domain Accounts	T1078.002	Domain user `arjun.patel` used for access
Remote Services: Remote Desktop Protocol	T1021.001	Type 10 logon through `WORKSTATION1`
Impair Defenses: Disable or Modify Tools	T1562.001	AMSI disabled via `amsiInitFailed`
Command and Scripting Interpreter: PowerShell	T1059.001	PowerUp and the AMSI bypass
Create or Modify System Process: Windows Service	T1543.003	`Light.exe` run as a SYSTEM service
Create Account: Local Account	T1136.001	`Chhupa` created
Impair Defenses: Downgrade Attack	T1562.010	Windows Downdate rolling back protected components
OS Credential Dumping: LSASS Memory	T1003.001	NT hash of the backdoor account from `lsass.DMP`
OS Credential Dumping: Cached Domain Credentials	T1003.005	Domain admin DCC2 in the SECURITY hive

Defender Takeaways

Forced reboots during working hours were the first visible symptom. Windows Downdate works by staging an update and rebooting. Alert on unscheduled update-driven restarts and on component servicing outside the maintenance window.

AMSI tampering is loud if script block logging is on. The amsiInitFailed string appears verbatim in 4104 events. A detection on that string would have flagged the intrusion well before the downgrade tool ran.

Cached domain credentials turn one workstation into a domain compromise. The administrator’s logon was cached in the SECURITY hive and fell to a wordlist. Lower the cached logon count and keep domain admin off ordinary workstations.

Credential Guard is only as strong as the files that back it. The actor replaced protected system files owned by TrustedInstaller. Monitor changes to securekernel.exe and the Device Guard state.

Prefetch holds eight run times. A tool that ran nine times lost its first execution, so corroborate with Amcache, the MFT and the USN journal before settling a timeline.

Conclusion

A single domain account reached the workstation over RDP, climbed to SYSTEM with a service binary and used a downgrade attack to switch off Credential Guard, ending with a domain administrator hash recovered offline. The early AMSI bypass and the unplanned reboots were the visible warnings, and neither was acted on.