OpTinselTrace-1

Scenario

An elf named “Elfin” has been acting rather suspiciously lately. He’s been working at odd hours and seems to be bypassing some of Santa’s security protocols. Santa’s network of intelligence elves has told Santa that the Grinch got a little bit too tipsy on egg nog and made mention of an insider elf! Santa is very busy with his naughty and nice list, so he’s put you in charge of figuring this one out. Please audit Elfin’s workstation and email communications.

Executive Summary

An outside contact approached a Santa’s Workshop employee over personal email and, over about a day, talked him into handing over protected delivery files. The employee used a desktop mail client, discussed meeting in person, and staged the files in a hidden folder under his profile before sending them out as an email attachment. Browser history shows him searching for ways around work security and reading CIA sabotage guidance beforehand, then searching for a country to flee to the morning after. An unsent apology draft sits in the mailbox. The local account password fell to a SAM and SYSTEM hive dump followed by a wordlist attack.

Artifacts

• Collection archive: elfidence_collection.7z → extract with 7z. Holds the user’s profile, the registry hives and the $MFT
• eM Client store: AppData\Roaming\eM Client\ → mail_data.dat is SQLite, message bodies sit in LocalMailContents blobs and need decoding
• Chrome profile: History → sqlite3
• $MFT: → MFTECmd
• Registry hives: SAM and SYSTEM → secretsdump in LOCAL mode

Timestamp note: Mail times come from the Date header of each message. Task formats vary between YYYY-MM-DD hh:mm:ss and a combined name, date string, so check the mask before copying.

Discovery

The profile has an eM Client folder under AppData\Roaming. The same product name shows up as the eM_Client/9.2.2157.0 User-Agent in the message headers, so the client is confirmed from two places.

7z x evidence/elfidence_collection.7z -owork/x

eM Client keeps its index in mail_data.dat, but the readable message content is in LocalMailContents blobs that a plain query won’t show. A short Python decoder dumps every message to text. The Gmail address sending to Elfin in the earliest thread is the outside contact.

sqlite3 mail_data.dat ".tables"

python3 -I dump_mail.py LocalMailContents/ > work/mails_clean.txt

From Q2 we have the sender address. Sort that sender’s messages by their Date header and take the oldest, a short opener titled “Hi there x”. The header date is the answer.

grep -n -B2 -A6 'definitelynotthegrinch' work/mails_clean.txt | head -40

Search the decoded mail for the word “boss”. The messages that refer to a boss come from a Yahoo address, [email protected], and that sender’s name gives the answer.

grep -i -n 'boss' work/mails_clean.txt

Later messages from the outside contact carry a different display name in the From header. The first one is dated 2023-11-28 10:00:21 and is the reply to Elfin’s message about the binaries, from Wendy Elflower.

grep -n '^From:' work/mails_clean.txt | sort | uniq -c

Gotcha: The answer format wants the name and the date joined by a comma and a space, not two separate values.

Collection

Read Elfin’s sent messages in time order. At 2023-11-28 09:56:11 he replies in the thread titled “Re: work” saying he has access to Santa’s special binaries. That is the first mention, and the next message from the contact (Q6) answers it.

grep -i -n -B6 'binaries' work/mails_clean.txt

Parse the $MFT and look up the archive named in Q11. ParentPath gives the full directory, which sits under AppData\Roaming rather than a normal user folder.

MFTECmd -f '$MFT' --csv work/mft

grep -i 'santa_deliveries' work/mft/*.csv

Same $MFT row as Q13. Use the $STANDARD_INFORMATION created time for the file, 2023-11-28 17:01:29.2753913, truncated to seconds for the format mask. It lands five minutes after Elfin offered to send the files (Q8).

MFTECmd -f '$MFT' --csv work/mft

Gotcha: The folder holds both the archive and what was unpacked from it. The question reads as the file Elfin sent, so use the zip’s own created time.

Exfiltration

In the decoded thread Elfin proposes a venue for an in-person meeting. The bar’s name is in his message body.

grep -i -n -E 'bar|meet' work/mails_clean.txt

After the contact pushes (“can’t wait any longer”), Elfin answers “you want me to send them to you??”. The Date header of that reply is the offer.

grep -i -n -B8 'send them to you' work/mails_clean.txt

The sent message that follows the offer carries one attachment. The attachment filename matches the file in the top-secret folder found in Q13.

grep -i -n -E 'attachment|filename|\.zip' work/mails_clean.txt

Back in Chrome, pull the searches from the morning after the transfer. Between 09:42 and 09:43 on 2023-11-29 Elfin searches for the country he plans to leave for.

sqlite3 History "select datetime(u.last_visit_time/1000000-11644473600,'unixepoch'), k.term from keyword_search_terms k join urls u on u.id=k.url_id order by 1"

Unsent mail lives in the drafts folder of the eM Client store. The draft titled “I can’t do this anymore santa” is addressed to the recipient in the answer.

grep -i -n -B3 -A10 'anymore santa' work/mails_clean.txt

Defense Evasion

Chrome’s keyword_search_terms table holds the search strings and joins to urls for the visit time. Starting from 2023-11-28 17:00, the first suspicious search is at 17:06:42, a few minutes after the archive was created. The format mask gives the word lengths.

sqlite3 History "select datetime(u.last_visit_time/1000000-11644473600,'unixepoch'), k.term from keyword_search_terms k join urls u on u.id=k.url_id order by 1"

The urls table shows a visit to corporate-rebels.com/blog/cia-field-manual at 21:21 that evening. The author comes from the article page itself, which names Joost Minnaar (https://www.corporate-rebels.com/blog/cia-field-manual). This was read from the web, not from an artifact on the host.

sqlite3 History "select datetime(last_visit_time/1000000-11644473600,'unixepoch'), url from urls where url like '%cia-field-manual%'"

Credential Access

Dump the local NT hash from the SAM and SYSTEM hives offline, then crack it against rockyou with mode 1000. The hash is 529848fe56902d9595be4a608f9fbe89 and it falls to a wordlist, so the password is a plain dictionary phrase.

secretsdump.py -sam SAM -system SYSTEM LOCAL

hashcat -m 1000 nt.txt /usr/share/dict/rockyou.txt

Attack Summary

Phase	Action
Discovery	Outside contact emails Elfin from a Gmail address
Collection	Elfin says he has access to Santa’s special binaries
Discovery	Contact reappears under a new display name
Exfiltration	Elfin proposes meeting at a bar, then offers to send the files
Collection	Archive staged in a hidden folder under AppData\Roaming
Exfiltration	Archive sent to the contact as an email attachment
Defense Evasion	Searches for ways around work security
Defense Evasion	Reads CIA field manual sabotage article
Impact	Searches for a country to flee to and leaves an unsent apology draft
Credential Access	SAM and SYSTEM hives dumped and the local password cracked

Forensic Timeline

Timestamp	Event
2023-11-27 17:27:26	Contact’s first email, “Hi there x”
2023-11-28 09:56:11	Elfin mentions access to the special binaries in “Re: work”
2023-11-28 10:00:21	First email under the contact’s new name
2023-11-28 16:56:13	Elfin offers to send the files
2023-11-28 17:01:29	santa_deliveries.zip created in top-secret
2023-11-28 17:06:42	Search for ways around work security
2023-11-28 21:21	CIA field manual article visited
2023-11-29 09:42	Searches for a country to flee to begin

IOCs

Type	Value
Email (threat actor)	[email protected]
Email (boss alias)	[email protected]
Alias	Wendy Elflower
File	santa_deliveries.zip
Path	C:\Users\Elfin\AppData\Roaming\top-secret
NT hash	529848fe56902d9595be4a608f9fbe89

MITRE ATT&CK

Technique	ID	Description
Email Collection: Local Email Collection	T1114.001	Mail recovered from the local eM Client store
Data from Local System	T1005	Protected delivery files gathered from the host
Data Staged: Local Data Staging	T1074.001	Archive kept in a hidden folder under AppData\Roaming
Exfiltration Over Alternative Protocol	T1048	Archive sent out as an email attachment
OS Credential Dumping: Security Account Manager	T1003.002	NT hash read from the SAM and SYSTEM hives
Brute Force: Password Cracking	T1110.002	Hash cracked offline with rockyou

Defender Takeaways

Personal webmail on a corporate workstation is an uncontrolled exit. Elfin used a desktop client with a Gmail account and sent the stolen archive straight out. Block or proxy personal mail from sensitive hosts and alert on large attachments leaving to free mail domains.

Staging in AppData\Roaming hides in plain sight. A folder called top-secret under the roaming profile never shows up in normal user browsing. File creation monitoring on archives created in AppData followed by mail activity would have tied the two events together.

Browser history predicts the act. Searches for ways around work security and CIA sabotage guidance came after the archive was staged, and flight searches came the next morning. Insider-risk tooling that watches search and browsing signals gives a window to intervene.

Weak local passwords undo disk and account protection. The local password fell to a single wordlist pass once the hives were copied. Long, random local passwords and restricted access to SAM and SYSTEM backups limit what an investigator, or a thief, gets from a seized disk.

Conclusion

An insider handed protected delivery files to an outside contact by email within a day of the first approach, and left a complete trail in his mail client, browser and $MFT. The sharpest lesson is that the host held the whole story, from the pitch to the exit plan, and none of it was being watched while it happened.