OpTinselTrace-3

Scenario

Oh no! Our IT admin is a bit of a cotton-headed ninny-muggins, ByteSparkle left his VPN configuration file in our fancy private S3 location! The nasty attackers may have gained access to our internal network. We think they compromised one of our TinkerTech workstations. Our security team have managed to grab you a memory dump - please analyse it and answer the questions! Santa is waiting…

Executive Summary

Attackers who obtained a leaked VPN configuration reached a TinkerTech workstation, where a zip archive copied from an internal SMB share was unpacked on the desktop. A shortcut in the archive launched a VBScript, which started PowerShell running a heavily obfuscated downloader. The downloader fetched a disguised image from an attacker-hosted web server, and the resulting executable pulled shellcode over a second channel and injected it into a running service host, establishing command and control. With that foothold the operator cleared every event log, excluded a public folder from Defender, and brought in a renamed Sysinternals tool to dump credential material from the security authority process. The whole chain was recovered from a single memory image.

Artifacts

• Memory image: santaclaus.bin → analyse with Volatility 3 (windows.pstree, windows.cmdline, windows.filescan, windows.netscan, windows.pslist --dump)
• Strings of the image: strings -a and strings -el output → search for PowerShell, VBScript and command-line fragments the plugins miss

Tip: Run strings -a and strings -el over the image once and grep the output for everything after Q1. The PowerShell and command-line fragments the plugins miss are all in there.

Initial Access

windows.filescan shows an archive sitting in the user’s Desktop folder, and windows.netscan has SMB traffic to 192.168.68.5:445, an internal file server. A zip on the desktop plus a live SMB connection to a peer is the pairing that says it was copied from a share. The same directory holds the files for the rest of the chain.

vol -f santaclaus.bin windows.filescan | grep -i desktop

vol -f santaclaus.bin windows.netscan | grep 445

Execution

Searching the filescan output and the dump strings for files next to the archive turns up a shortcut named like a gift. A shortcut is the natural trigger for a user-opened archive, and the next question confirms it launches the script.

strings -a santaclaus.bin > sall.txt

grep -i "click_for_present" sall.txt | head

The strings carry a cscript command line pointing into the extracted present_for_santa directory. The shortcut hands a VBScript to the Windows Script Host, so the script name is the target of that command.

grep -i "cscript" sall.txt | head

cscript.exe is what runs the VBScript, not what the script launches. The script hands the next stage to PowerShell, which also matches the obfuscated script blocks and host application strings recovered from memory in Q5.

vol -f santaclaus.bin windows.pstree

vol -f santaclaus.bin windows.cmdline | grep -i powershell

Gotcha: cscript.exe is the obvious name in the process list, but it is the interpreter for present.vbs, the stage before the one asked about.

The PowerShell script blocks in memory are wrapped in an obfuscation function whose name appears in the strings. The payload text is padded so that only every seventh character is real. A short Python decoder that keeps every 7th character recovered the plaintext, including the function name and the download URL used in Q6.

strings -a -el santaclaus.bin > s16.txt

python3 -I dec.py

Command and Control

The decoded WrapPresent script contains a web request for a .jpg. It is not an image: it is the executable that Q7 disassembles. The path is /destroy_christmas/, hosted on a bare IP.

python3 -I dec.py | grep -i http

Dump the downloaded executable by PID from the process list, then disassemble it. The loader calls htons with 0x1bd, which is 445, on the same IP as Q6. The shellcode is pulled from there. windows.netscan also shows a live connection to that IP on 447, which is the command and control session after injection, not the download.

vol -f santaclaus.bin windows.pslist --pid 3248 --dump

objdump -d pid.3248.0x*.exe | grep -B5 -A5 0x1bd

Gotcha: The port that netscan shows for this IP (447) is the C2 channel. The download port only appears in the loader’s code as the htons argument.

Defense Evasion

windows.netscan lists an svchost.exe holding the connection to 77.74.198.52:447. A service host with an outbound session to an external IP on a nonstandard port is the injection target, and its PID is the owner column in that row. This was read from the network owner rather than from the injection API call in the loader, so it is reasoned from the C2 connection rather than read from the injection call.

Note: Reasoned, not read straight from an artifact: the PID comes from the svchost.exe owner of the C2 connection in netscan.

vol -f santaclaus.bin windows.netscan | grep 77.74.198.52

The PowerShell HostApplication strings in memory include the operator’s one-liner, which enumerates every log with Get-EventLog -List and clears each by name.

grep -i "Clear-EventLog" sall.txt | head

Search the strings for Add-MpPreference. The -ExclusionPath argument is the folder, one that any user can write to.

grep -i "Add-MpPreference" sall.txt | head

Credential Access

The tool the operator ran is called PresentForNaughtyChild.exe, but its command line (-ma lsass.exe) is procdump syntax, and the binary is Sysinternals procdump. The ingressed file kept the original name of that tool before it was renamed.

grep -i "PresentForNaughtyChild" sall.txt | head

Note: Reasoned rather than read from the binary. The identification rests on the command-line switches and the renamed binary behaving as procdump; the PE original-name field was not extracted.

The recovered command line passes -ma with a process name, a full memory dump of the security authority process, which is how credentials are lifted from memory.

grep -i "\-ma " sall.txt | head

Attack Summary

Phase	Action
Initial Access	Archive copied from an internal SMB share to the desktop
Execution	Shortcut launches a VBScript through cscript
Execution	VBScript starts PowerShell with an obfuscated downloader
Command and Control	Downloader fetches a disguised image that is really an executable
Command and Control	Executable pulls shellcode from the attacker server and injects it into a service host
Defense Evasion	All event logs cleared with Clear-EventLog
Defense Evasion	Public folder excluded from Defender
Credential Access	Renamed procdump dumps the LSASS process

IOCs

Type	Value
File	present_for_santa.zip
File	click_for_present.lnk
File	present.vbs
File	PresentForNaughtyChild.exe (renamed procdump)
URL	hxxp[://]77[.]74[.]198[.]52/destroy_christmas/evil_present[.]jpg
IP:Port	77[.]74[.]198[.]52:445 (shellcode), 77[.]74[.]198[.]52:447 (C2)
Obfuscation function	WrapPresent
Defender exclusion	C:\users\public

MITRE ATT&CK

Technique	ID	Description
User Execution: Malicious File	T1204.002	Shortcut inside a copied archive
Command and Scripting Interpreter: Visual Basic	T1059.005	present.vbs run by cscript
Command and Scripting Interpreter: PowerShell	T1059.001	Obfuscated downloader
Obfuscated Files or Information	T1027	WrapPresent padding scheme
Ingress Tool Transfer	T1105	Executable disguised as a .jpg
Process Injection	T1055	Shellcode injected into svchost.exe
Indicator Removal: Clear Windows Event Logs	T1070.001	Clear-EventLog across all logs
Impair Defenses: Disable or Modify Tools	T1562.001	Defender path exclusion
OS Credential Dumping: LSASS Memory	T1003.001	procdump -ma lsass.exe

Defender Takeaways

Alert on archives copied from SMB shares and opened from the desktop. The chain starts with a file pulled over SMB and a shortcut inside it. Block .lnk execution from user-writable extracted paths, or flag cscript and wscript launched by a shortcut.

Log PowerShell script blocks. The downloader only existed in the clear after decoding, and the useful strings were in memory. Script block and module logging shipped off-host would have exposed the URL without a memory capture.

Treat Add-MpPreference -ExclusionPath as a high-severity event. A public, world-writable folder in the exclusion list gives the operator a place to run tools unscanned. Enable Defender tamper protection and alert on exclusion changes.

Clearing every log is a detection in itself. Clear-EventLog across the full list, and Security event 1102, should page someone, and only holds up if logs are forwarded before the wipe.

Rename does not hide procdump from behaviour rules. Detect LSASS access with dump-style access masks regardless of the binary name, and enable LSA protection.

Conclusion

A shortcut in a share-delivered zip became an injected C2 implant, a blinded Defender and an LSASS dump, with each stage visible in memory even after the logs were wiped. The sharpest lesson is that the renamed tools and padded scripts hid names but not behaviour.