Happy Grunwald contacted the sysadmin, Alonzo, because of issues he had downloading the latest version of Microsoft Office. He had received an email saying he needed to update, and clicked the link to do it. He reported that he visited the website and solved a captcha, but no office download page came back. Alonzo, who himself was bombarded with phishing attacks last year and was now aware of attacker tactics, immediately notified the security team to isolate the machine as he suspected an attack. You are provided with network traffic and endpoint artifacts to answer questions about what happened.
A phishing email sent the user to a fake Office update page that dressed a clipboard-poisoning trick up as a captcha. Solving it copied a PowerShell one-liner to the clipboard, and the page coached the user into pasting it into the Windows Run dialog. The one-liner pulled a stager from the attacker’s web server and ran it in memory, and the stager opened a reverse shell back to the same host on a non-standard port. The shell stayed up for a few minutes before the machine was isolated. The Run dialog’s MRU list on the endpoint and the HTTP and TCP streams in the capture cover the whole chain.
NTUSER.DAT with regipytsharkGotcha:
tshark --export-objects httpcan truncate bodies when segments arrive out of order or overlap. Hash anything that matters from the reassembled TCP payload, not from the exported file.
The victim reached one web server over plain HTTP, and the reconstructed C2 address from the endpoint side (Q1) is the same host. Follow the TCP stream for the captcha page request and dump the server’s payload. The HTML comes back gzip-compressed, so grepping the raw stream finds nothing readable. Reassemble the segments, decompress, and search the page script for clipboard. The function that writes the command into the clipboard is the one that holds the payload.
tshark -r capture.pcap -Y 'ip.addr==43.205.115.44 && http' -T fields -e frame.number -e http.request.uritshark -r capture.pcap -Y 'tcp.stream==<captcha stream> && ip.src==43.205.115.44' -T fields -e tcp.payloadGotcha: Grepping the exported HTTP object or the raw hex for the function name returns nothing because the body is compressed. Decompress it first.
Text pasted into the Run dialog is recorded in the RunMRU key under Software\Microsoft\Windows\CurrentVersion\Explorer in the user’s NTUSER.DAT. Parse the hive with regipy and walk the subkeys. A get_key call with a full path failed on this hive, but recurse_subkeys found the key. The most recent entry holds the full cradle: a hidden, non-interactive, execution-policy-bypassing PowerShell that runs DownloadString through IEX.
python3 -I -c "from regipy.registry import RegistryHive; r=RegistryHive('NTUSER.DAT'); [print(s.path, v.name, v.value) for s in r.recurse_subkeys(as_json=False) if 'RunMRU' in s.path for v in s.iter_values()]"Tip: A pasted Run command is stored with a trailing
\1marker. The MRU order value (MRUList) tells you which entry was the latest.
The RunMRU key’s last write time is the moment the last command was submitted from the Run dialog. Only one command was ever run from there, so the key timestamp is the execution time. regipy reports registry times in UTC.
python3 -I -c "from regipy.registry import RegistryHive; r=RegistryHive('NTUSER.DAT'); [print(s.path, s.header.last_modified) for s in r.recurse_subkeys(as_json=False) if 'RunMRU' in s.path]"The script from Q1 was served over HTTP, so the capture holds the complete file. Filter to the attacker host, find the request for the stager, and rebuild the response body from the tcp.payload of the server’s packets, stripping the HTTP headers. The body is 1355 bytes. Hash that.
tshark -r capture.pcap -Y 'ip.addr==43.205.115.44 && http' -T fields -e frame.number -e http.request.uri -e http.response.codesha256sum office2024install.ps1Gotcha:
tshark --export-objects http,out/wrote only 1199 of the 1355 bytes, so its hash is wrong. Rebuilding fromtcp.payloadgives the full body.
The stager from Q3 carries a base64 payload that builds the reverse shell, and it names the callback port. The capture agrees: the TCP conversation table shows a second long-lived connection from the victim to the same attacker address, on a port other than 80.
tshark -r capture.pcap -q -z conv,tcpFrom Q4 we know which TCP stream to look at. The Duration column of the conv,tcp table for that conversation gives the connection lifetime, reported to two decimals. Round it to whole seconds.
tshark -r capture.pcap -q -z conv,tcp,ip.addr==43.205.115.44Gotcha: The conversation table lists the 80/tcp download streams too. Read the row for the reverse shell port, not the HTTP ones.
| Phase | Action |
|---|---|
| Initial Access | Phishing email links the user to a fake Office update page |
| Initial Access | Fake captcha script copies a PowerShell one-liner to the clipboard |
| Execution | User pastes it into the Run dialog; the command is stored in RunMRU |
| Execution | One-liner fetches office2024install.ps1 over HTTP and runs it in memory with IEX |
| Command and Control | Stager opens a reverse shell to the attacker host on port 6969 |
| Command and Control | Shell stays connected for about 403 seconds |
| Type | Value |
|---|---|
| IP (staging and C2) | 43[.]205[.]115[.]44 |
| URL | hxxp[://]43[.]205[.]115[.]44/office2024install[.]ps1 |
| File | office2024install.ps1 (1355 bytes) |
| SHA256 | 579284442094e1a44bea9cfb7d8d794c8977714f827c97bcb2822a97742914de |
| Port | 6969/tcp (reverse shell) |
| Registry | NTUSER.DAT Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU |
| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Link | T1566.002 | Email linking to the fake Office update site |
| User Execution: Malicious Copy and Paste | T1204.004 | Fake captcha puts the payload on the clipboard and the user pastes it into Run |
| Command and Scripting Interpreter: PowerShell | T1059.001 | Hidden, policy-bypassing PowerShell cradle with IEX |
| Ingress Tool Transfer | T1105 | Stager downloaded over HTTP |
| Non-Standard Port | T1571 | Reverse shell on 6969/tcp |
The Run dialog is an execution surface, and RunMRU is its record. A hidden powershell with -Exec Bypass and DownloadString in RunMRU is a one-key triage win on any suspected paste-and-run attack. Hunt for it fleet-wide, and alert on PowerShell whose parent is explorer.exe with those flags.
Clipboard-paste lures defeat the usual download controls. Nothing is downloaded by the browser, so mail and web filtering see only a captcha page. Restricting the Run dialog and PowerShell for standard users, or enforcing Constrained Language Mode, blocks the paste step, and user awareness training should name this lure specifically.
Plain HTTP to a bare IP is a cheap detection. Both the stager download and the shell went to an IP with no domain. Block or alert on outbound HTTP to raw IPs, and on long-lived outbound connections to unusual high ports such as this one.
Hash from reassembled streams, not export helpers. Extraction features can silently truncate bodies and give a plausible but wrong hash. Rebuild from TCP payload, or confirm size and hash against a second method, before putting an IOC in a report.
The attacker got a shell for several minutes with no malware on disk. A pasted command, a script run in memory and one outbound connection were enough, and the Run dialog history was the quickest way to see what happened.