TickTock

Scenario

In this Sherlock, you find yourself investigating a potential spear-phishing attack against Forela. Gladys, a new employee, has received an email supposedly from the IT department, asking her to provide them with remote access to her PC for maintenance. Unbeknownst to Gladys, the ‘IT team’ is in reality a group of hackers posing as internal staff to infiltrate Forela’s systems. Your mission is to assess the nature and extent of this attempted attack, identify any potential breaches in security that may have occurred, and establish defensive measures to prevent such occurrences in the future. This challenge will test your ability to analyze communication trails, spot phishing tactics, and effectively investigate a complex attack.

Executive Summary

An attacker posing as IT support convinced a new employee to open a TeamViewer session, and the remote operator used it to drop tooling on the desktop. A Merlin C2 agent was launched and called back to an external host over HTTP, and Defender flagged it as a known post-exploitation tool. A PowerShell script delivered through the same session rewrote the system clock repeatedly, which skews timestamps across the event logs. Finally, an encoded PowerShell command tried to enable BitLocker on the system drive with an attacker-chosen PIN. The whole chain is recoverable from the TeamViewer log, Sysmon, Defender and Security events, with Amcache supplying the binary’s SHA1.

Artifacts

• Windows event logs: Collection/C/Windows/System32/winevt/logs → parsed with EvtxECmd into CSV, then filtered with Python. Sysmon, Defender, PowerShell and Security channels are all present
• TeamViewer logs: TeamViewer15_Logfile.log and TVNetwork.log → read with grep. Plain text, local-time stamps
• Amcache: Amcache.hve → AmcacheParser
• SYSTEM hive: read with regipy for the time zone setting

Timestamp note: The attacker moved the system clock, so the record time of an event and the UtcTime field Sysmon writes inside it can disagree. Q8 wants the TeamViewer log timestamp as written, with no time zone shift, in DD/MM/YYYY HH:mm:ss.

Initial Access

The lure was a request for remote access, so the TeamViewer log is the first place to look. When the remote operator joins, the log records the participant being added with their display name, which is the identity the attacker presented to Gladys.

grep -i "was added" TeamViewer15_Logfile.log

The same log records the inbound connection. The IncomingConnection line carries a sessionID field, and it is a negative number, which matches the format hint.

grep -i "IncomingConnection" TeamViewer15_Logfile.log

The IncomingConnection line from Q2 carries the start time, 2023/05/04 11:35:27 in the log. The question says UTC, but the answer is that log value reordered to day, month, year with no offset applied. TVNetwork.log was read as a cross-check, and the SYSTEM hive’s TimeZoneInformation was checked for the local offset.

grep -i "IncomingConnection" TeamViewer15_Logfile.log

Gotcha: Subtracting the one-hour local offset to get “real” UTC gives a value that is not accepted. Submit the TeamViewer log time as it is written.

Execution

Parse the whole log directory once with EvtxECmd, then filter Sysmon Event ID 1 (process creation) for executables running from user-writable paths. merlin.exe stands out on Gladys’s desktop, and the name matches the Merlin C2 framework agent. Defender’s detection on the same file (Q6) agrees.

EvtxECmd -d evidence/Collection/C/Windows/System32/winevt/logs --csv work/evtx

Defense Evasion

Search the parsed events for .ps1 file names. Sysmon Event ID 11 (file create) shows TeamViewer.exe writing the script to the desktop, which ties it to the remote session from Q2 rather than to a local user action.

grep -i "\.ps1" work/evtx/*.csv

A system clock change is logged as Security Event ID 4616, with the changing process in the event. Count the 4616 events where powershell.exe is the process. One 4616 record has a corrupted process name; it is not a countable PowerShell change.

grep -c "4616" work/evtx/*Security*.csv

Gotcha: Counting every 4616 event includes the record with the garbled process name and overshoots by one. Count only the ones that name powershell.exe.

The same 4616 events hold the account that changed the time. SubjectUserSid for gladys is the victim’s SID. It ends in 1003, matching the format hint.

grep -i "4616" work/evtx/*Security*.csv

Command and Control

Sysmon Event ID 3 (network connection) filtered on merlin.exe shows one outbound destination on port 80.

grep -i "merlin" work/evtx/*.csv | grep -i "52\."

Defender Event IDs 1116 (detected) and 1117 (action taken) name the threat for the C2 agent. The Threat Name field holds the family string; Defender’s own category for it is Tool.

grep -E "1116|1117" work/evtx/*Defender*.csv

Two artifacts split the work. Amcache has the SHA1 for the executable, and the Sysmon Event ID 1 hashes for merlin.exe give the SHA256. The answer is SHA1:SHA256, with the SHA256 in lowercase.

AmcacheParser -f Amcache.hve --csv work/amc

Impact

Sysmon Event ID 1 includes a powershell.exe -e command line. Decode the Base64 (UTF-16LE) payload: it calls Enable-BitLocker -MountPoint "C:" with a -Pin, and the PIN is the password asked for.

grep -i "powershell" work/evtx/*Sysmon*.csv | grep -i " -e"

Attack Summary

Phase	Action
Initial Access	Phishing lure convinces Gladys to allow a TeamViewer session
Initial Access	Remote operator joins the session
Execution	merlin.exe and Invoke-TimeWizard.ps1 placed on the desktop by TeamViewer.exe
Command and Control	Merlin agent beacons to an external host over port 80; Defender flags it
Defense Evasion	PowerShell script changes the system clock thousands of times
Impact	Encoded PowerShell attempts to enable BitLocker with an attacker PIN on C:

IOCs

Type	Value
IP (C2)	52.56.142[.]81
File	merlin.exe
File	Invoke-TimeWizard.ps1
SHA1	ac688f1ba6d4b23899750b86521331d7f7ccfb69
SHA256	42ec59f760d8b6a50bbc7187829f62c3b6b8e1b841164e7185f497eb7f3b4db9
Detection	VirTool:Win32/Myrddin.D
TeamViewer session ID	-2102926010
Attacker display name	Fritjof Olfasson

MITRE ATT&CK

Technique	ID	Description
Phishing	T1566	Fake IT email asking Gladys for remote access
Remote Access Software	T1219	TeamViewer session used as the entry point
Command and Scripting Interpreter: PowerShell	T1059.001	Time-manipulation script and encoded BitLocker command
Indicator Removal	T1070	Repeated system clock changes that skew log timestamps (mapping reasoned from the behaviour, not stated by an artifact)
Application Layer Protocol: Web Protocols	T1071.001	Merlin agent calling out over port 80
Data Encrypted for Impact	T1486	Attempt to enable BitLocker on C: with an attacker PIN

Defender Takeaways

Remote-access tools are an initial access path. TeamViewer on a new employee’s workstation let an outsider in with a single approval. Allow-list approved remote tools, block the rest at the endpoint and proxy, and train new starters that IT never asks for unsolicited access.

Sysmon from a remote-tool parent is a strong signal. TeamViewer.exe creating .ps1 and .exe files on a desktop is not normal. Alert on file creation and process launches whose ancestor is a remote-access tool.

Clock changes need alerting. Security Event ID 4616 fired thousands of times from powershell.exe. A threshold alert on 4616 from any process other than the time service would catch the script early and protects the integrity of the rest of the log timeline.

Log both views of time. The record time and the UtcTime inside Sysmon events diverged once the clock moved. Forward logs to a central collector that stamps its own receipt time, so the manipulation is visible instead of silently corrupting the timeline.

Watch for BitLocker commands outside IT. An encoded Enable-BitLocker -Pin from a user session is a ransom-style lockout attempt. Alert on Enable-BitLocker in PowerShell script block and command line logs.

Conclusion

Posing as IT support got the attacker a TeamViewer session, a C2 agent and a time-warping script on one workstation, and the BitLocker PIN attempt shows lockout was the goal. Every step left a clear trail in Sysmon, Defender and Security logs; the clock manipulation is the part that makes reading them carefully matter.