// HackTheBox · writeup

Unit42

HackTheBox Very Easy EvtxECmdPython

DFIR

← sherlocks challenge page → proof of completion →

Scenario

In this very easy Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto’s Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.

Executive Summary

A user downloaded an executable from a consumer cloud-storage host through Firefox and ran it from Downloads. The name used a double extension, and the process spawned msiexec to install an MSI. Within about two seconds it wrote around fifteen files, including a command script under the user’s AppData, then rewrote their creation times to look months old. It made a DNS lookup and a TCP connection to a placeholder domain as an internet check, and then terminated itself, leaving the backdoored UltraVNC install behind. The whole stage is visible in one Sysmon log.

Artifacts

Sysmon Operational log: Microsoft-Windows-Sysmon-Operational.evtx (169 records) → parse with EvtxECmd, then read the CSV with Python

Gotcha: EvtxECmd puts the useful Sysmon fields in PayloadData1 to PayloadData6, and which column holds which field changes per Event ID. Print full values per EID instead of trusting a truncated view, which cuts the AppData paths and the timestomp values.

Initial Access

Q3 — Which Cloud drive was used to distribute the malware?

Sysmon EID 22 (DNS query) from firefox.exe sits just before the EID 11 that writes the malicious executable into Downloads. The queried name is a random-looking host under a cloud-storage content domain, which names the service that hosted the payload.

python3 -I work/u42.py work/evtx/*.csv

Click flag to reveal dropbox

Execution

Q1 — How many Event logs are there with Event ID 11?

Parse the EVTX to CSV first, then count records per EventId. EID 11 is FileCreate, and with 169 records in the whole log it is the dominant event type, which already says the host was busy writing files.

EvtxECmd -d evidence --csv work/evtx

python3 -I work/u42.py work/evtx/*.csv

Click flag to reveal 56

Q2 — Whenever a process is created in memory, an event with Event ID 1 is recorded with details such as command line, hashes, process path, parent process path, etc. This information is very useful for an analyst because it allows us to see all programs executed on a system, which means we can spot any malicious processes being executed. What is the malicious process that infected the victim's system?

Read the EID 1 events in time order. One stands out: an executable in the user’s Downloads folder launched by explorer.exe, with a double extension and the Sysmon rule name tagged T1204. It later spawns msiexec /i main1.msi and is the parent of the file drops and timestomping in the following questions, so it is the process to pivot on.

python3 -I work/u42.py work/evtx/*.csv

Click to reveal answer C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe

Defense Evasion

Q4 — For many of the files it wrote to disk, the initial malicious file used a defense evasion technique called Time Stomping, where the file creation date is changed to make it appear older and blend in with other files. What was the timestamp changed to for the PDF file?

EID 2 (file creation time changed) lists around fifteen files from the Q2 process. Only one is a PDF, TempFolder\~.pdf. The event carries both the new CreationUtcTime and the previous one, and the previous value is the real drop time, which makes the stomp obvious.

python3 -I work/u42b.py work/evtx/*.csv

Gotcha: Sysmon records milliseconds. The answer format wants whole seconds, so truncate the fraction and don’t round.

Click to reveal answer 2024-01-14 08:10:06

Q5 — The malicious file dropped a few files on disk. Where was "once.cmd" created on disk? Please answer with the full path along with the filename.

Two EID 11 events name once.cmd. msiexec.exe writes one copy under C:\Games, and the dropper itself writes another under its own install tree in AppData\Roaming. The question asks about the file the malicious executable dropped, so match the event by the dropper’s PID, not by the filename. The answer format with ten directory levels points the same way.

python3 -I work/u42b.py work/evtx/*.csv

Gotcha: C:\Games\once.cmd is the msiexec.exe write and is the wrong answer here. Check the Image and PID on each EID 11.

Click flag to reveal C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd

Discovery

Q6 — The malicious file attempted to reach a dummy domain, most likely to check the internet connection status. What domain name did it try to connect to?

Filter EID 22 to the dropper’s process. Its only lookup is for a placeholder domain reserved for documentation, which no real malware infrastructure would use. That makes it a connectivity check, not command and control.

python3 -I work/u42b.py work/evtx/*.csv

Click to reveal answer www.example.com

Q7 — Which IP address did the malicious process try to reach out to?

The EID 3 (network connection) from the same process follows the lookup from Q6. The DestinationIp is the resolved address of that placeholder domain.

python3 -I work/u42b.py work/evtx/*.csv

Click flag to reveal 93.184.216.34

Q8 — The malicious process terminated itself after infecting the PC with a backdoored variant of UltraVNC. When did the process terminate itself?

EID 5 (process terminated) for the Q2 executable gives the exit time. It lands about two seconds after the EID 1 start, which fits a dropper that finishes once the payload is installed.

python3 -I work/u42b.py work/evtx/*.csv

Click to reveal answer 2024-02-14 03:41:58

Attack Summary

Phase	Action
Initial Access	Firefox resolves a Dropbox content host and downloads the trojanised executable to `Downloads`
Execution	User runs the double-extension executable from `explorer.exe`
Execution	Dropper launches `msiexec /i main1.msi`
Persistence / Payload	Around fifteen files written, including `once.cmd` under `AppData\Roaming`
Defense Evasion	Creation times of the dropped files rewritten, including `~.pdf`
Discovery	DNS lookup and TCP connection to a placeholder domain as an internet check
Execution	Dropper terminates itself

Forensic Timeline

Timestamp (UTC)	Event
2024-02-14 03:41:56	Malicious executable starts (EID 1, parent `explorer.exe`)
2024-02-14 03:41:58	`~.pdf` written; this is the real creation time later overwritten
2024-02-14 03:41:58	Dropper writes `once.cmd` under `AppData\Roaming`
2024-02-14 03:41:58	Dropper terminates (EID 5)
2024-01-14 08:10:06	Forged creation time set on `~.pdf` by the timestomp

IOCs

Type	Value
File (dropper)	`C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe`
File (installed)	`main1.msi` (run via `msiexec /i`)
File (dropped)	`C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd`
Domain (delivery)	`uc2f030016253ec53f4953980a4e[.]dl[.]dropboxusercontent[.]com`
Domain (connectivity check)	`www[.]example[.]com`
IP	`93.184.216[.]34`

MITRE ATT&CK

Technique	ID	Description
User Execution: Malicious File	T1204.002	Dropper run from `Downloads` via `explorer.exe`
Masquerading: Double File Extension	T1036.007	`.exe.exe` name posing as a document
Indicator Removal: Timestomp	T1070.006	Creation times rewritten on dropped files, including `~.pdf`
System Binary Proxy Execution: Msiexec	T1218.007	`msiexec /i main1.msi`
System Network Configuration Discovery: Internet Connection Discovery	T1016.001	DNS and connection to `www.example.com` / `93.184.216.34`

Defender Takeaways

An executable launched by explorer.exe from Downloads is the first thing to look for. EID 1 with the parent process finds the infection in one pass, and the Sysmon rule name already tagged it T1204. Alert on execution from user download folders on managed hosts.

Time-stomping leaves its own event. EID 2 shows both the forged and the original creation time, and legitimate software rarely changes creation times on files it just wrote. Alert on EID 2 from non-system processes.

Pair browser DNS with the next FileCreate to name the source. The EID 22 from Firefox followed by the EID 11 into Downloads identified the cloud-storage host. Consider blocking or monitoring consumer storage downloads of executables.

Double extensions are cheap to detect. A name ending .exe.exe is a masquerade signal in itself and is worth a filename rule.

Don’t analyse Sysmon through a truncated view. The key paths and timestomp values only appear once the payload columns are shown in full.

Conclusion

The dropper went from a cloud-storage download to an installed backdoor and exit in about two seconds, and then hid its tracks by forging file dates. Sysmon recorded every step, so the case rests on reading parent processes, EID 2 and EID 22 together.