Detroit Becomes Human

Alonzo Spire is fascinated by AI after noticing the recent uptick in usage of AI tools to help aid in daily tasks. He came across a sponsored post on social media about an AI tool by Google. The post had a massive reach, and the Page which posted had 200k + followers. Without any second thought, he downloaded the tool provided via the Post. But after installing it he could not find the tool on his system which raised his suspicions. A DFIR analyst was notified of a possible incident on Forela's sysadmin machine. You are tasked to help the analyst in analysis to find the true source of this odd incident.

Hard - DFIR

Preparing our Linux environment:

Install Zimmerman tools (source)

1. What is the full link of a social media post which is part of the malware campaign, and was unknowingly opened by Alonzo spire?

Let's look at the browser history for the alonzo.spire user:

└──╼ [★]$ find . -name History
./AppData/Local/Microsoft/Edge/User Data/Snapshots/116.0.1938.69/Default/History
./AppData/Local/Microsoft/Edge/User Data/Snapshots/114.0.1823.43/Default/History
./AppData/Local/Microsoft/Edge/User Data/Snapshots/113.0.1774.35/Default/History
./AppData/Local/Microsoft/Edge/User Data/Default/History

Inside, we will find evidence that he was doing some AI-related queries through Bing. Then, he opened a Facebook post that led him to a strange Google Drive link:

The full URL inside URL #21 is our answer.

2. Can you confirm the timestamp in UTC when alonzo visited this post?

The timestamp for the visit to this URL is the second-to-last field: 13355296200136503. Using an online tool, we can transform this WebKit timestamp into UTC:

3. Alonzo downloaded a file on the system thinking it was an AI Assistant tool. What is name of the archive file downloaded?

Looking into the downloads table inside Alonzo's browser history, we will be able to see that a .rar file was downloaded from the Drive link inside the Facebook post:

4. What was the full direct url from where the file was downloaded?

The downloads_url_chains table contains our answer as the very last link:

5. Alonzo then proceeded to install the newly download app, thinking that its a legit AI tool. What is the true product version which was installed?

First, we need the parse the Windows Event Logs:

$ evtxecmd -d "/home/hiramf0/Downloads/Triage/C/Windows/System32/winevt/logs/" --csv $(pwd) --csvf evtxecmd-out
[...]

Looking inside the parsed Windows Event Logs, we can see the installation of a suspicious msi:

Let's for any other suspicious msi files installed at around the same time:

6. When was the malicious product/package successfully installed on the system?

The answer can be found inside the timestamp shown above.

Another way of finding the installed file for Q5 and Q6 would've been to use Windows Event ID 11707 (installation completed) on the day of the incident:

The timestamp stored here is the answer for Q6. Using the Binary string shown at the end of the returned log, we could've gone back and found the product version of the software:

7. The malware used a legitimate location to stage its file on the endpoint. Can you find out the Directory path of this location?

Looking at events happening around the software installation, we can see some signs of suspicious PowerShell activity:

It is possible that a PowerShell script might have been involved in the installation of the service. Let's use the $MFT file to find our answer. First, let's parse the $MFT file:

Now, let's look for any created .ps1 files around the time of the incident:

Interesting. This ps1 script appears to be created inside the C:\Program Files (x86)\Google\... directory, which is legit. Everything after the Install folder is suspicious.

8. The malware executed a command from a file. What is name of this file?

Let's look deeper into the files inside the Program Files (x86)\Google\Install directory:

The install.cmd file looks interesting.

9. What are the contents of the file from question 8? Remove whitespace to avoid format issues.

MFT can store entire files inside an MFT record if they are small enough! According to the MFT output, this file is under 100 bytes long, so we should be able to read it:

└──╼ [★]$ head mftecmd-out -n 1 | cut -d ',' -f 1,6,7,9 && cat mftecmd-out | grep install.cmd | cut -d ',' -f 1,6,7,9
EntryNumber,ParentPath,FileName,FileSize
51471,.\Program Files (x86)\Google\Install,install.cmd,94

Using mftecmd, we can show the data inside the Entry Number 51471, which corresponds to our suspicious file:

All of our relevant data comes after the ASCII string! We can simply copy it and paste it into CyberChef to remove all whitespace:

10. What was the command executed from this file according to the logs?

We have already seen this command while we answered Q7. We can simply look at all Powershell-related logs that mention ru.ps1 to find our command:

11. Under malware staging Directory, a js file resides which is very small in size.What is the hex offset for this file on the filesystem?

Looking at the files inside the Install directory, we can see the aforementioned .js file:

└──╼ [★]$ cat mftecmd-out | grep "Google" | grep "Install" | cut -d "," -f 1,6,7,9 | grep js
51352,.\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic,background.js,17208
51463,.\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic,manifest.json,714
64067,.\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic,content.js,258

We can use the --de flag to see the corresponding entry number for content.js:

The hex file offset is mentioned here.

12. Recover the contents of this js file so we can forward this to our RE/MA team for further analysis and understanding of this infection chain. To sanitize the payload, remove whitespaces.

The payload is shown at the end of the mftecmd output:

We can use CyberChef again to clean the payload:

13. Upon seeing no AI Assistant app being run, alonzo tried searching it from file explorer. What keywords did he use to search?

After some research, I found out that the NTUSER.DAT file can be used for looking into File Explorer activities, more specifically, the WordWheelQuery and the TypedPaths section appears to be the most relevant for our investigation (source). Using Zimmerman Tools, we can find the location of the WordWheelQuery key with recmd (alias recmd="dotnet /opt/net9/RECmd/RECmd.dll"):

└──╼ [★]$ recmd -f "/home/hiramf0/Downloads/Triage/C/Users/alonzo.spire/ntuser.dat" --sk "WordWheelQuery"
RECmd version 2026.5.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/RECmd

[...]

	Found 1 search hit in /home/hiramf0/Downloads/Triage/C/Users/alonzo.spire/ntuser.dat
	Key: Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Now, let's read the values of this key:

The second value looks interesting, let's decode it with CyberChef:

14. When did alonzo searched it?

The Last write time field from the registry key contains our answer.

15. After alonzo could not find any AI tool on the system, he became suspicious, contacted the security team and deleted the downloaded file. When was the file deleted by alonzo?

Going back to the MFT file, let's try looking for any records mentioning rar archives around the time of the incident:

The last event indicates that the rar file was moved to the Recycle Bin, which show the exact moment when the user attempted to delete the file.

16. Looking back at the starting point of this infection, please find the md5 hash of the malicious installer.

Let's do some OSINT to see if we can find more information about this file online. After a little bit of research, I found this any.run report that describes the same processes as the .msi that we have been analyzing: