Recollection - HTB Sherlock Writeup

A junior member of our security team has been performing research and testing on what we believe to be an old and insecure operating system. We believe it may have been compromised & have managed to retrieve a memory dump of the asset. We want to confirm what actions were carried out by the attacker and if any other assets in our environment might be affected. Please answer the questions below.

Easy - DFIR

We will use the Volatility Framework for this Sherlock. We might need to use versions 2 and 3, so we will download both.

Volatility 2 can be downloaded as a standalone executable from the archived GitHub repo. I downloaded the volatility_2.6_lin64_standalone.zip file, extracted the executable, and renamed it as vol2.

Volatility 3 can be downloaded from GitHub using git:

git clone https://github.com/volatilityfoundation/volatility3.git

1. What is the Operating System of the machine?

Let's use vol2 for this. Using the imageinfo module, we can find the Operating System of the machine based on the Suggest Profiles.

Based on these profiles, we can assume that this machine was running Windows 7.

2. When was the memory dump created?

We can find our answer in the Image date and time field from the previous imageinfo output.

3. After the attacker gained access to the machine, the attacker copied an obfuscated PowerShell command to the clipboard. What was the command?

Since this question mentions clipboard usage, let's check what's on the clipboard using vol2 with the clipboard module,

The only plaintext string under Data appears to be our obfuscated command.

4. The attacker copied the obfuscated command to use it as an alias for a PowerShell cmdlet. What is the cmdlet name?

Using the consoles module, we should be able to see information about the console session running inside memory. If we look for the obfuscated command, we will see that it calls another PowerShell cmdlet used for command execution:

iex is a common alias for the following PowerShell cmdlet:

5. A CMD command was executed to attempt to exfiltrate a file. What is the full command line?

Going at the beginning of the consoles output, we can see a CMD command trying to exfiltrate a file using network shares with type .

6. Following the above command, now tell us if the file was exfiltrated successfully?

Scrolling down below, we can find the output of the exfiltration attempt and confirm that the file was not exfiltrated.

7. The attacker tried to create a readme file. What was the full path of the file?

Inside the consoles output, we can find the attacker attempting to execute an encoded PowerShell command to no avail:

We can decode this command easily with base64 -d:

└──╼ [★]$ echo "ZWNobyAiaGFja2VkIGJ5IG1hZmlhIiA+ICJDOlxVc2Vyc1xQdWJsaWNcT2ZmaWNlXHJlYWRtZS50eHQi" | base64 -d
echo "hacked by mafia" > "C:\Users\Public\Office\readme.txt"

This is the readme file the attacker attempted to create!

8. What was the Host Name of the machine?

We will need to read registry keys from memory to find the hostname. I found this guide online, which helped me find the hostname of the machine. First, I had to get the KDBG offset (where critical Windows system structures live) from imageinfo:

Then, I used the first profile and the KDBG offset to confirm the virtual memory address of the SYSTEM registry hive:

Finally, I was able to read the hostname from the correct registry key (ControlSet001\Control\ComputerName\ComputerName):

9. How many user accounts were in the machine?

Using the windows.hashdump module, we should be able to list all user accounts in the system based on stored NTLM hashes.

To get our answer, we need to exclude the HomeGroupUser$, since it appears to be a service account, leaving us with a total of three user accounts.

10. In the "\Device\HarddiskVolume2\Users\user\AppData\Local\Microsoft\Edge" folder there were some sub-folders where there was a file named passwords.txt. What was the full file location/path?

Using the windows.filescan module on Volatility 3 will display the file paths and memory addresses of Windows file. We can pair this with grep to find a specific file inside a directory. I used many grep commands piped together because I had some issues with the backslashes.

└──╼ [★]$ ./volatility3/vol.py -f recollection.bin windows.filescan | grep "AppData" | grep Local | grep Microsoft | grep Edge | grep password
0x11fc10070100.0\Users\user\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt

Pairing what's after Users with \Device\HarddiskVolum2 will complete the full file path.

11. A malicious executable file was executed using command. The executable EXE file's name was the hash value of itself. What was the hash value?

The consoles module on Volatility 2 should display executables ran through the CLI.

The last command in this session is our executable, based on its unique naming convention.

12. Following the previous question, what is the Imphash of the malicous file you found above?

Let's lookup this hash on VIrusTotal to find what the Imphash of the executable is:

13. Following the previous question, tell us the date in UTC format when the malicious file was created?

This information is also available in the VirusTotal report.

14. What was the local IP address of the machine?

We can use the netstat module to see what the Local Address of the machine is:

The non-localhost IP address under Local Address is our answer.

15. There were multiple PowerShell processes, where one process was a child process. Which process was its parent process?

We can find parent-child relationships of Windows processes using the pstree module.

The cmd.exe process is responsible for the creation of these PowerShell processes.

16. Attacker might have used an email address to login a social media. Can you tell us the email address?

Social media is usually accessed through a web browser. Was there a web browser running on the machine? Let's find out by checking the running processes.

msedge.exe refers to Microsoft Edge, the default web browser used in Windows. Let's dump this process to find any email addresses:

└──╼ [★]$ ./volatility3/vol.py -f recollection.bin -o msedge-dump/ windows.memmap --dump --pid 2380

We are left with the pid.2380.dmp file, which should contain important strings that could leak the attacker's email address. Using strings and grep, we find this:

This email address was used to access Facebook!

17. Using MS Edge browser, the victim searched about a SIEM solution. What is the SIEM solution's name?

After some more analysis with strings, we can observe that all search queries look like *bing.com/search?q=*. We should be able to find a web search related to a SIEM solution:

Wazuh appears in one of the search queries!

18. The victim user downloaded an exe file. The file's name was mimicking a legitimate binary from Microsoft with a typo (i.e. legitimate binary is powershell.exe and attacker named a malware as powershall.exe). Tell us the file name with the file extension?

We should be able to find this exe file inside the Downloads folder. Let's use filescan and grep for this:

The first file here is impersonating csrss.exe, which is the file we are looking for.