In this Sherlock, Players will investigate an incident inspired by rise of malicious google ads for softwares mostly used by individuals like streaming, productivity or note taking applications. Players will analyze windows artifacts to uncover all stages of cyber kill chain.
Simon Stark is a dev at forela who recently planned to stream some coding sessions with colleagues on which he received appreciation from CEO and other colleagues too. He unknowingly installed a well known streaming software which he found by google search and was one of the top URL being promoted by google ads. Unfortunately things took a wrong turn and a security incident took place. Analyze the triaged artifacts provided to find out what happened exactly.
Hard - DFIR
Before starting, I downloaded the Zimmerman tools with Get-ZimmermanTools.ps1.
Finding the malicious file
The first real challenge was to find the actual malicious file. At first, I looked into the browser history of the Simon.stark user, which only contained downloads for a legitimate PHP encryption tool.
Then, I parsed many Windows artifacts with Zimmerman tools (MFT, Windows Event Logs, Amcache) and I found an interesting program related to streaming inside the Amcache logs: OBS
Inside, we can find a directory which could be related to where the OBS files where downloaded:c:\Users\simon.stark\documents\streaming software\obs streaming software\obs-studio. Knowing this, we can try to find a .zip file related to this directory inside the parsed MFT logs.
- What's the original name of the malicious zip file which the user downloaded thinking it was a legit copy of the software?
The original name of the file can be found inside the Zone.Identifier file appended to our .zip archive.
- Simon Stark renamed the downloaded zip file to something else. What's the renamed Name of the file alongside the full path?
The full name of the file can be found by appending the values of the Parent Path column and the File Name column.
Before \Users\, append C: for the drive letter.
- What's the timestamp when the file was renamed?
The Last Record Change0x10 timestamp displays the last time the MFT record related to the file was edited. With this in mind, we can find the timestamp when the file was renamed inside the field:
- What's the Full URL from where the software was downloaded?
The URL can be found inside the Zone:Identifier MFT record after the HostUrl string.
Malicious Domain and C2 server
For this section, I used Windows Event Logs since they contained DNS queries and results mentioning this domain. For some reason, the actual relevant information related to these DNS communications were only stored inside the final Payload field. Nevertheless, we can easily find information by filtering for the obsproicet string.
- Dig down deeper and find the IP Address on which the malicious domain was being hosted.
Looking into the DNS communications, we can find a DNS query showing the IP address related to the malicious domain:
- Multiple Source ports connected to communicate and download the malicious file from the malicious website. Answer the highest source port number from which the machine connected to the malicious website.
It took me some time to find logs showing actual network information. After some time, I finally managed to find the file that would help me answer this question: pfirewall.log. This file is located inside Acquisition\C\Windows\System32\LogFiles\Firewall within the extracted archive files. We can use sls (grep) to find any interesting network communications towards the IP address obtained in Q5:
Behavior and Malicious Backdoor
- The zip file had a malicious setup file in it which would install a piece of malware and a legit instance of OBS studio software so the user has no idea they got compromised. Find the hash of the setup file.
The downloaded .zip file we found in Q2 is probably the setup file we are looking for. Using AmcacheParser and looking for OBS-related files, we can find the SHA1 hash of our suspicious archive file:
- The malicious software automatically installed a backdoor on the victim's workstation. What's the name and filepath of the backdoor?
First, I decided to also parse the logs from the $J file. Inside these logs, I found the .pf files corresponding to the installation of the OBS Studio application. A few rows below, we can see some files with strange names being created:
Inside the MFT logs, we can verify the location of these files. We can additionally find evidence that this lat takewode... file was executed based on the presence of .pf files:
- Find the prefetch hash of the backdoor.
The prefetch hash belonging to lat takewode... can be found in the parsed Prefetch logs.
- The backdoor is also used as a persistence mechanism in a stealthy manner to blend in the environment. What's the name used for persistence mechanism to make it look legit?
Looking for any events related to the persistence backdoor, we can see a scheduled task being created, which is additional evidence that the secondary payload is used for persistence:
The data related to the actual task is inside the Payload Data2 field, which appears to be in XML format. After some processing, we can find information about the scheduled task, including the legitimate Windows process that it is trying to impersonate:
Further C2 communication evidence through DNS
- What's the bogus/invalid randomly named domain which the malware tried to reach?
In the Windows Event Logs immediately after the creation of the scheduled task, we can see a DNS-related event containing a domain with a strange TLD that is clearly invalid:
- The malware tried exfiltrating the data to a s3 bucket. What's the url of s3 bucket?
By looking for domains containing the .s3. string, we should be able to find the URL of a S3 bucket:
User Activities and Detection
- What topic was simon going to stream about in week 1? Find a note or something similar and recover its content to answer the question.
Inside the parsed MFT logs, we can look for interesting files inside the Simon.stark\Documents directory that could be related to planning streaming sessions:
The Week 1 plan.txt looks quite interesting! The File Size of that text file is only 57 bytes, so we should be able to easily recover its contents with MFTECmd: MFTECmd.exe --de 5443 -f "C:\Users\hiramf0\Downloads\Streamer\Streamer\Acquisition\C\`$MFT".
- What's the name of Security Analyst who triaged the infected workstation?
The prefetch logs demonstrate that the image was captured via KAPE. We should try to the location from where the GKAPE.EXE file was executed from.
Looking inside the NTUSER.dat file belonging to the Simon.stark user, we can use the UserAssist key to find recent application run events. If we look for a KAPE executable, we will find the name of the security analyst in the filepath of the executable:
- What's the network path from where acquisition tools were run?
The network path includes the name of the machine (\\DESKTOP-887GK2L) and the actual directory where the KAPE executable was stored. The Program Name contains our answer already: \\DESKTOP-887GK2L\Users\CyberJunkie\Desktop\Forela-Triage-Workstation\Acquisiton and Triage tools.