Trojan - HTB Sherlock Writeup

John Grunewald was deleting some old accounting documents when he accidentally deleted an important document he had been working on. He panicked and downloaded software to recover the document, but after installing it, his PC started behaving strangely. Feeling even more demoralised and depressed, he alerted the IT department, who immediately locked down the workstation and recovered some forensic evidence. Now it is up to you to analyze the evidence to understand what happened on John's workstation.

Easy - DFIR

I will be using the Windows Pwnbox for this Sherlock. Throughout my investigation, I installed the following DFIR tools to help me in analyzing the artifacts:

• Volatility 3 (git clone https://github.com/volatilityfoundation/volatility3.git)
• FTK Imager (download from Exterro website)
• Wireshark (already installed)
• PECmd, Timeline Explorer (Zimmerman Tools)
• 7zip (to extract all archives)

1. What is the build version of the operating system?

Let's use Volatility to find the build version of the OS. The memory dump is inside the memory capture directory:

Our answer is located inside the Major/Minor field. The number after the 15 is the Build Version of the machine, which corresponds to Version 2004 of Windows 10.

2. What is the computer hostname?

We should use the Registry to find the computer hostname. First, let's find the offset of the SYSTEM hive:

The offset is 0x8a0d9148a000. Let's use the windows.registry.printkey utility with this offset to print the value of the 'ControlSet001\Control\ComputerName\ComputerName' key:

3. What is the name of the downloaded ZIP file?

Let's check the disk_artifacts.ad1 image inside FTK Imager. If the user downloaded a ZIP file, it should be in the Downloads folder:

4. What is the domain of the website (including the third-level domain) from which the file was downloaded?

Now, we can use the network.pcapng capture found inside the packet capture directory. By filtering for http traffic and searching for the Data_Recovery.zip string, we can find the domain from which the file was downloaded:

5. The user then executed the suspicious application found in the ZIP archive. What is the process PID?

By opening the ZIP archive inside FTK Imager, we can find the name of the suspicious application:

We should be looking for a process mentioning Recovery_Setup.exe with Volatility. Let's use windows.pslist to find any processes mentioning that executable:

6. What is the full path of the suspicious process?

Similarly, we can use the windows.cmdline plugin to find the full path of the suspicious process:

PS C:\Users\hiramf0\Downloads> python .\volatility3\vol.py -f '.\Trojan\memory capture\memory.vmem' windows.cmdline
Volatility 3 Framework 2.28.1
Progress:  100.00               PDB scanning finished
PID     Process Args
...
484     Recovery_Setup  "C:\Users\John\Downloads\Data_Recovery\Recovery_Setup.exe"
...

7. What is the SHA-256 hash of the suspicious executable?

Going back to FTK Imager, we can get the hashes from the suspicious executable by right clicking it > Export File Hash List and saving the CSV file:

Let's look up the MD5 hash on VirusTotal to find the SHA256 hash of the suspicious executable:

8. When was the malicious program first executed?

Inside FTK Imager, we can find the Prefetch folder, which should contain relevant information about our suspicious executable:

Using PECMD.exe and Timeline Explorer from the Zimmerman tools will be great to analyze everything easily. Let's parse all Prefetch files and open them on Timeline Viewer:

After opening the prefetch-logs_Timeline file and filtering for REOVERY_SETUP.EXE on the Executable Name field, we can find the timestamp of the first time program was executed:

9. How many times in total has the malicious application been executed?

There are only two instances of the RECOVERY_SETUP.EXE file inside the Prefetch logs.

10. The malicious application references two .TMP files, one is IS-NJBAT.TMP, which is the other?

At first, I tried searching for tmp files being mentioned in the memdump through windows.psline and windows.cmd, but I only found the IS-NJBAT.TMP file again:

PS C:\Users\hiramf0\Downloads> python .\volatility3\vol.py -f '.\Trojan\memory capture\memory.vmem' windows.cmdline | findstr tmp
5956    is-NJBAT.tmp    "C:\Users\John\AppData\Local\Temp\is-VIBV9.tmp\is-NJBAT.tmp" /SL4 $A033C "C:\Users\John\Downloads\Data_Recovery\Recovery_Setup.exe" 1937767 52224

Looking for tmp files in the Prefetch logs inside Timeline Explorer does yield results:

11. How many of the URLs contacted by the malicious application were detected as malicious by VirusTotal?

Inside the VirusTotal report, we can navigate to the Relations > Contacted URLs and count how many of them are considered to be malicious:

12. The malicious application downloaded a binary file from one of the C2 URLs, what is the name of the file?

Let's find any downloads related to these URLs by using the available packet capture. All of the domains above were contacted in our packet capture. Let's focus on the first domain mentioned to determine if its our binary by using the http and ip.dst==45.12.253.72 display filter:

Looking into the puk.php streams, we can see that a DLL file is being downloaded, which indicates that this is the correct URL:

13. Can you find any indication of the actual name and version of the program that the malware is pretending to be?

We need to find a deeper analysis of the malware's behavior. Inside the Community tab of the VirusTotal report, we can find the Joe Sandbox Analysis link:

Let's enter that and try to find something that looks like a legitimate program. Inside the Created / dropped files section, we can find a mention of a possibly benign file recovery executable that the program is pretending to act as: