Gladys is a new joiner in the company, she has recieved an email informing her that the IT department is due to do some work on her PC, she is guided to call the IT team where they will inform her on how to allow them remote access. The IT team however are actually a group of hackers that are attempting to attack Forela.
The sherlock archive contains a rapid triage dump collected by KAPE on a Windows host. The dump includes parts of the C:\ partition and log files relevant for forensics.
Information Gathering
Rapid triage dumps contain a lot of logging data that needs to be organized and processed before use. Some of the most important data sources collected by KAPE include:
The Master File Table ($MFT): A table of records for all files and folders stored on the NTFS volume.
Event logs (C:\Windows\System32\winevt\logs): System logs in the .evtx format, collected by Windows.
User profile data (C:\Users\<user>): Local profiles store settings and temporary files that might prove useful forensically.
There are several approaches for organizing and analyzing the collected data, though the most important toolkit is Eric Zimmerman's tools. Regardless of the method used for further analysis, the tools EvtxECmd and MFTECmd fom the Zimmerman suite are essential for parsing event logs or the MFT, respecitively.
The toolkit is for Windows only and parses the input files into JSON or CSV. The output can then be analyzed using tools like Timeline Explorer or MFT Explorer. Alternatively, the JSON output can be directly searched using a tool like grep.
PS> Z:\sherlocks\ticktock\Collection\C>mftecmd.exe -f '$MFT' --json Z:\sherlocks\ticktock\C --csv Z:\sherlocks\ticktock\C
MFTECmd version 1.2.2.1
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd
Command line: -f $MFT --json Z:\sherlocks\ticktock\C --csv Z:\sherlocks\ticktock\C
Warning: Administrator privileges not found!
File type: Mft
Processed $MFT in 2.5914 seconds
$MFT: FILE records found: 120,652 (Free records: 11,126) File size: 128.8MB
Path to Z:\sherlocks\ticktock\C doesn't exist. Creating...
CSV output will be saved to Z:\sherlocks\ticktock\C\20250510223301_MFTECmd_$MFT_Output.csv
JSON output will be saved to Z:\sherlocks\ticktock\C\20250510223301_MFTECmd_$MFT_Output.json
Note
If using PowerShell, the path to the $MFT file has to be enclosed in single quotes to prevent PowerShell from treating it as a variable. This not an issue if using cmd.exe.
Windows stores event logs in C:\Windows\System32\winevt\logs as multiple .evtx files. Using EvtxECmd the files can be combined into a single JSON file like so:
With the logs combined, grepping for specific items becomes much easier. For instance, all events containing powershell -e (inline PowerShell invocations) can be enumerated:
Chainsaw is a tool for analyzing forensic artefacts from Windows sytems using pre-defined Sigma detection rules. This helps filter out non-relevant log entries and focus on events that are of interest.
Chansaw operates directly on the .evtx event files. It also requires the Sigma detection rules to be present on the system, as well as a mapper between them and Chainsaw's rules.
[!] failed to parse document '../Collection/C/Windows/System32/winevt/logs/Microsoft-Windows-Sysmon%4Operational.evtx' - An error occurred while trying to deserialize evtx stream
Unfortunately, as this particular log is essential for solving some of the questions below, Chainsaw is missing crucial data in its report.
Once done, Chainsaw produces a plain text report of its findings. The file is organized by topic, making it much easier to navigate the event logs and finding IOCs and pinpointing when important events occurred.
Splunk
An alternative to analyzing the output from EvtxECmd.exe using tools like grep is to upload the data to a SIEM like Splunk. The upside of this is easier oversight that helps finding potentially interesting details.
Other Logs
Aside from the logging data collected by Windows' event logging system, some parts of the OS store their own logs, primarly as text files in various locations.
Some potentially useful logs in this category include:
Log of all PowerShell commands run by a given user.
Windows Defender log: C:\ProgramData\Microsoft\Windows Defender\Support
Contains log files from scans performed by Windows Defender. May provide further details if malware is detected. The log files in this directory are unfortunately encoded in UTF16-LE, which makes searching them with grep difficult.
Tasks
What was the name of the executable that was uploaded as a C2 Agent?
Looking through the rapid triage dump, there is a TeamViewer folder under C:\Users\gladys\AppData\Local. It's likely that TeamViewer the remote access tool mentioned in the scenario.
There is a log file under Logs in the TeamViewer folder. Searching the file for .exe turned the following:
The attacker attempted to set a bitlocker password on the C: drive what was the password?
The Chainsaw report lists some suspicious entries under the PowerShell Engine State that are similar to the one below:
The full content of the entry can be found by searching for parts of the event details, i.e. powershell.exe -e JABTAGUAYwB1AHIAZQB, in the combined event log output from EvtxECmd.exe:
...
2023/05/04 11:35:31.958 5716 2436 D3 CParticipantManagerBase participant DESKTOP-R30EAMH (ID [1764218403,-2102926010]) was added with the role 3
2023/05/04 11:35:31.958 5716 2436 D3 New Participant added in CParticipantManager DESKTOP-R30EAMH ([1764218403,-2102926010])
2023/05/04 11:35:31.958 5716 2436 D3 CParticipantManagerBase participant fritjof olfasson (ID [1761879737,-207968498]) was added with the role 6
2023/05/04 11:35:31.958 5716 2436 D3 New Participant added in CParticipantManager fritjof olfasson ([1761879737,-207968498])
...
What IP address did the C2 connect back to?
Knowing the C2 executable's name (merlin.exe) makes it fairly straight-forward to search the combined event log for occurences of the executable and find any related details:
The hashes are: ac688f1ba6d4b23899750b86521331d7f7ccfb69:42ec59f760d8b6a50bbc7187829f62c3b6b8e1b841164e7185f497eb7f3b4db9
How many times did the powershell script change the time on the machine?
Time changes on Windows are logged as Event ID 4616: The system time was changed.
Aside from using a SIEM to filter for the relevant event ID, there are at least two ways of finding this using grep on the combined event log output from EvtxECmd.exe.
Keeping in mind that the question is only about the times the system time was changed by PowerShell and not in general, one way is to search for the event description and the keyword powershell:
$ grep "The system time was changed" 20250511141538_EvtxECmd_Output.json | grep powershell | wc -l
2371
Another method is to use jq's select feature to selectively extract parts of a JSON object and then filtering for for events containing the keyword powershell:
The SID for a user can be found in a number of ways. One way is to search the event logs, as the SID is often included in the event payload. Being included in the payload means that there is no simple way of filtering for the SID value alone, though it's usually easy to spot.
A typical event that will include the user's SID is Event ID 4624: An account was successfully logged on:
