Boogeyman 3 Capstone (TryHackMe): Full Kill Chain Analysis from Initial Access to Domain Compromise

Overview

In this case study, I analyze a multi-stage Windows intrusion that escalated from an initial payload execution to full domain compromise and attempted ransomware deployment. Using process creation telemetry, PowerShell command-line analysis, and credential abuse artifacts, I reconstructed the attacker’s full kill chain and identified each key action across the environment.

This investigation highlights an important SOC lesson: when traditional object access logging fails, attacker intent often leaks through process command lines and PowerShell execution.

Initial Compromise & Stage 1 Payload Execution

The investigation began by identifying the execution of a suspicious process responsible for delivering the initial payload.

Using the filter expression:

user.name” “evan.hutchinson” and process.executable contains ‘ProjectFinancialSummary_Q3’

• Initial Stage 1 Payload PID: 6392

This process initiated a sequence of file operations designed to implant a malicious file in a secondary location.

Payload Implantation via Living-Off-the-Land Binary

The attacker leveraged a native Windows utility to copy the payload stealthily.

Using the filter:

user.name” “evan.hutchinson” and process.parent.pid:6392

We’re able to get the full command-line value for the execution.

Malicious File Implantation Command

"C:\Windows\System32\xcopy.exe" /s /i /e /h D:\review.dat C:\Users\EVAN~1.HUT\AppData\Local\Temp\review.da

Why this matters:

• **xcopy.exe is a trusted LOLBin**
• Hidden and recursive flags (/h /e) suggest intent to avoid detection
• Payload masquerades as a .dat file

Payload Execution via rundll32

Once implanted, the payload was executed using another trusted Windows binary. This is noticed in the image above.

Payload Execution Command

"C:\Windows\System32\rundll32.exe" D:\review.dat,DllRegisterServer

This technique allows attackers to execute malicious DLL code without dropping an obvious .dll file to disk.

Persistence via Scheduled Task

To maintain access across reboots, the attacker established persistence.

• Scheduled Task Name: Review

This ensured the malicious payload would execute repeatedly without further user interaction.

Command-and-Control (C2) Activity Detected

Shortly after execution, the implanted payload initiated outbound network communication.

• C2 Endpoint: 165.232.170.151:80

This confirmed the system had transitioned from initial compromise to active remote control.

Privilege Escalation via UAC Bypass

The attacker determined the compromised user already had local administrator privileges and exploited this to bypass UAC.

• UAC Bypass Process Used: fodhelper.exe

This is a well-known Windows auto-elevated binary frequently abused for privilege escalation.

Credential Dumping with Mimikatz

With elevated privileges, the attacker downloaded and executed a credential dumping tool.

Tool Downloaded

https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zi

This resulted in the extraction of NTLM hashes from memory.

Credential Abuse & Lateral Movement Begins

The attacker used dumped credentials to authenticate to additional systems. This is also evident in the previous image.

First New Credential Pair

itadmin:F84769D250EB95EB2D7D8B4A1C5613F2

These credentials were then used to enumerate accessible network shares.

Remote Share Enumeration via PowerShell (Key Detection Moment)

Traditional SMB object access events (5145) were unavailable. Instead, I pivoted to process creation logs, which served as a resource to answer the rest of questions in this lab.

Detection Query

winlog.event_id:1 AND process.name:"powershell.exe"

By adding the following as fields:

• process.command_line
• parent.process.name
• host.hostname

I identified direct evidence of remote file access.

File Accessed from Remote Share

IT_Automation.ps1

This reinforced a critical SOC insight:

When file auditing fails, PowerShell command lines often expose attacker behavior.

Credential Discovery & Further Lateral Movement

After reviewing the contents of the remote file, the attacker obtained additional credentials.

Newly Discovered Credentials

QUICKLOGISTICS\allan.smith:Tr!ckyP@ssw0rd987

These credentials enabled lateral movement to a new workstation.

• Target Hostname: WKSTN-1327

Remote Execution on Second Host

Analysis of the second system revealed the malicious command was executed remotely via Windows Remote Management.

• Parent Process: wsmprovhost.exe

This confirms the attacker used PowerShell Remoting / WinRM for lateral movement.

Second Credential Dump

Once established on the second machine, the attacker dumped credentials again.

Dumped Credential

administrator:00f80f2538dcb54e7adc715c0e7091ec

This enabled access to the domain controller.

Domain Controller Compromise & DCSync Attack

With domain-level access, the attacker performed a DCSync attack to replicate password hashes.

• Additional Account Dumped: backupda

This confirms full Active Directory compromise.

Ransomware Preparation & Final Stage

In the final stage of the intrusion, the attacker attempted to download a ransomware payload.

Scrolling down the list of results, i was able to find the site where the ransomboogey.exe was downloaded from.

Ransomware Download URL

http://ff.sillytechninja.io/ransomboogey.exe

This indicates the intrusion had progressed from espionage and credential theft to impact-focused objectives.

Key Takeaways for SOC Analysts

• Process creation logs are critical when file auditing is unavailable
• LOLBins (xcopy, rundll32, fodhelper) remain attacker favorites
• PowerShell command-line telemetry exposes attacker intent clearly
• Credential dumping enables rapid, quiet lateral movement
• DCSync remains a high-impact post-exploitation technique

Final Thoughts

This case study demonstrates how a seemingly small initial payload can cascade into full domain compromise when defensive visibility is incomplete. By pivoting intelligently across log sources and focusing on attacker behavior rather than assumptions, defenders can still reconstruct the full attack narrative.