Investigating a Malware Infection Using Splunk: From Initial Compromise to Data Exfiltration

As part of my cybersecurity training and SOC-focused lab practice, I recently completed a simulated incident investigation using Splunk. The objective was to analyze security logs, identify the attack timeline, determine how the compromise occurred, and uncover the attacker’s persistence and data exfiltration methods.

This exercise provided valuable experience in log analysis, threat hunting, IOC identification, and incident response workflows commonly performed by SOC analysts.

Environment Overview

The environment consisted of six hosts:

Grouped logs based on the source and created index accordingly

• HR-PC01
• IT-ADMIN
• WS-11
• WS-12
• WS-21
• DC01

During the investigation, I analyzed logs from Sysmon, Windows Security Events, DNS records, and network activity to reconstruct the attack timeline.

Identifying the Initial Compromise

The first suspicious activity occurred on HR-PC01 when a Microsoft Word document named Benefits_Update.docm was downloaded and opened by the user Alice.

Shortly after the document execution, a hidden PowerShell process was launched from WINWORD.exe:

Suspicious chain of events

WINWORD.exe → powershell.exe

The PowerShell command included encoded parameters and hidden execution flags, which are commonly observed in malicious document-based attacks.

This strongly indicated that the Word document contained malicious macros designed to execute PowerShell commands on the victim system.

Malware Deployment

Following the PowerShell execution, a new executable named adobesync.exe was created and launched.

The observed process chain was:

Benefits_Update.docm
        ↓
WINWORD.exe
        ↓
powershell.exe
        ↓
adobesync.exe

This process hierarchy clearly demonstrated the progression from document-based phishing to malware execution.

Command and Control Communication

The compromised system established outbound connections to an external IP address:

45.77.154.88

The malware communicated with this destination over HTTPS (Port 443), suggesting encrypted command-and-control (C2) activity.

Associated DNS activity revealed communication with the domain:

cdn-sync-updates.net

This domain resolved to the same external IP address observed in the network logs.

Based on the collected evidence, the attacker successfully established command-and-control communication after malware deployment.

Persistence Mechanisms

Further investigation revealed that the malware attempted to maintain persistence on the system.

Evidence included:

• Scheduled Task Creation (Event ID 4698)
• Registry Run Key Modification (Sysmon Event ID 13)

A scheduled task named AdobeSyncUpdater was created shortly after user logon, allowing the malware to execute automatically whenever the system was accessed.

The following persistence location was identified:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdobeSyncUpdater

This ensured that the malware would remain active even after system restarts.

Authentication Analysis

As part of the investigation, I reviewed authentication activity to determine whether brute-force attempts were present.

Results showed:

• Successful Logins (Event ID 4624): 220
• Failed Logins (Event ID 4625): 3

Although three failed login attempts targeting the Administrator account were observed, there was insufficient evidence to classify the activity as a brute-force attack.

The login failures appeared isolated and were not followed by additional authentication abuse.

DNS Analysis and Data Exfiltration

One of the most interesting findings emerged during DNS log analysis.

The compromised host generated the following DNS queries:

ZW1wbG95ZWVzLmNzdg==.corp-check.com
cGF5cm9sbC54bHN4.corp-check.com

After decoding the Base64 strings, the following filenames were revealed:

employees.csv
payroll.xlsx

These queries suggested that sensitive file names were being encoded and transmitted through DNS requests.

This behavior is commonly associated with DNS tunneling and covert data exfiltration techniques.

Evidence of Data Transfer

Additional network logs showed outbound communication from adobesync.exe to the attacker’s infrastructure.

Approximately:

5 MB

of data was transmitted to:

45.77.154.88

over HTTPS.

This strongly supported the hypothesis that sensitive information was exfiltrated from the compromised system.

Indicators of Compromise (IOCs)

IP Address

• 45.77.154.88

Suspicious IP

Domains

• cdn-sync-updates.net
• corp-check.com

Malicious Files

• Benefits_Update.docm
• adobesync.exe

Potentially Stolen Files

• employees.csv
• payroll.xlsx

Registry Persistence

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdobeSyncUpdater

Suspicious Process Chain

WINWORD.exe
    ↓
powershell.exe
    ↓
adobesync.exe

Conclusion

This investigation demonstrated a complete attack lifecycle beginning with a malicious document, followed by PowerShell execution, malware deployment, persistence establishment, command-and-control communication, and suspected data exfiltration.

Using Splunk, Sysmon logs, Windows Security Events and DNS logs, I was able to reconstruct the attack timeline, identify indicators of compromise, and determine the techniques used by the attacker.

Exercises like this are excellent for developing SOC analyst skills because they closely resemble real-world investigations involving malware execution, persistence mechanisms, network communications, and incident response analysis.