BoogeyMan 3 -TryHackMe Write-up

Introduction

This investigation focuses on a targeted phishing attack against Quick Logistics LLC, which led to the compromise of the CEO’s workstation. Using the ELK Stack, I analyzed system and network logs to trace the attacker’s activities, identify the initial infection vector, and assess the overall impact of the breach.This report details the findings and the attacker’s tactics observed during the incident timeline from August 29 to August 30, 2023.

Question 1: What is the PID of the process that executed the initial stage 1 payload?

To answer this i filtered for the file which was already there as part of the email investigation :ProjectFinancialSummary_Q3, then i looked at the PID which was:

Answer: 6392

Question 2: The stage 1 payload attempted to implant a file to another location. What is the full command-line value of this execution?

Answer:"C:\Windows\System32\xcopy.exe" /s /i /e /h D:\review.dat C:\Users\EVAN~1.HUT\AppData\Local\Temp\review.dat

Question 3: The implanted file was eventually used and executed by the stage 1 payload. What is the full command-line value of this execution?

Key observations:

• Payload File: review.dat
• Execution Method: rundll32.exe (DLL loading)
• Export Function Used: DllRegisterServer
• Parent Process: mshta.exe (PID 6392)
• User: QUICKLOGISTICS\evan.hutchinson

Answer:"C:\Windows\System32\rundll32.exe" D:\review.dat,DllRegisterServer

Question 4: The stage 1 payload established a persistence mechanism. What is the name of the scheduled task created by the malicious script?

Answer: Review

Question 5: The execution of the implanted file inside the machine has initiated a potential C2 connection. What is the IP and port used by this connection?

Answer: 165.232.170.151:80

Question 6: The attacker has discovered that the current access is a local administrator. What is the name of the process used by the attacker to execute a UAC bypass?

Answer: fodhelper.exe

Question 7: Having a high privilege machine access, the attacker attempted to dump the credentials inside the machine. What is the GitHub link used by the attacker to download a tool for credential dumping?

Answer: [https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip](https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip)

Question 8: After successfully dumping the credentials inside the machine, the attacker used the credentials to gain access to another machine. What is the username and hash of the new credential pair?

Answer: itadmin:F84769D250EB95EB2D7D8B4A1C5613F2

Question 9 — Using the new credentials, the attacker attempted to enumerate accessible file shares. What is the name of the file accessed by the attacker from a remote share?

Answer: IT_Automation.ps1

Question 10 — After getting the contents of the remote file, the attacker used the new credentials to move laterally. What is the new set of credentials discovered by the attacker?

Answer: allan.smith:Tr!ckyP@ssw0rd987

Question 11 — What is the hostname of the attacker’s target machine for its lateral movement attempt?

Answer: WKSTN-1327

Question 12 — What is the parent process name of the malicious command executed on the second compromised machine?

Answer: wsmprovhost.exe

Question 13 — The attacker then dumped the hashes in this second machine. What is the username and hash of the newly dumped credentials? (format: username:hash)

Answer: administrator:00f80f2538dcb54e7adc715c0e7091ec

Question 14 — After gaining access to the domain controller, the attacker attempted to dump the hashes via a DCSync attack. Aside from the administrator account, what account did the attacker dump?

Answer: backupda

Question 15 — After dumping the hashes, the attacker attempted to download another remote file to execute ransomware. What is the link used by the attacker to download the ransomware binary?

Answer: [http://ff.sillytechninja.io/ransomboogey.exe](http://ff.sillytechninja.io/ransomboogey.exe)

Conclusion

The investigation revealed a multi-stage attack involving initial payload execution, credential dumping, lateral movement using Pass-the-Hash, and privilege escalation. The attacker exploited legitimate Windows tools and remote PowerShell sessions to move through the network, eventually compromising the domain controller and dumping domain credentials. The final phase involved downloading ransomware using PowerShell.

That’s all for this challenge

Thank you:)