TryHackMe // Write-up

Boogeyman 2.

Phishing, memory forensics, and persistence: reconstructing an attack from a phishing email and a Windows memory dump.

• DFIR
• Phishing Analysis
• Memory Forensics
• Volatility 3
• Persistence

Platform

TryHackMe

Room

Boogeyman 2

Category

Digital Forensics and Incident Response (DFIR)

Tools

olevba, Python, Volatility 3, strings, grep

Result

Completed, 450 points

01 Scenario

The investigation focused on a phishing email sent to an employee at Quick Logistics. The email contained a malicious Microsoft Word document disguised as a job application. The document used a VBA macro to download and execute a JavaScript payload, which led to further malware execution, command-and-control (C2) activity, and scheduled-task persistence.

My objective was to reconstruct the attack using the email artifact and a Windows memory dump.

02 Analyze the Phishing Email

The first artifact was Resume - Application for Junior IT Analyst Role.eml. I inspected the email headers and extracted the attached Word document using Python's email parsing functionality.

The resume-themed subject was intended to make the attachment appear legitimate. The external sender and unexpected document attachment warranted further investigation.

03 Analyze the Malicious Word Document

I used olevba to inspect the document for embedded VBA macros.

olevba Resume_WesleyTaylor.doc

The macro contained an AutoOpen() routine that executed when the document was opened. It used Microsoft.XMLHTTP to retrieve a remote file and ADODB.Stream to write the response to disk. The important indicators were:

This established the initial execution chain: opening the document triggered the macro, which downloaded a remote payload and launched it through Windows Script Host.

04 Investigate the Windows Memory Dump

The next artifact was WKSTN-2961.raw, a Windows memory image. I used Volatility 3 to identify the operating system and investigate the running and recently exited processes.

vol -f WKSTN-2961.raw windows.info

The system information identified a 64-bit Windows 10 environment running build 18362.

Process tree

I examined the process tree:

vol -f WKSTN-2961.raw windows.pstree

The relevant process chain was:

OUTLOOK.EXE (PID 1440)
└── WINWORD.EXE (PID 1124)
    ├── WINWORD.EXE (PID 4336, exited)
    └── wscript.exe (PID 4260)
        └── updater.exe (PID 6216)
            └── conhost.exe (PID 4464)

This process relationship connected the phishing document to script execution and the subsequent malware process. The relevant findings were:

I also examined process command lines:

vol -f WKSTN-2961.raw windows.cmdline

The command-line evidence supported the execution of C:\ProgramData\update.js by Windows Script Host and identified the path of updater.exe.

05 Identify the Download URL and C2 Endpoint

During the memory investigation, I searched for strings associated with the malicious activity. To find HTTPS URLs stored as little-endian UTF-16 strings, I used:

strings -a -el WKSTN-2961.raw | grep -i 'https://files'

This recovered the initial payload URL:

https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png

The -el option was important because Windows commonly stores strings in UTF-16LE encoding. Searching only standard ASCII strings can miss relevant artifacts.

Further memory-string analysis identified:

http://128.199.95.189:8080/admin/get.php

The identified C2 endpoint was 128.199.95.189:8080. These findings helped distinguish the initial phishing payload delivery from subsequent malware communications.

06 Locate the Original Attachment in Memory

I used Volatility's file-object scanning functionality to locate cached files and other filesystem artifacts:

vol -f WKSTN-2961.raw windows.filescan | grep -i -E 'updater|update.js|Resume_WesleyTaylor|\.doc'

This revealed a cached copy of the Word attachment at:

\Users\maxine.beck\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\WQHGZCFI\Resume_WesleyTaylor (002).doc

The file scan also identified artifacts associated with the malicious executable and its scheduled task:

• \Windows\Tasks\updater.exe
• \Windows\System32\Tasks\Updater
• \Windows\Prefetch\UPDATER.EXE-F25601BD.pf

These artifacts provided additional evidence of execution and persistence.

07 Recover the Scheduled-Task Persistence Command

The final stage of the investigation was to determine how the attacker maintained access after establishing C2. The task file was identified as \Windows\System32\Tasks\Updater. I dumped the relevant file object with Volatility:

vol -f WKSTN-2961.raw windows.dumpfiles --virtaddr 0xe58f89295990

The recovered artifact was:

file.0xe58f89295990.0xe58f838dcbe0.DataSectionObject.Updater.dat

Further investigation led to the full scheduled-task creation command:

schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\"'

Understanding the command

The command retrieves a value named debug from the user's registry location and executes the decoded content. This provides a mechanism for executing stored commands or code without placing the entire payload directly in the scheduled-task definition.

08 Reconstructed Attack Chain

The evidence supported the following sequence:

1. The victim received a phishing email disguised as a job application.
2. The victim opened the attached Word document.
3. The document's AutoOpen() macro downloaded a remote resource.
4. The macro saved the downloaded content as C:\ProgramData\update.js.
5. wscript.exe executed the script.
6. The subsequent activity launched C:\Windows\Tasks\updater.exe.
7. The malware communicated with the identified C2 endpoint.
8. The attacker established scheduled-task persistence through a task named Updater, configured to run daily at 9:00 AM.

09 Indicators of Compromise

10 Lessons Learned

This investigation reinforced the value of correlating multiple evidence sources instead of relying on a single indicator. The email headers and macro revealed the initial delivery mechanism. The process tree established relationships between Office, Windows Script Host, and the malicious executable. Memory-string searches uncovered network indicators, while file scanning and task artifacts helped identify persistence.

// Conclusion