Reflection - HackTheBox Challenge Writeup

Challenge Information

Description

In this challenge, you are part of a final operation against Draeger’s organization. After successfully disrupting their fuel-supply plans, dismantling their ransomware gang, and preventing phishing campaigns, the team is ready for the final blow. However, during last-minute checks on Miyuki’s PC, you notice suspicious behavior that suggests unauthorized access.

Your objective is to forensically investigate the system to determine if it has been compromised. If evidence of breach is found, the operation’s signal must be changed immediately to maintain operational security. Time is critical—there is no margin for error.

Solution Overview

This forensics challenge requires analyzing system artifacts and logs to detect signs of compromise. The investigation focuses on identifying unauthorized access, suspicious processes, persistence mechanisms, or other indicators of compromise (IOCs) that would prove the system has been breached.

Key Steps

1. Initial System Artifact Collection

Begin by examining critical system artifacts that would show signs of unauthorized access:

# Check system event logs for failed/successful login attempts
Get-EventLog -LogName Security -InstanceId 4624,4625 |
  Select-Object TimeGenerated, Message |
  Sort-Object TimeGenerated -Descending |
  Head -50

# Examine process execution history
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object {$_.Id -eq 1} |
  Select-Object TimeCreated, Message |
  Sort-Object TimeCreated -Descending

2. Persistence Mechanism Analysis

Look for common persistence techniques:

# Check scheduled tasks for suspicious entries
Get-ScheduledTask |
  Where-Object {$_.State -eq "Ready"} |
  Get-ScheduledTaskInfo |
  Select-Object TaskName, LastRunTime, NextRunTime

# Examine registry run keys
Get-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" |
  Select-Object -ExpandProperty Property

# Check startup folder
Get-ChildItem -Path "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

3. Network Connection Analysis

Investigate suspicious network communications:

# Review network connections and associated processes
Get-NetTCPConnection -State Established |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $_ | Add-Member -NotePropertyName ProcessName -NotePropertyValue $proc.Name -PassThru
  }

# Check DNS resolution history
Get-DnsClientCache |
  Select-Object Name, Type, TimeToLive |
  Sort-Object Name

4. File System Artifacts

Examine suspicious file modifications:

# Find recently modified executables
Get-ChildItem -Path "C:\Windows\Temp" -Recurse -File |
  Where-Object {$_.Extension -match "\.(exe|dll|ps1|vbs|bat)"} |
  Select-Object FullName, LastWriteTime |
  Sort-Object LastWriteTime -Descending

5. Evidence Compilation

Consolidate findings into a comprehensive report documenting:

• Timeline of suspicious events
• Unauthorized user accounts or sessions
• Persistence mechanisms installed
• Lateral movement indicators
• Data exfiltration attempts
• Malware or exploit artifacts

Tools Used

• Event Viewer - Windows system and security event log analysis
• Sysmon - Advanced process and network monitoring
• Registry Editor - System configuration and persistence point examination
• Task Scheduler - Scheduled task analysis
• Process Explorer - Process hierarchy and relationship mapping
• Network Monitoring - Connection and DNS analysis
• Timeline Analysis - Chronological correlation of events

Key Learnings

1. Comprehensive Log Analysis - Success requires examining multiple log sources (Security, Sysmon, Application logs) and correlating events across different timestamps.

2. Persistence Mechanism Hunting - Attackers typically establish persistence through scheduled tasks, registry modifications, startup folders, or service installations. These are critical indicators to investigate.

3. Behavioral Indicators - Look for unusual process chains, unexpected network connections to external IPs, and processes running from temporary directories.

4. Timeline Reconstruction - Building an accurate timeline of events is crucial for determining the sequence of compromise and understanding attacker actions.

5. Operational Security Impact - In scenarios like this where security operations are at stake, forensic findings directly impact operational decisions—accuracy is paramount.

6. Artifact Preservation - Careful handling of forensic evidence ensures findings are admissible and conclusions are defensible.

The flag format for this challenge is HTB{<redacted>}, where the value is derived from evidence of the specific compromise found during the investigation.