Title here
Summary here
HTB Sherlock: Unit42
Unit42
HackTheBox Sherlock, rated Easy. DFIR box, working from Windows Event Logs (Sysmon).
Task 1: How many Event logs are there with Event ID 11?
Filtered for EventID 11 in Event Viewer.
Answer: 56
Task 2: What is the malicious process that infected the victim’s system?
Filtered for EventID 1 (process creation, with command line, hashes, and parent path). Only 6 entries total. 5 looked legitimate; this one stood out for the weird double extension and the Downloads path:
C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exeAnswer: C:\Users\CyberJunkie\Downloads\Preventivo24.02.14.exe.exe
Task 3: Which Cloud drive was used to distribute the malware?
Filtered for EventID 22 (DNS query). 3 entries, one resolving a Dropbox domain.
Answer: dropbox
Task 4: What was the timestamp changed to for the PDF file?
Filtered for EventID 2 (file creation time changed), Sysmon’s flag for time stomping. Logs the process making the change, the target file, the tampered timestamp, and the original. Found the entry with a PDF in TargetFilename and read CreationUtcTime.
Answer: 2024-01-14 08:10:06
Task 5: Where was “once.cmd” created on disk? Please answer with the full path along with the filename.
Back to EventID 11 (file create), searched TargetFilename for once.cmd.
Answer: C:\Users\CyberJunkie\AppData\Roaming\Photo and Fax Vn\Photo and vn 1.1.2\install\F97891C\WindowsVolume\Games\once.cmd
Task 6: The malicious file attempted to reach a dummy domain, most likely to check the internet connection status. What domain name did it try to connect to?
Back in the EventID 22 DNS queries, one entry for www.example.com: a standard connectivity check, not real C2.
Answer: www.example.com
Task 7: Which IP address did the malicious process try to reach out to?
Filtered for EventID 3 (network connection). Only one entry, destination IP 93.184.216.34, resolving back to the www.example.com check from Task 6.
Answer: 93.184.216.34
Task 8: The malicious process terminated itself after infecting the PC with a backdoored variant of UltraVNC. When did the process terminate itself?
Filtered for EventID 5 (process terminated). Only entry, referencing the malware, UTC timestamp 2024-02-14 03:41:58.
Answer: 2024-02-14 03:41:58
Sysmon Event ID cheat sheet
The box hands you this cheat sheet up front, but it’s worth keeping close since almost every task above hangs off it:
| Event ID | Meaning | Key fields |
|---|---|---|
| 1 | Process Creation/Execution | Process path, parent process path, command-line arguments |
| 2 | File Creation Time Changed | Process making the change, target file, tampered timestamp, original timestamp |
| 3 | Network Connection | Process making the connection, destination IP address, port |
| 5 | Process Termination | Name of the process killed or self-terminated |
| 11 | File Created | Process creating the file, file being created, full path |
| 22 | DNS Query | Process querying the domain, target domain name, resolved IP addresses |