HTB Sherlock: ProcNet

Initial Triage

Extracting the provided zip file reveals two directories: DC and Employee.

Each directory contains a pcap file, a Sysmon log file, and an apmx64 file. The apmx64 file is an API capture data log generated by API Monitor.

The API capture data of the Employee directory shows three captured processes: csgo.exe, notepad.exe, and net.exe.

The DC directory shows five captured processes: fifa24.exe, two cmd.exe, and two powershell.exe processes.

The csgo.exe was run by the Employee from the Downloads directory, and fifa24.exe was run on the DC from the TEMP directory. This is a clear indication that csgo.exe and fifa24.exe are malicious files. My theory is that csgo.exe is malware executed by the Employee after downloading it from the internet, giving the attacker access to the Employee machine. The attacker then used that access to pivot to the DC and executed the fifa24.exe malware to gain access to it.

Task 1

To which IP address and port number is the malware attempting to establish a connection ?

Since I already theorized that csgo.exe is the initial malware executed by the Employee, I will start my analysis from the Employee directory.

The Protocol Hierarchy of the Employee.pcap file shows a high number of TCP packets.

In the Export Objects section, I can see four suspicious entries under HTTP. All of them point to the same IP address, 3.6.165.8, on ports 80 and 8080.

Using the filter ip.addr==3.6.165.8 to retrieve more information, I found the download source of both csgo.exe and fifa24.exe.

From this, I can conclude that 3.6.165.8 is the attacker IP address and 10.10.0.79 is the Employee machine IP address.

Tracing to the point where csgo.exe finished downloading, I can see that the machine continued to communicate with the attacker IP address, but this time using port 443.

Right after that is a POST request to the attacker IP address at the endpoint /register.html with the parameters d=7874085t7&vg=17119478.

My theory is that the malware is registering the infected machine with the C2 server using custom parameters.

Another way to solve this task is to check the Sysmon log file for the Employee machine, searching for the csgo.exe string.

The answer is 3.6.165.8:443

Task 2

Now that you are aware of the IP address and port number, what is the JA3 fingerprint of the C2 server ?

As mentioned before, right after csgo.exe finished downloading, the machine continued to communicate with the attacker IP address over port 443. So I just need to find the TLS handshake packets to get the JA3 fingerprint.

The answer is 19e29534fd49dd27d09234e639c4057e

Task 3

What is the name of the C2 framework being utilized by the red team ?

Searching online for the JA3 fingerprint 19e29534fd49dd27d09234e639c4057e:

The article can be found here

The answer is Sliver

Task 4

Which WIN32 API provided the red team with the current directory information ?

The challenge now requires me to analyze the API Monitor capture data log file, since the question asks about a WIN32 API.

As mentioned before, csgo.exe is the initial malware executed by the Employee, so I will start my analysis from the Employee directory.

The csgo.exe is the process of interest. Right off the bat, I can see that the GetCurrentDirectoryW API was called by the csgo.exe process.

The answer is GetCurrentDirectoryW

Task 5

Now that we have identified the C2 framework utilized by the red team, which C2 command is responsible for opening notepad.exe by default and loading the .NET CLR into it ?

The Sliver framework provides a handful of built-in commands as well as additional functionality through its armory. Both can be found in the Sliver Armory repository.

Following this wiki:

The answer is execute-assembly

Task 6

What is the name of the module (DLL) that was loaded to gain access to Windows Vault ?

From this wiki, I can see what each .dll is responsible for, including the one used to access the Windows Vault.

From Task 5, I know that the execute-assembly command opens notepad.exe and loads the .NET CLR into it. So the .dll must be loaded by the execute-assembly command into the notepad.exe process. The only Windows Vault .dll loaded into the notepad.exe process is vaultcli.dll.

The answer is vaultcli.dll

Task 7

After loading the mentioned module, there were a series of WIN32 APIs loaded. Which specific Win32 API is responsible for enumerating vaults ?

Here is where the vaultcli.dll module is loaded into the notepad.exe process.

Right after that, the VaultEnumerateVaults API is called by clr.dll to enumerate the vaults.

The answer is VaultEnumerateVaults

Task 8

Which command did the attacker execute to identify domain admins ?

The API Monitor capture data log file also shows an additional process executed on the Employee machine: the net.exe process.

Taking a look at the net.exe process, I can see the command line the attacker executed.

The answer is net group "domain admins" /dom

Task 9

The red team has provided us with a hint that they utilized one of the tools from "ARMORY" for lateral movement to DC01. What is the name of the tool ?

Continuing with the API Monitor capture data log file, I can see some interesting strings in the csgo.exe process.

These strings contain suspicious commands like executevbs, along with the returned DC machine name and the URL of the fifa24.exe malware.

Some digging on the internet and in the Armory repository gave me the answer.

The answer is sharpwmi

Task 10

Which command was executed by the red team to extract/dump the contents of NTDS.DIT ?

At this point, fifa24.exe is the process of interest, since it is the malware executed on the DC.

The API Monitor capture data log file shows numerous cmd.exe and powershell.exe processes spawned by the fifa24.exe process.

Checking each of the cmd.exe and powershell.exe processes, I can see the command line executed by the fifa24.exe process.

The answer is cmd /c ntdsutil "ac in ntds" ifm "cr fu %TEMP%\H00i0Z000.dat" q q

Task 11

The red team has obtained the aforementioned dump by compressing it into a ZIP file. Which specific Win32 API is responsible for retrieving the full path of the file to be downloaded?

Knowing the credentials dump file was H00i0Z000.dat, I can search for it in the API Monitor capture data log file to see when it was compressed into a ZIP file, then work my way back to find the specific Win32 API responsible for retrieving the full path of the file to be downloaded.

The answer is GetFullPathNameW