Digital Forensics

Windows Endpoint Compromise

Scenario

A targeted phishing campaign was carried out against the organization, and the phishing email had already been opened on three systems across the network. A quick triage image was collected from one of the infected hosts for identification of the attacker's tactics and techniques, so the incident response team could respond and contain any further compromise.

This investigation was focused on manual artifact analysis using Eric Zimmerman's tools suite. Some findings required additional research beyond standard artifact parsing.

Evidence Collected

Artifact	Source	Key Evidence	Why It Mattered
Shellbags	[root]\Users\CyberJunkie\NTUSER.dat	...\Downloads\MailDownloads	Revealed the path to the phishing document
Recycle Bin	$Recycle.Bin\S-1-5-21-...-1001\$lWKWHDC	Security Awareness.docx	Deleted phishing document was recovered
Prefetch	[root]\Windows\Prefetch	SECURITYPATCH.EXE	Confirmed the dropped stager was executed
$MFT	[root]\Users\CyberJunkie\$MFT	SECURITYPATCH.EXE	Timestamp had been altered by the attacker
Registry	...\SilentProcessExit\explorer.exe	GetPatch.exe	Explorer.exe was hijacked to execute the stager
RDP Cache	...\Terminal Server Client\Cache	bcache24.bmc, Cache0000.bin	Confirmed RDP lateral movement
System Logs	\System32\winevt\Logs\System.evtx	cmd.exe /c echo kyvckn > \.\pipe\kyvckn	Indicated privilege escalation activity

Timeline

Time (UTC)	User	Event	Source
2022-08-21 12:55:33	Cyberjunkie	Directory access	Shellbags
2022-08-21 13:02:23	Cyberjunkie	Timestamp modified	$MFT
2022-08-21 13:03:08	Cyberjunkie	Process execution	Prefetch
2022-08-21 14:03:33	Cyberjunkie	File deletion	Recycle Bin
2022-09-08 14:34:52	Cyberjunkie	Persistence established	Registry
Unvalidated	Cyberjunkie	Privilege escalation	System Logs

Key Findings

The compromise originated from a malicious phishing document delivered to the user.
A malicious stager identified as SECURITYPATCH.EXE was executed on the host.
Timestamp manipulation of the stager was identified, likely intended to hinder analysis.
Persistence was established via the GlobalFlags / SilentProcessExit technique using GetPatch.exe.
Command execution led to privilege escalation consistent with Metasploit framework activity.
Post-exploitation activity included account enumeration and use of PowerView.ps1.

Attack Chain

Initial Access

Malicious document (Security Awareness.docx) delivered via phishing email.

Execution

Opening the document triggered execution of a stager identified as SECURITYPATCH.EXE.

Persistence

Configured through the GlobalFlags / SilentProcessExit technique to execute GetPatch.exe.

Lateral Movement

RDP activity observed, alongside post-exploitation commands including net localgroup and PowerView.ps1.

Privilege Escalation

Activity consistent with Metasploit-style named pipe usage via cmd.exe.

Impact

Host remained under attacker control through persistence mechanisms and post-exploitation tooling.

Analyst Notes

Initial analysis focused on identifying the phishing document responsible for the compromise.

Shellbags and Recycle Bin artifacts were correlated to confirm user interaction with the document.

Prefetch analysis was used to identify the executable launched after document access.

Timeline reconstruction revealed timestamp inconsistencies associated with SECURITYPATCH.EXE.

Additional research was required to identify persistence through the GlobalFlags / SilentProcessExit technique.

RDP cache artifacts and PowerView activity suggested post-exploitation actions beyond the initial compromise.

Lessons Learned

Correlating multiple artifacts provides stronger evidence than relying on a single source.
Timeline reconstruction can reveal inconsistencies that warrant further investigation.
Timestamp analysis should be validated across multiple artifacts before drawing conclusions.
Persistence mechanisms may not always be obvious and can require additional registry analysis.