Table of Contents

• Context
• Reconnaissance
• Overview — Process Tree
• Attack Chain
  • 1. Initial Access — ISO Phishing + HTA (Q1)
  • 2. Staging — DLL Payload Copy (Q2)
  • 3. Execution — DLL Sideloading (Q3)
  • 4. Persistence — Scheduled Task (Q4)
  • 5. Command & Control (Q5)
  • 6. Privilege Escalation — UAC Bypass (Q6)
  • 7. Credential Access — Mimikatz (Q7, Q8)
  • 8. Discovery — Network Share (Q9)
  • 9. Lateral Movement — WinRM (Q10, Q11, Q12)
  • 10. Credential Access — Pass-the-Hash + DCSync (Q13, Q14)
  • 11. Actions on Objectives — Ransomware (Q15)
• Tools Used
• What Didn't Work
• Lessons Learned

Boogeyman 3 #

🏴 Platform: TryHackMe
🔬 Category: DFIR / Threat Hunting (ELK)
🟠 Difficulty: Medium
📅 Date: 2026-02-14
✍️ Author: t0nt0n
⏱️ Reading time: ~5 min

Context #

Quick Logistics LLC was targeted by the Boogeyman threat group in a sophisticated attack. The analysis relies on Sysmon and Windows logs ingested into an ELK stack (index winlogbeat-*). The goal: trace the full attack chain from initial phishing to ransomware deployment.

Reconnaissance #

Kibana index: winlogbeat-* Time range: August 29-30, 2023 Machines involved: WKSTN-0051, WKSTN-1327, DC01.quicklogistics.org

Overview — Process Tree #

WKSTN-0051 (evan.hutchinson)
│
├─ iexplore.exe
│  └─ download: ProjectFinancialSummary_Q3.pdf.iso
│     └─ mount ISO → D:\
│
├─ mshta.exe [PID ????]                        ← Q1  HTA execution
│  │  cmd: D:\ProjectFinancialSummary_Q3.pdf.hta
│  │
│  ├─ xcopy.exe                                 ← Q2  Copy DLL to %TEMP%
│  │     D:\review.dat → %TEMP%\review.dat
│  │
│  ├─ rundll32.exe                              ← Q3  DLL sideload
│  │  │  review.dat,DllRegisterServer
│  │  │
│  │  └──── C2: ???.???.???.???:??              ← Q5  C2 callback
│  │
│  └─ powershell.exe                            ← Q4  Persistence
│        schtasks /create "??????"
│
├─ ????????????.exe                              ← Q6  UAC Bypass
│
├─ mimikatz.exe                                 ← Q7  Downloaded from GitHub
│  │  sekurlsa::logonpasswords
│  └─ ????????:????????????????                 ← Q8  Credential dump
│
├─ net use \\WKSTN-1327\ITFiles                 ← Q9  Discovery
│  └─ read: ??????????????.ps1
│     └─ creds: QUICKLOGISTICS\??????????       ← Q10 Cleartext creds
│
└─ Invoke-Command -ComputerName ??????????      ← Q11 Lateral movement

         ??????????
         │
         ├─ ??????????????.exe                   ← Q12 Parent process (WinRM)
         │
         ├─ mimikatz.exe
         │  │  sekurlsa::pth (Pass-the-Hash)
         │  └─ ?????????????:????????????????   ← Q13 Admin hash
         │
         └─ lsadump::dcsync                     ← Q14 DCSync
               account: ????????

                  DC01.quicklogistics.org
                  │
                  └─ powershell.exe
                     │  iwr http://??????????????
                     │      /??????????????.exe         ← Q15
                     │
                     └─ ransomware deployment
                        ├─ WKSTN-0051
                        ├─ WKSTN-1327
                        └─ DC01

Attack Chain #

1. Initial Access — ISO Phishing + HTA (Q1) #

An ISO file containing a double-extension HTA was used to trick the victim.

process.command_line: *.hta*

Result: mshta.exe executes the .pdf.hta payload from the mounted ISO drive. Look for the PID in the Sysmon Event ID 1 log.

2. Staging — DLL Payload Copy (Q2) #

process.parent.name: mshta.exe

Three child processes identified:

• xcopy — copies the DLL
• rundll32 — executes the DLL
• powershell — creates a scheduled task

The xcopy command reveals the full staging path. Check the complete command line.

3. Execution — DLL Sideloading (Q3) #

The malicious DLL is loaded via rundll32.exe with DllRegisterServer as the export function.

4. Persistence — Scheduled Task (Q4) #

A scheduled task is created via PowerShell. Filter on schtasks in the command line to find the task name.

5. Command & Control (Q5) #

process.name: rundll32.exe AND event.category: network

Look for the destination IP and port in the network connection event from rundll32.exe.

6. Privilege Escalation — UAC Bypass (Q6) #

process.name: (fodhelper.exe OR eventvwr.exe OR computerdefaults.exe OR sdclt.exe)

One of these classic UAC bypass binaries was used.

7. Credential Access — Mimikatz (Q7, Q8) #

Search for the mimikatz download:

process.command_line: *github*

The full GitHub URL answers Q7. Then search for sekurlsa::logonpasswords output to find the dumped username:NTLM hash pair for Q8.

8. Discovery — Network Share (Q9) #

host.name: WKSTN-0051* AND process.command_line: *\\\\*

A script file was found on a remote share containing cleartext credentials.

9. Lateral Movement — WinRM (Q10, Q11, Q12) #

The script contains credentials in DOMAIN\user:password format. Search for Invoke-Command to find the target machine, and look for the parent process spawned by WinRM on the target.

10. Credential Access — Pass-the-Hash + DCSync (Q13, Q14) #

On the second machine, mimikatz is used again with sekurlsa::pth and lsadump::dcsync. Look for the administrator NTLM hash and the account name used for DCSync.

11. Actions on Objectives — Ransomware (Q15) #

host.name: DC01* AND process.command_line: (*download* OR *iwr* OR *http*)

The ransomware is downloaded via PowerShell and deployed across all three machines.

Tools Used #

• Kibana Discover (ELK stack)
• KQL (Kibana Query Language)
• Sysmon Event ID 1 (Process Create)
• Windows Event ID 4624 (Logon)
• Windows Event ID 4104 (ScriptBlock Logging)

What Didn't Work #

• Initial KQL query with double quotes inside wildcards (*".iso"*) — syntax error. Fixed by using *.iso* without quotes.
• Q10: initial answer without domain prefix (allan.smith:...). The expected format includes the domain prefix.

Lessons Learned #

• In KQL, do not put double quotes inside wildcards — use *.extension* directly
• Always include the domain in credentials when the context is Active Directory
• wsmprovhost.exe as a parent process is a reliable indicator of lateral movement via WinRM/PowerShell Remoting
• fodhelper.exe remains a very common UAC bypass technique in real-world attack scenarios
• IT automation scripts stored on network shares are a frequent source of cleartext credentials

⬛⚪⬛
⬛⬛⚪  ☠ user
⚪⚪⚪  rm -rf /ignorance && echo 42 > /dev/brain