Rather than let the concepts stay theoretical, I built out my own analysis utilizing a VM using tools:<\/p>\n\n\n\n
- \n
- Wireshark<\/strong> \u2014 PCAP analysis<\/li>\n\n\n\n
- Splunk<\/strong> \u2014 log analysis<\/li>\n\n\n\n
- CyberChef<\/strong> – data analysis\/manipulation<\/li>\n\n\n\n
- Velociraptor<\/strong> \u2014 endpoint collection<\/li>\n\n\n\n
- Volatility3<\/strong> \u2014 memory analysis<\/li>\n\n\n\n
- Eric Zimmerman’s tools<\/strong> \u2014 Windows artifact analysis<\/li>\n<\/ul>\n\n\n\n
Then I worked the course’s compromise scenario end-to-end. Below is the investigation, organized the way I’d actually brief it: three questions every IR needs to answer. How did they get in? How did they stay? What did they take?<\/strong><\/p>\n\n\n\n
![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image.png\")
<\/figure>\n\n\n\nScope<\/h2>\n\n\n\n
- \n
- In scope:<\/strong> CLIENT2 \u2014
192.168.0.104<\/code>, useralice<\/code><\/li>\n\n\n\n- Timeframe:<\/strong> 2024-08-30 22:50:27 UTC onward<\/li>\n\n\n\n
- Environment:<\/strong> no AV or endpoint security enabled on the workstation by default<\/li>\n\n\n\n
- Reference hosts:<\/strong>
192.168.0.10<\/code> DC1 \u00b7192.168.0.1<\/code> Gateway + Splunk \u00b7192.168.0.104<\/code> CLIENT2<\/li>\n<\/ul>\n\n\n\nQuestion 1: How did they get in?<\/h2>\n\n\n\n
The lure<\/h3>\n\n\n\n
On August 30, 2024 at 22:56:20 UTC, the user Alice downloaded a file from:<\/p>\n\n\n\n
http[:]\/\/w1ndowsupdate.com:8000\/update.exe[.]hta<\/code><\/pre>\n\n\n\nTwo red flags before you even open a tool. First, the domain is typosquatted<\/strong> \u2014 “windows” spelled with a numeral 1. Second, the double extension(
.exe.hta<\/code>). An HTA (HTML Application) executes with full trust viamshta.exe<\/code>, a classic living-off-the-land binary.<\/p>\n\n\n\nFrom the SOC side, I’d normally catch this as a DNS or proxy alert on a newly-registered\/lookalike domain or behavioral watchlist surrounding .mshta bevahior. But here I had no alert \u2014 just a PCAP. So the question becomes: can I reconstruct the delivery myself?<\/p>\n\n\n\n
Confirming delivery in Wireshark<\/h3>\n\n\n\n
I started where you always should: Statistics \u2192 Conversations \/ Protocol Hierarchy<\/strong> to understand the shape of the traffic, then a DNS query<\/strong> for the download domain to resolve the attacker infrastructure.<\/p>\n\n\n\n
ip.addr == 3.140.33.120<\/code><\/pre>\n\n\n\nFiltering on that address surfaced the full HTTP conversation \u2014 CLIENT2’s GET to the domain, and the response delivering the file. Wireshark carves it straight out of the capture (File \u2192 Export Objects \u2192 HTTP<\/strong>), so I now had the actual
.hta<\/code> the victim executed, on my own analysis box.<\/p>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-2.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-3.png\")
<\/figure>\n\n\n\nI also noticed traffic outside port 80 immediately \u2014 an early tell that this wasn’t going to end at the download. Flagged it, moved on to the payload.<\/p>\n\n\n\n
Question 2: What did the payload do?<\/h2>\n\n\n\n
First stage: the HTA stager<\/h3>\n\n\n\n
![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-4.png\")
<\/figure>\n\n\n\nOpening the carved
.hta<\/code>, the structure identifies it as an initial stager<\/strong> \u2014 the first link in the kill chain. On execution it phones home, retrieves the real agent code, and runs it in memory viaIEX<\/code>. The encoded call decodes cleanly in CyberChef:<\/p>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-5.png\")
<\/figure>\n\n\n\nBase64: aAB0AHQAcAA6AC8ALwAzAC4AMQA0ADAALgAzADMALgAxADIAMAA6ADkAMAAwADEA\n \u2192 http:\/\/3.140.33.120:9001<\/code><\/pre>\n\n\n\nSo the stager reaches back to 3.140.33.120:9001<\/strong> and pulls the next stage from
\/login\/process.php<\/code>. Nothing touches disk beyond the initial.hta<\/code> \u2014 the agent lives in memory.<\/p>\n\n\n\nFingerprinting the framework<\/h3>\n\n\n\n
Pulling the HTTP indicators together gave a clean profile of the C2:<\/p>\n\n\n\n
Indicator<\/th> Value<\/th><\/tr><\/thead> C2 endpoint<\/td> 3.140.33.120:9001<\/code> (AWS-hosted \u2014 verify against your own TI)<\/td><\/tr>Full URL<\/td> http:\/\/3.140.33.120:9001\/login\/process.php<\/code><\/td><\/tr>User-Agent<\/td> Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko<\/code><\/td><\/tr>Cookie<\/td> MbQrWboBJij=v2\/3voIg4rUQ+JdKIqTSWsTshLk=<\/code><\/td><\/tr>RC4 key<\/td> !hz%2x6mtC0AeYV,5Wju84\/[snLaXH_D<\/code><\/td><\/tr>Framework<\/td> PowerShell Empire<\/strong> \/ fork \u2014 RC4 staging, 4-byte IV-prepend protocol<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n The RC4 staging key and the IV-prepend handshake are the signature. That User-Agent is Empire’s default. <\/p>\n\n\n\n
Question 3: How did they stay \u2014 and escalate?<\/h2>\n\n\n\n
Network IOCs in hand, I pivoted to Splunk. Filtering to the malicious PowerShell Process GUID<\/strong> let me isolate that one process and follow it.<\/p>\n\n\n\n
Beaconing<\/h3>\n\n\n\n
Sysmon Event ID 3<\/strong> (network connection) off that process GUID showed the host hitting
3.140.33.120<\/code> on a one-second interval<\/strong> which textbook beaconing, confirmed with atimechart count by DestinationPort<\/code> against the C2 destination. A fixed one-second cadence is loud; real operators add jitter, which is precisely why interval-based detections need tolerance windows rather than exact-match logic. (Straight into my detection-tuning notes.)<\/p>\n\n\n\nPersistence #1 \u2014 registry Run key (22:59:43)<\/h3>\n\n\n\n
Filtering the non<\/em>-network events off the same GUID surfaced the persistence chain. A Run key under HKU<\/strong>:<\/p>\n\n\n\n
TargetObject: HKU\\...\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater\nDetails: powershell.exe -c \"$x=$((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug);\n powershell -Win Hidden -enc $x\"<\/code><\/pre>\n\n\n\nNote the tradecraft: the run key doesn’t contain<\/em> the payload \u2014 it reads the real encoded command out of a
Debug<\/code> registry value<\/strong> and executes it hidden. The payload hides in the registry; the run key is just a pointer. That’s a detail an “autoruns” glance would miss.<\/p>\n\n\n\nThe escalation \u2014 SilentCleanup UAC bypass (23:00:21)<\/h3>\n\n\n\n
This was the most instructive artifact in the whole lab. In sequence:<\/p>\n\n\n\n
23:00:21 whoami.exe \/groups\n23:00:21 schtasks.exe \/Run \/TN \\Microsoft\\Windows\\DiskCleanup\\SilentCleanup \/I<\/code><\/pre>\n\n\n\nSilentCleanup<\/code> is a built-in scheduled task that auto-elevates<\/strong> \u2014 it runs with high integrity without<\/em> a UAC prompt. Because parts of its execution path are attacker-controllable, triggering it is a well-documented UAC bypass<\/strong>. This isn’t housekeeping; it’s a privilege escalation disguised as disk cleanup.<\/p>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-6.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-7.png\")
<\/figure>\n\n\n\nThe proof is in the very next relevant event:<\/p>\n\n\n\n
23:09:14 systeminfo.exe \u2192 IntegrityLevel: High<\/code><\/pre>\n\n\n\nPost-SilentCleanup, the attacker’s commands are running at High<\/strong> integrity. That’s the elevation moment, caught in the timeline.<\/p>\n\n\n\n
Persistence #2 \u2014 the redundant SYSTEM task (23:01:14)<\/h3>\n\n\n\n
Not satisfied with one foothold, the attacker planted a second, stronger one:<\/p>\n\n\n\n
schtasks.exe \/Create \/F \/RU system \/SC ONLOGON \/TN Updater \/TR\n \"powershell.exe -NonI -W hidden -c \\\"IEX ([Text.Encoding]::UNICODE.GetString(\n [Convert]::FromBase64String((gp HKLM:\\Software\\Microsoft\\Network debug).debug)))\\\"\"<\/code><\/pre>\n\n\n\nSame read-from-registry trick as the run key, but escalated on every axis: runs as SYSTEM<\/strong>, triggers ONLOGON<\/strong>, and pulls its payload from HKLM<\/strong> (machine-wide) instead of HKU (per-user). Two independent persistence mechanisms reading from two different registry hives \u2014 if a responder kills one, the other survives.<\/p>\n\n\n\n
Question 4: What did they take?<\/h2>\n\n\n\n
The collection and exfil sequence, all at High integrity:<\/p>\n\n\n\n
23:10:04 powershell -command compress-archive C:\\users\\alice\\documents\n -destinationpath c:\\temp\\1.zip\n23:13:51 powershell -command remove-item -path C:\\Temp\\1.zip<\/code><\/pre>\n\n\n\nArchive Alice’s Documents to
C:\\Temp\\1.zip<\/code>, then delete the staging archive to cover the collection.<\/p>\n\n\n\nThe exfil itself showed up back in the packet capture \u2014 and here’s the detail worth pausing on. The stager beacons on 9001<\/strong>, but the data movement was a separate TCP stream on port 9003<\/strong>. I built a Wireshark I\/O graph<\/strong> on destination port 9003 to visualize the transfer, then read the TCP conversation statistics: ~4 MB<\/strong> moved to the external host.<\/p>\n\n\n\n
![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-8-1024x387.png\")
<\/figure>\n\n\n\nIn an enterprise incident you’d expect GB or TB, not megabytes but that’s exactly the teaching point. The analyst’s job is spotting the outlier<\/em>, not a threshold. A steady 9003 stream that doesn’t match the 9001 beacon pattern is the anomaly, regardless of absolute size.<\/p>\n\n\n\n
Pivoting with Velociraptor<\/h2>\n\n\n\n
With CLIENT2 confirmed, I used Velociraptor<\/strong> the way you would to scope an incident across a fleet:<\/p>\n\n\n\n
- \n
- Hunted for
.hta<\/code> files<\/strong> dropped in user directories, confirming CLIENT2 (C:\\Users\\alice\\Downloads\\update.exe.hta<\/code>) was the only<\/strong> host with the file, then pulling it directly for inspection.<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-9.png\")
<\/figure>\n\n\n\n- \n
- Hunted scheduled tasks<\/strong> in the Tasks folder \u2014 surfacing the malicious
Updater<\/code> task.<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-10.png\")
<\/figure>\n\n\n\n- \n
- Hunted Startup folders and Run keys<\/strong> \u2014 confirming the registry persistence at scale.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/shaynepatelcybersecurityportfolio.online\/wp-content\/uploads\/2026\/07\/image-11.png\")
<\/figure>\n\n\n\nThis is the closing move of a real triage: network IOCs from the wire \u2192 SIEM to find
mshta<\/code> spawningpowershell.exe<\/code> across the environment \u2192 EDR\/Velociraptor to confirm scope and collect. Same muscle memory as production, just with me driving every tool instead of reading a detection summary.<\/p>\n\n\n\nFull timeline<\/h2>\n\n\n\n
Time (UTC)<\/th> Event<\/th><\/tr><\/thead> 22:56:20<\/td> alice<\/code> downloadsupdate.exe.hta<\/code> from typosquattedw1ndowsupdate.com:8000<\/code><\/td><\/tr>\u2014<\/td> HTA stager executes, beacons to 3.140.33.120:9001<\/code>, pulls agent viaIEX<\/code><\/td><\/tr>22:59:43<\/td> Persistence #1 \u2014 HKU Run\\Updater<\/code> key (payload hidden inDebug<\/code> value)<\/td><\/tr>23:00:21<\/td> whoami \/groups<\/code>, then SilentCleanup UAC bypass<\/strong> triggered<\/td><\/tr>23:01:14<\/td> Persistence #2 \u2014 SYSTEM \/ ONLOGON Updater<\/code> task (payload in HKLM)<\/td><\/tr>23:09:14<\/td> systeminfo<\/code> confirms High<\/strong> integrity \u2014 escalation successful<\/td><\/tr>23:10:04<\/td> Alice’s Documents archived to C:\\Temp\\1.zip<\/code><\/td><\/tr>23:13:51<\/td> Staging archive deleted<\/td><\/tr> \u2014<\/td> ~4 MB exfiltrated over separate TCP stream on port 9003<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n MITRE ATT&CK Mapping<\/h2>\n\n\n\n
Tactic<\/th> Technique<\/th><\/tr><\/thead> Resource Development<\/td> T1583.001 \u2014 Acquire Infrastructure: Domains<\/td><\/tr> Initial Access<\/td> T1566 \u2014 Phishing<\/td><\/tr> Execution<\/td> T1204.002 \u2014 User Execution: Malicious File; T1059.001 \u2014 PowerShell; T1218.005 \u2014 Mshta<\/td><\/tr> Persistence<\/td> T1547.001 \u2014 Registry Run Keys; T1053.005 \u2014 Scheduled Task<\/td><\/tr> Privilege Escalation<\/td> T1548.002 \u2014 Bypass UAC (SilentCleanup)<\/td><\/tr> Defense Evasion<\/td> T1027 \u2014 Obfuscated Files or Information; T1140 \u2014 Deobfuscate\/Decode; T1112 \u2014 Modify Registry; T1070.004 \u2014 Indicator Removal: File Deletion<\/td><\/tr> Discovery<\/td> T1033 \u2014 System Owner\/User Discovery; T1082 \u2014 System Information Discovery<\/td><\/tr> Command & Control<\/td> T1071.001 \u2014 Application Layer Protocol: Web; T1573 \u2014 Encrypted Channel (RC4)<\/td><\/tr> Collection<\/td> T1560.001 \u2014 Archive Collected Data<\/td><\/tr> Exfiltration<\/td> T1041 \u2014 Exfiltration Over C2 Channel<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n What this changes about how I work<\/strong><\/p>\n\n\n\n
Visibility is the investigation.<\/strong> Every pivot above depended on evidence existing before the incident: PCAPs, Sysmon, process GUIDs to thread events together. On a box with no AV enabled, the logging was the only reason there was a story to tell at all. As a quick proof of that principle, I also ran
strings<\/code> against the memory capture and pulled every domain the host had visited straight from RAM. One command, no forensic suite. If the evidence exists, even trivial tooling talks.<\/p>\n\n\n\nDetections have anatomy.<\/strong> I now know exactly what “beaconing detected” is built on, and therefore how it breaks: jitter, longer intervals, a second channel on a different port. Knowing that the exfil rode 9003 while the beacon sat on 9001 is the difference between triaging an alert and writing a better one.<\/p>\n\n\n\n
Legitimate features are attack surface.<\/strong> The single sharpest lesson here was SilentCleanup. The attacker did not bring an exploit to escalate or a wiper to clean up. They used a built-in Windows maintenance task to bypass UAC, and read their real payloads out of the registry so persistence looked like a pointer, not a program. The adversary’s escalation path and staging were your own OS. That is what I will be looking for differently on Monday.<\/p>\n","protected":false},"excerpt":{"rendered":"
As an SOC analyst, I see this attack pattern constantly: user downloads something they shouldn’t, PowerShell spawns, EDR fires, I triage, isolate, escalate, write it up. But there’s a layer underneath every one of those alerts that the SOC workflow rarely forces you to touch which are the raw packets, the memory image, the disk […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-192","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/posts\/192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=192"}],"version-history":[{"count":1,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/posts\/192\/revisions"}],"predecessor-version":[{"id":206,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=\/wp\/v2\/posts\/192\/revisions\/206"}],"wp:attachment":[{"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/shaynepatelcybersecurityportfolio.online\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Hunted Startup folders and Run keys<\/strong> \u2014 confirming the registry persistence at scale.<\/li>\n<\/ul>\n\n\n\n
- Hunted scheduled tasks<\/strong> in the Tasks folder \u2014 surfacing the malicious
- Timeframe:<\/strong> 2024-08-30 22:50:27 UTC onward<\/li>\n\n\n\n
- Splunk<\/strong> \u2014 log analysis<\/li>\n\n\n\n