CUSTOMMediumForensics

Infection

XESXOR9/2/20264 min read

#forensics#custom#medium#activitycache_analysis#custom_byte_shift_decoding#raw_memory_string_search#static_malware_analysis#windows

Infection

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: activitycache_analysis, custom_byte_shift_decoding, raw_memory_string_search, static_malware_analysis

Summary

Task: a large ZIP contains a Windows memory dump and the suspect's copied profile. Solution: use the activity timeline to identify a suspicious Desktop executable, reverse its persistence and C2 behavior, then decode the adjacent blob found in raw memory with a +0x10 byte shift to recover the flag.

Infection — HackerLab

Description

Vanya tried to hack the Pentagon, father captured a memory dump and copied Vanya's folder.

English summary: the archive contains a Windows memory dump (dump.vmem) and a copied user profile (vanya_hacker/). The goal is to reconstruct what malware was executed and recover the flag from the available forensic evidence.

Analysis

1. Start from the copied user artifacts

The ZIP was large, so downloading it with range requests was convenient:

 bash read-only • copy allowed
aria2c -x 16 -s 16 "https://hackerlab.pro/game_api/files/download?folder=parts_5406bb1b-ba5e-4a82-af83-a912ee1f361e_data&name=task&type=zip"
unzip -l task.zip

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Two artifacts mattered immediately:

dump.vmem — Windows memory dump
vanya_hacker/ — copied user profile

Inside the profile, the most useful forensic source was the Windows activity timeline database:

vanya_hacker/AppData/Local/ConnectedDevicesPlatform/L.vanya_hacker/ActivitiesCache.db

Useful quick checks:

 bash read-only • copy allowed
sqlite3 vanya_hacker/AppData/Local/ConnectedDevicesPlatform/L.vanya_hacker/ActivitiesCache.db \
  ".tables"

sqlite3 vanya_hacker/AppData/Local/Microsoft/Edge/User\ Data/Default/History \
  "SELECT url, title FROM urls LIMIT 10;"

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The Edge history database existed but did not contain useful visits, URLs, or download records. The activity timeline was much more revealing: it showed the Run dialog being opened, cmd.exe being launched, and then C:\Users\vanya_hacker\Desktop\hack_pentagon.exe being executed and staying active for hours.

That gave a clear next target: vanya_hacker/Desktop/hack_pentagon.exe.

2. Statically analyze the suspicious executable

Basic triage identified it as a 64-bit Windows console program:

 bash read-only • copy allowed
file vanya_hacker/Desktop/hack_pentagon.exe
strings -a vanya_hacker/Desktop/hack_pentagon.exe
rabin2 -i vanya_hacker/Desktop/hack_pentagon.exe
objdump -d vanya_hacker/Desktop/hack_pentagon.exe

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The import table strongly suggested persistence plus remote command execution:

RegCreateKeyExA, RegOpenKeyExA, RegSetValueExA
CreateProcessA
WSAStartup, WSASocketA, WSAConnect, gethostbyname, inet_addr, htons, inet_ntoa

Important strings extracted from the binary:

192.168.1.188
1337
Software\Microsoft\Windows\CurrentVersion\Run
hack_pentagon
Software\pentagon
1nfecTed
3?452Ik!^VUSDUTO\b WBQ]]OR0S[4 bm`
[For me] The decryption/encryption password is the same ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

From reverse analysis, the behavior was:

if not run as administrator, it prints a Russian message saying admin privileges are needed to hack the Pentagon;
it persists through HKLM\Software\Microsoft\Windows\CurrentVersion\Run\hack_pentagon = <current executable path>;
it stores an additional marker/config value at HKLM\Software\pentagon\1nfecTed = 3?452Ik!^VUSDUTO\b WBQ]]OR0S[4 bm`;
it connects to 192.168.1.188:1337;
it launches cmd.exe and redirects standard input/output/error to the socket. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

So the binary is a persistent reverse shell / backdoor. The last remaining question was whether the strange stored blob was the flag or something directly transformable into it.

3. Correlate the malware config with the memory dump

volatility3 windows.info worked on the memory dump, but process-list style plugins were unreliable because the VMEM image did not have matching VMSS/VMSN metadata. Raw memory searching still worked well enough for string correlation.

Searching the dump for the known C2 and config strings revealed the same encoded blob in memory next to the malware configuration at multiple offsets: ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

804065888
1045131872
1518504544

The repeated association between 192.168.1.188, 1337, and the encoded string strongly suggested that this blob was part of the malware's runtime-decrypted or runtime-stored data.

4. Decode the blob

Reverse analysis showed the main malicious code was self-decrypted at runtime with a per-byte +0x10 transformation. Applying the same byte shift to the stored blob decoded it cleanly.

 python read-only • copy allowed
#!/usr/bin/env python3
blob = b"3?452Ik!^VUSDUTO`b WBQ]]OR0S[4  bm"
decoded = bytes((b + 0x10) & 0xff for b in blob)
print(decoded.decode())

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Output:

 text read-only • copy allowed
CODEBY{REDACTED}

Solution

Download and inspect the ZIP contents.
Use ActivitiesCache.db from the copied user profile to reconstruct execution history.
Identify C:\Users\vanya_hacker\Desktop\hack_pentagon.exe as the suspicious long-running program.
Statically analyze the PE and confirm reverse-shell behavior, Run-key persistence, and embedded config strings.
Search raw memory for those same strings because full process reconstruction is unreliable without VMSS/VMSN metadata.
Locate the encoded blob next to the C2 configuration in memory.
Decode the blob with the same per-byte +0x10 transform recovered during reverse analysis.
Recover the flag. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Full minimal recovery script:

 python read-only • copy allowed
#!/usr/bin/env python3
blob = b"3?452Ik!^VUSDUTO`b WBQ]]OR0S[4  bm"

flag = bytes((b + 0x10) & 0xff for b in blob).decode()
print(flag)

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍