Stockpile Breach

Platform: 0xl4ugh | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-01-23 | Status: Solved Techniques: c2_detection, registry_persistence, sysmon_log_analysis, timeline_analysis

Summary

Task: Analyze a Windows triage image to reconstruct a malware attack timeline and answer 11 incident response questions. Solution: Parse Sysmon EVTX logs to identify the malware download source (Zone.Identifier ADS), execution timeline, C2 communication (Sliver framework at 3.121.219.28:8888), persistence via registry Run key, and file artifacts.

Stockpile Breach - 0xl4ugh CTF

Description

The SOC team received an alert indicating suspicious command executions from an external IP targeting finance employee Khaled's workstation. The commands appear to have been executed remotely, raising concerns of potential compromise. Initial threat intelligence links the IP to known malicious activities.

As a DFIR analyst, you have been provided with a triage image of Khaled's machine for further investigation. Your objective is to analyze the image, identify indicators of compromise (IOCs), determine the attack vector, and assess the impact. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

This was a Windows DFIR challenge with a triage image containing Sysmon logs. The challenge consisted of 11 questions about the attack chain that needed to be answered correctly to get the flag.

Key Artifacts

The triage image contained:

• Windows Event Logs (EVTX files)
• Sysmon Operational logs
• Registry hives
• PowerShell logs

Attack Chain Reconstruction

Using Sysmon logs, I reconstructed the complete attack timeline:

1. Initial Access: User khaled.allam downloaded monitorStock.exe from http://app.finance.com/monitorStock.exe
2. Execution: Malware was executed from the Downloads folder
3. C2 Communication: Malware connected to C2 server at 3.121.219.28:8888 using Sliver framework
4. Reconnaissance: Attacker ran whoami command
5. Persistence:
   • Malware copied to C:\Windows\Temp\monitorStock.exe
   • Registry Run key added for persistence ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Sysmon Event Analysis

EventID 15 - Zone.Identifier

This was crucial for finding the download source. When a file is downloaded via browser, Windows creates an Alternate Data Stream (ADS) called Zone.Identifier containing the source URL: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

HostUrl=http://app.finance.com/monitorStock.exe

Solution

Tool: Parse EVTX Files

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import sys
import Evtx.Evtx as evtx
import xml.etree.ElementTree as ET


def parse_evtx(evtx_file, max_records=None):
    with evtx.Evtx(evtx_file) as log:
        count = 0
        for record in log.records():
            if max_records and count >= max_records:
                break
            try:
                xml_str = record.xml()
                print(f"=== Record {record.record_num()} ===")
                print(xml_str)
                print()
            except Exception as e:
                print(f"Error parsing record: {e}", file=sys.stderr)
            count += 1
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: parse_evtx.py <evtx_file> [max_records]")
        sys.exit(1)

    evtx_file = sys.argv[1]
    max_records = int(sys.argv[2]) if len(sys.argv) > 2 else None
    parse_evtx(evtx_file, max_records)

Automated Answer Submission

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

r = remote("challenges2.ctf.sd", 34927)

# All 11 answers
answers = [
    "app.finance.com",                                                    # Q1: Domain
    "2025-02-07 04:37:06 UTC",                                           # Q2: Download time
    "2025-02-07 04:41:24 UTC",                                           # Q3: Execution time
    "314AA91A2AD7770F67BF43897996A54042E35B6373AE5D6FEB81E03A077255A7",  # Q4: SHA256
    "3.121.219.28:8888",                                                 # Q5: C2 IP:port
    "whoami",                                                            # Q6: First command
    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",                 # Q7: Registry key (NO HKCU!)
    "C:\\Windows\\Temp\\monitorStock.exe",                               # Q8: Registry value
    "2025-02-07 04:43:51 UTC",                                           # Q9: File copy time
    "2025-02-07 04:45:03 UTC",                                           # Q10: Registry add time
    "Sliver",                                                            # Q11: C2 Framework
]
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

for answer in answers:
    r.recvuntil(b"Please enter your answer: ")
    r.sendline(answer.encode())

r.interactive()

Answers to 11 Questions

Tricky Part: Registry Key Format

Important: For Q7, the answer was SOFTWARE\Microsoft\Windows\CurrentVersion\Run without the HKCU\ prefix! This was tricky because:

• Sysmon logs show the full path with HKU\<SID>\...
• The challenge expected only the relative path under the hive

IOCs

References

• Sysmon Event IDs
• Sliver C2 Framework
• Zone.Identifier ADS
• MITRE ATT&CK T1547.001 - Registry Run Keys ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍