Export

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

We spotted a suspicious connection to one of our servers, and immediately took a memory dump. Can you figure out what the attackers were up to?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Got a .raw file which is a memory dump of a system in which memory forensics was done to figure out what is going on during the time the dump created.

3. So let's use memory forensics tools named Volatility.

4. Based from the result, the top suggested profile is Win7SP1x64 which means that the system in question is likely a Windows 7 SP1 64 bit system.

5. Since the profile is determined, hence we can run this command:

vol.py -f WIN-LQS146OE2S1-20201027-142607.raw --profile=Win7SP1x64 pslistt

1. The cmd.exe caught my attention, let's use cmdscan.

vol.py -f WIN-LQS146OE2S1-20201027-142607.raw --profile=Win7SP1x64 cmdscan

1. Let's paste the encoded url to cyberchef.

2. Notice there's a base64 encoded text.

3. Let's decode that.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.