BFT

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

In this Sherlock, you will become acquainted with MFT (Master File Table) forensics. You will be introduced to well-known tools and methodologies for analyzing MFT artifacts to identify malicious activity. During our analysis, you will utilize the MFTECmd tool to parse the provided MFT file, TimeLine Explorer to open and analyze the results from the parsed MFT, and a Hex editor to recover file contents from the MFT.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: MFT.

Detailed Investigation

1. In this task we're given a MFT file which we can analyze using MFT Explorer. But I prefer to analyze it by converting the raw MFT file to a .csv format.
2. Then analyze the CSV file using Timeline Explorer.
3. To convert the raw MFT file to .csv format, you can either use analyzeMFT or MFTECmD.exe. Both also can be used for the same purpose.

1ST QUESTION --> ANS: REDACTED

1. For this writeup, I used MFTECmD.exe to convert the raw MFT to .csv file.

Converting mft.raw file to .csv file.

1. Now let's upload it to Timeline Explorer.

2. The easiest way to identify the zip filename which Simon downloaded at 13th February, we just have to search for .zip and correlate the timestamp.

3. Found one zip file that looks convincing based on it's timestamp and it's file path.

4. However, found another zip file that resides in the Download directory. Interesting!

5. To improve the visibility, I sorted the parent path then custom the filter for only Downloads directory of user Simon.

6. Great! Based from the results above, seems there are only 2 .zip files inside Simon Downloads directory at 13th February 2024.

7. Further analysis, found that Stage-20240213T093324Z-001.zip is unzipped and has another .zip file inside it named invoices.zip.

8. Then found out a .bat file inside invoice.zip. This is absolutely indicating a malicious file.

Notes

A .bat file is a batch file in Windows, which is essentially a script containing a series of commands that are
executed in sequence. These files are often used to automate tasks or run multiple commands at once.

1. Noticed the file size is only 286 bytes. Hence it should be stored directly at the MFT entry.

Notes

When a file is small enough to be stored entirely within the MFT record, it can improve access times because the file
data can be read directly from the MFT without the need to access additional disk sectors. This technique is often used
for system files and other small files that are frequently accessed.

1. Knowing this, then let's analyze invoice.bat's content by uploading raw MFT file using MFT Explorer.

2. Based from the result above, we can see there is a C2 IP and it's port which are as the web server to download a file.

3. Another alternative way to review the content of invoice.bat file, simply upload the raw MFT file to a hexeditor then calculate the offset.

 MD read-only • copy allowed Copy
OFFSET for MFT Entry

Entry number of invoice.bat file --> 23436 (you can see it at Timeline Explorer, there's a column for it).
Each entry is 1024 bytes.

Offset --> 23436 * 1024 = 23998464.
Convert it to hex = 0x16E3000

Using hexeditor and open at offset 0x16E3000, shows the invoice.bat's content.

1. Great! We hunted the malicious file then.

2ND QUESTION --> ANS: REDACTED

1. To identify the full HOST URL, open Time Explorer again then filter the malicious zip file and check the Zone id Contents column.

3RD QUESTION --> ANS: REDACTED

1. To identify the full path, simply filter for the malicious file we hunt before (invoice.bat) then look at the bottom for the full path.

4TH QUESTION --> ANS: REDACTED

1. To identify the timestamp for the file creation on disk, simply check Created0x30 column.

5TH QUESTION --> ANS: REDACTED

1. Previously we already calculated the offset as an alternative way to investigate the .bat's content.
2. The calculation is performed by multiply the Entry Number with 1024 then convert it to hex.

6TH QUESTION --> ANS: REDACTED

1. Again, previously we already identified the C2 IP and it's port by reviewing the .bat's file content.
2. Finally, we investigated the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Parsing Master File Table (MFT) raw file using MFT Explorer.
2. Using MFTECmD to convert MFT raw file to csv.
3. Identify downloaded malicious file.