Hyperfiletable

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

There has been a new joiner in Forela, they have downloaded their onboarding documentation, however someone has managed to phish the user with a malicious attachment. We have only managed to pull the MFT record for the new user, are you able to triage this information?

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: python.
• Artifacts: MFT.

Detailed Investigation

1. In this challenge we're given a raw data file of MFT record for the new user.

2. To analyze this file, we need to parse it first.

3. To parse the file I used analyzeMFT and convert the output to .csv file.

python3 'C:\CTF\TOOLS-FOREN\analyzeMFT\analyzeMFT.py' -f .\mft.raw -o analyzed_mft.csv

1ST QUESTION --> ANS: REDACTED

1. To get the MD5 hash of the MFT, we can use md5sum command in Linux.

2ND QUESTION --> ANS: REDACTED

1. To identify the user's name on the system, we can filter our search with this --> /Users/.

2. Randy Savage stands out as the only user we can see here.

3RD QUESTION --> ANS: REDACTED

1. To get the malicious filename, I start by searching .hta and it resulting to only 1 filename namely --> Onboarding.hta.
2. This concludes that it is indeed the malicious file.

4TH QUESTION --> ANS: REDACTED

1. To identify the ZoneIdentifier of the download for the malicious HTA file, we can parse the mft.raw file using MFTExplorer.

What is ZoneID?
The Zone Identifier is a piece of metadata associated with files that are downloaded from the internet. It is a security feature implemented in Microsoft Windows to help protect the system from potentially harmful content.

1. Now open the path for the .hta file, at the data interpreter section, we can see the ZoneID value --> 3.

5TH QUESTION --> ANS: REDACTED

1. To find the download URL, simply scroll down at the same data interpreter.

6TH QUESTION --> ANS: REDACTED

1. At the overview tab we can see the physical size (allocated size for the HTA file) and logical size (the real size of the HTA file).

Physical size (allocated size) --> 0x1000 = 4096

7TH QUESTION --> ANS: REDACTED

Logical size (actual size) --> 0x478 = 1144

8TH QUESTION --> ANS: REDACTED

1. Enumerating directories shall found our interest is at Documents --> Work.

9TH QUESTION --> ANS: REDACTED

1. To find the password, simply click the notes.txt file then check the data interpreter section.

10TH QUESTION --> ANS: REDACTED

1. To identify how many files remain under, I didn't figure out the fastest way. But from what I did, every time I click a directory I continuously adding the value shown at the bottom right.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Parsing raw mft data using analyzeMFT.
2. Searching ZoneID, physical size, and logical size for a specific file using MFTExplorer.