Litter

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Khalid has just logged onto a host that he and his team use as a testing host for many different purposes, it’s off their corporate network but has access to lots of resources in network. The host is used as a dumping ground for a lot of people at the company but it’s very useful, so no one has raised any issues. Little does Khalid know; the machine has been compromised and company information that should not have been on there has now been stolen – it’s up to you to figure out what has happened and what data has been taken.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: wireshark, cyberchef.
• Artifacts: PCAP, pcap.

Detailed Investigation

1. In this challenge we're given a .pcap file.

WIRESHARK

1ST QUESTION --> ANS: REDACTED

1. Analyzing the packets, it is known that most of the hostname is a large number of hexadecimals.

2. This pattern is referring to DNS tunneling technique, hence we can conclude the malicious protocol is DNS.

2ND QUESTION --> ANS: REDACTED

1. Based from the previous malicious traffic we found, we can conclude the suspected host is --> 192.168.157.145.

3RD QUESTION --> ANS: REDACTED

1. Following one of the UDP packet streams and decode it with cyberchef, shall let us find the first command the attackers sends to the client.

4TH QUESTION --> ANS: REDACTED

1. To identify the version of DNS tunneling tool used, simply analyze the previous decoded hex.
2. Scrolling down, we shall find the version.

5TH QUESTION --> ANS: REDACTED

1. Based from the previous question, we can assume that the attacker accidentally left the dns tool not renamed.

2. Hence, I scrolling down again and searched for a renaming command and found this:

3. As you can see, the attacker tried to use ren command which is a shorthand of rename in windows command.

6TH QUESTION --> ANS: REDACTED

1. The users cloud storage is at OneDrive, scrolling down the decoded packet stream shall found out that there is no files inside it.
2. Hence, we can conclude the attacker did not locate any file in the user cloud storage.

7TH QUESTION --> ANS: REDACTED

1. Again, scrolling down the same decoded packet stream, shall found the full path of PII file which is stolen.

2. Actually I found few .csv file which is interesting but only one so far that the attacker attempted to read.

3. Scrolling down again, you shall find the attacker indeed have an interest in this file and attempted to download it.

8TH QUESTION --> ANS: REDACTED

1. To identify how many PII records were stolen, I download the cyberchef results and count manually there.
2. Took me a very long time to analyze it, maybe there's an intended way to solve it.
3. However, found out the amount of PII stolen is 721.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED

Lessons Learned

1. DNS tunneling.