Lockpick

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Forela needs your help! A whole portion of our UNIX servers have been hit with what we think is ransomware. We are refusing to pay the attackers and need you to find a way to recover the files provided. Warning This is a warning that this Sherlock includes software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments. One the Sherlock zip has been unzipped, you will find a DANGER.txt file. Please read this to proceed.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: python, strings, ghidra.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this challenge we're given 15 files.

1ST QUESTION --> ANS: REDACTED

1. Reviewing the DANGER.txt file, we can conclude that the malware is inside the .zip file. This .txt file gives several warning upon analyzing the software and gave us the password for the zip file.

2. Unzipping it, we found the malware named --> bescrypt3.2.

3. To identify the encryption key used, I decompiled the binary using ghidra.

4. At the main() function, we can see a function named process_directory() is called, it have 2 parameters and both are strings.

5. Then analyzig the process_directory() function, we can tell that the second parameter is used again by another function named encrypt_file().

6. Reviewing the encrypt_file() code, it's clear that param2 is used as a key for XOR operation.

7. Hence it concludes that --> bhUlIshutrea98liOp is the key.

2ND QUESTION --> ANS: REDACTED

1. To get his firstname and lastname, we just need to check the sql file of forela.

2. But sadly it's already encrypted by the malware.

3. Now we need to do malware reversing.

4. Upon reviewing all the functions available in the binary, seems our interest should be the encrypt_file() function.

5. The logic for the encryption lies at the XOR operation.

6. Hence, we just need to re-write the code focusing on this function. Things to note in XOR logic, if we XOR the encrypted data with the same key it used to encrypt, we shall retrieved the plaintext.

7. Remembering we already identified the key before, hence the rest should be just do the same operation again.

8. To decrypt the encrypted file I used python script.

THE SCRIPT

 py read-only • copy allowed Copy
from pwn import *
import os
os.system('clear')

### function to grab all the encrypted files

def grab_encrypted(dir):
    files=[]
    for filename in os.listdir(dir): # enumerate every files inside the specified path
        if filename.endswith('.24bes'): # if it ends with .24bes, add it to our list.
            files.append(filename)
    return files

### function to decrypt the encrypted files.

def decrypt_files(path, file, output_directory):
    key = 'bhUlIshutrea98liOp' # param2
    key_length = len(key)

    output_path = os.path.join(output_directory, file[:-6]) # the slicing is to remove the .24bes name for the decrypted files.

    current_path = os.path.join(path, file) # current path

    with open(current_path, 'rb') as file:
        data_file = file.read()# read all the files inside the dir.
    
    file_content = bytearray()
    for i,y in enumerate(data_file):
        file_content.append(y ^ ord(key[i % key_length])) # DECRYPTING
    
    with open(output_path, 'wb') as f:
        f.write(file_content) # write the decrypted content to the output path

path = './' # current path
files = grab_encrypted(path) # grab all the encrypted files
output_directory = os.path.join(path, 'decrypted-files')
os.makedirs(output_directory) # create the output-dir

### decrypt each files

for i, file in enumerate(files, start=1):
    decrypt_files(path, file, output_directory)
    log.progress(f'IS DECRYPTING THE FILES')

log.success(f'DECRYPTION DONE')

1. Awesome! Now to identify the firstname and lastname of this --> wbevansn1@cocolog-nifty.com applicant, we can review the forela_uk_applicants.sql file.

3RD QUESTION --> ANS: REDACTED

1. Next, to identify MAC Address and serial number of the laptop assigned to Hart Manifould, we should review the it_assets.xml file.

4TH QUESTION --> ANS: REDACTED

1. Previously, upon reviewing the notes and the malware's logic, we can identified the attacker's mail. The attacker told Forela to discuss payment by contacting his email --> bes24@protonmail.com.

5TH QUESTION --> ANS: REDACTED

1. The city of London Police told us suspiciouns of some insider trading taking part within Forela trading organization.

2. Now we're tasked to identify the email address and the profit percentage of the person which has the highest profit percentage.

3. Noticed, there is around 2521 trading datas inside the .json file.

4. Hence, a short script should be involved to sort the data shown descending by the profit percentage.

GET MAX SCRIPT

 py read-only • copy allowed Copy
from pwn import *
import os
import json

### os.system('clear')

filename = './trading-firebase_bkup.json'
with open(filename, 'r') as f:
    content = json.load(f) # read the json data

### get the person with the highest profit percentage

highest_profit = max(content.values(), key=lambda x: x['profit_percentage'])

log.success(f"EMAIL ADDRESS: {highest_profit['email']}")
log.success(f"PROFIT PERCENTAGE: {highest_profit['profit_percentage']}")

6TH QUESTION --> ANS: REDACTED

1. To identify the IP address of Karylin O'Hederscroll simply review the sales_forecast.xlsx file.

7TH QUESTION --> ANS: REDACTED

1. Again, upon reviewing the malware's code, we can identified that .ppt file is not targeted by the malware.

8TH QUESTION --> ANS: REDACTED

1. Executing md5sum command at the terminal (for linux) shall shows us the checksum.

9TH QUESTION --> ANS: REDACTED

10TH QUESTION --> ANS: REDACTED

1. Great! We've investigated the case.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Conducting static malware analysis using ghidra.
2. Reviewing C code-based Malware.
3. Developing a python script to reverse the encryption logic.
4. Developing a python script to parse json file.