Logjammer

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

You have been presented the opportunity to work as a junior DFIR consultant for a big consultancy, however they have provided a technical assessment for you to complete. The consultancy Forela-Security would like to gauge your knowledge on Windows Event Log Analysis. Please analyse and report back on the questions they have asked.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: metasploit, powershell.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this challenge we're given several windows event logs.

1ST QUESTION --> ANS: REDACTED

1. To identify the timestamp, we need to analyze the Security or Security_1 log.

2. Long story short, after sorted the timestamp from the oldest to newest, found a logon attempt with explicit credentials (eventID -> 4648) and cyberjunkie as it's username.

3. However, it does not explain whether the login attempt is succesfull or not. It can be successfully or it can't be.

4. But it concludes that this is the 1st attempt.

5. Hence let's convert the timestamp tp UTC using this online tool --> https://dateful.com/convert/utc.

2ND QUESTION --> ANS: REDACTED

1. Analyzing the Windows Firewall-Firewall shall let us identify the name of the firewall rule added.

3RD QUESTION --> ANS: REDACTED

1. The direction of the firewall rule is also stated there.

4TH QUESTION --> ANS: REDACTED

1. Analyzing the Security_1 event log with eventID 4719, it states the subcategory of the changed policy.

5TH QUESTION --> ANS: REDACTED

1. To find the scheduled task created by cyberjunkie we just need to analyze the events with ID 4698 at Security_1 event log.

6TH QUESTION --> ANS: REDACTED

1. Scrolling down at the exact ID shows the full path of the file.

7TH QUESTION --> ANS: REDACTED

1. The argument is stated just below the file path.

8TH QUESTION --> ANS: REDACTED

1. To identify the tool, we need to analyze the Windows Defender-Operational event log.
2. Simply searching for eventID 1117 shows us the tool name.

9TH QUESTION --> ANS: REDACTED

1. Scrolling down at the exact eventID's general tab, shows us the full path of the malware.

10TH QUESTION --> ANS: REDACTED

1. Scrolling down again at the exact eventID's general tab, you shall find the action taken by the antivirus.

11TH QUESTION --> ANS: REDACTED

1. Analyzing Powerhell-Operational event log with 4104 as it's eventID, shows us the powershell command executed by the user.

12TH QUESTION --> ANS: REDACTED

1. This is a little bit tricky, took me a while to get the correct answer.

2. While analyzing the Security_1 event log, I noticed there is an event log which is cleared by cyberjunkie.

3. However if you tried to submit the event log cleared is --> Security, you shall get incorrect result.

4. After analyzing the Windows Firewall-Firewall event log, I found this eventID which explains this:

5. This should be our interest.

6. Submitting the log name shall gave you correct result.

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED
• 12TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Windows event log analysis.