Operation Blackout 2025: Phantom Check

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Talion suspects that the threat actor carried out anti-virtualization checks to avoid detection in sandboxed environments. Your task is to analyze the event logs and identify the specific techniques used for virtualization detection. Byte Doctor requires evidence of the registry checks or processes the attacker executed to perform these checks.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: powershell.
• Artifacts: registry, dump.

Detailed Investigation

1. In this case, we were tasked with investigating and analyzing Windows event logs to identify the techniques used by the threat actor for virtualization detection, as well as the specific registry keys accessed during the execution of the detection process.

2. Unzipping the evidence we're only given 2 windows event log files:

3. Since our objective was highly specific, we accelerated the investigation by using an open-source tool called Hayabusa, developed by the Yamato Security team.

COMMAND EXECUTED:

hayabusa-3.3.0-win-x64.exe csv-timeline -d C:\HTB-SHERLOCKS\ -o results.csv -p super-verbose

1. Using the command above, my objective was to parse all event logs located in the HTB-SHERLOCKS directory, which contained the forensic evidence. I utilized the --csv-timeline flag to instruct Hayabusa to convert the parsed data into a CSV timeline format, and the -o flag to specify the output file name as results.csv.

2. Additionally, I enabled the --super-verbose flag to ensure Hayabusa provided detailed output regarding its scanning findings, which helped in identifying relevant artifacts more efficiently.

3. Hayabusa returned several medium-severity detections, which warranted further analysis to determine their relevance to the threat actor's activity.

1ST QUESTION --> ANS: REDACTED

1. To examine the parsed event log files, I used Timeline Explorer, another powerful tool developed by Eric Zimmerman.
2. By searching for the keyword "wmi", I identified three records related to Windows Management Instrumentation (WMI) activity, which provided valuable insight into the threat actor's behavior.

NOTE: VICTIM HOSTNAME -> DESKTOP-M3AKJSD

1. The first and second record clearly indicated that the threat actor utilized the Win32_ComputerSystem class to query the system’s model and manufacturer information, its commonly used for virtualization detection.

2ND QUESTION --> ANS: REDACTED

1. Following that, we observed the threat actor executing an SQL query to retrieve temperature data from the machine. This was done by dumping all entries from the MSAcpi_ThermalZoneTemperature class.
2. Very interesting!

SQL QUERY:

SELECT * FROM MSAcpi_ThermalZoneTemperature

3RD QUESTION --> ANS: REDACTED

1. Moving on, by examining activity near the timeline at 2025-04-09 16:20:11, found a powershell script execution and a function named Check-VM is likely forged.

2. After tried to paste and did a quick check for it, indeed its very clear the Check-VM is a forged function to perform virtualization detection.

4TH QUESTION --> ANS: REDACTED

1. Upon reviewing it, we identified a series of registry key queries occurring around the time of the virtualization check.
2. Notably, the threat actor specifically accessed the Services registry key, which is a common technique used to enumerate installed drivers and services—often leveraged for virtualization and sandbox detection.

5TH QUESTION --> ANS: REDACTED

1. Based on our previous findings, we can confidently conclude that the script is also capable of detecting VirtualBox environments.
2. To achieve this, the script performs a comparison check for the presence of two specific processes: vboxservice.exe and vboxtray.exe, both commonly associated with VirtualBox installations.

6TH QUESTION --> ANS: REDACTED

1. To identify the output generated during execution, we examined the corresponding event logs using Event Viewer.

2. We observed a consistent pattern in the output messages. Each began with the phrase "This is a".

3. This pattern allowed us to efficiently locate the relevant detection events by simply searching for that specific string, which led us directly to the successful execution logs.

4. Nice! We can tell the script detect two virtualizations platforms.

5. Those are Hyper-V and VMware.

6. Great! We've investigated a quick case and specific request!

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using Hayabusa for efficient parsing and triage of Windows event logs.
2. Utilized Timeline Explorer to examine and correlate events within CSV-based timeline data.
3. Using Event Viewer to analyze windows event logs.
4. WMI class abused to retrieve model and manufacturer information.
5. Identification of current machine temperature value.
6. Identification of virtualization detection activity.