Recollection

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

A junior member of our security team has been performing research and testing on what we believe to be an old and insecure operating system. We believe it may have been compromised & have managed to retrieve a memory dump of the asset. We want to confirm what actions were carried out by the attacker and if any other assets in our environment might be affected. Please answer the questions below.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: python, powershell, volatility, strings.
• Artifacts: memory, registry, dump.

Detailed Investigation

1. In this challenge we're tasked to do a memory forensic from a memory dump to identify what actions carried out by the attacker and checks what assets might be affected.

1ST QUESTION --> ANS: REDACTED

1. To do RAM forensic, first we need to identify the correct profile. We can use volatility to identify it using plugin imageinfo.

2. The first suggested profile usually is the correct one and judging from the result we can identify that the operating system of the machine is Windows and the version is 7.

2ND QUESTION --> ANS: REDACTED

1. Few info shown simply by using plugin imageinfo. The time when the memory dump created is specify at the Image data and time header.

3RD QUESTION --> ANS: REDACTED

1. To identify data saved on the clipboard, in volatility2 we can use clipboard plugin.

2. Noticed the first data shown is kinda obfuscated, this could indicate the obfuscated mentioned at the questions.

3. To make sure that this is the copied command, we can use cmdscan plugin to check what command executed on the poweshell.exe process.

4. Based from the result above, we can identify that the command is executed both in cmd and powershell. It's valid then, that the copied command is our interest.

4TH QUESTION --> ANS: REDACTED

1. Took me a while to identify the targeted powershell cmdlet. I used consoles plugin to check the result of the executed obfuscated command.

2. Interesting it's resulting to iex, searching on the internet about iex found that iex stands for Invoke Expressions.

NOTES:

What is IEX?
EX stands for "Invoke-Expression" in PowerShell. It's a cmdlet used to run a string as a PowerShell command. This means it allows PowerShell scripts to dynamically execute code stored in a string variable. It's a powerful feature but can also pose security risks if used improperly, as it enables dynamic execution of potentially malicious commands

Attacker tried to set an alias for IEX, this could be an attempt to obfuscate malicious PowerShell commands. By creating an alias for Invoke-Expression, an attacker may make it harder for security tools or analysts to detect and understand the true nature of the executed code

1. The article visited shows the obfuscated command that is similiar with what the attacker send.

2. It's clear that the attacker tried to set an alias for Invoke Expression cmdlet.

5TH QUESTION --> ANS: REDACTED

1. Analyzing the CMD history, we can identify an attempt of the attacker to exfiltrate the content of the Confidential.txt to his file named pass.txt inside pulice directory.

6TH QUESTION --> ANS: REDACTED

1. Anyway, the exfiltration is failed because the program path was not found.

7TH QUESTION --> ANS: REDACTED

1. Analyzing the terminal history furthermore, we can identify there an encodede messages.

2. After decoded the message we can identify the full path of the readme file.

8TH QUESTION --> ANS: REDACTED

1. To check hostname in windows, we can run --> net users.

2. Based from the terminal history, the hostname of the compromised system is USER-PC.

3. Anyway, there is an alternate way to check the machine's hostname. Simply dump the registry key.

4. First we need to find the offset of \REGISTRY\MACHINE\SYSTEM. In volatility to list registry keys we can use plugin hivelist.

5. Next, to dump the registry key we can use plugin printkey.

printkey -o 0xfffff8a000024010 -K "ControlSet001\Control\ComputerName\ComputerName"

9TH QUESTION --> ANS: REDACTED

1. To identify total user accounts were in the machine we can run hashdump plugin.

2. Based from the results, we can conclude that there were 3 users registered.

10TH QUESTION --> ANS: REDACTED

1. To identify full location path, we can use filescan plugin and filter for passwords.txt.

11TH QUESTION --> ANS: REDACTED

1. By analyzing the results of console plugin, we can identify an executeable file with a hash lookalike values as it's name.

2. To verify that it is the malicious file, remembering the filename is the hash value of itself, then we can use it to virustotal to check whether the executeable file is a malware or not.

RESULT IN VIRUSTOTAL

1. It is indeed what we're looking for.

12TH QUESTION --> ANS: REDACTED

1. We can simply open the details tab in virustotal to check for imphash value.

NOTES:

What is imphash value?
An imphash (import hash) value is a hash function generated from the characteristics of a binary executable file's imported functions.
It is commonly used in digital forensics and malware analysis to quickly identify and compare different versions or instances of executable
files based on their imported functions. The imphash value remains consistent for files that share similar import tables,
making it a useful tool for identifying and grouping related files.

13TH QUESTION --> ANS: REDACTED

1. Again, we can use virustotal to check the creation time of the malicious executeable file.

14TH QUESTIOM --> ANS: REDACTED

1. To identify local ip address of the machine, we can use netscan plugin.

2. Based from the result above, it's clear that 192.168.0.104 is the local ip address of the machine, because it listens to 0.0.0.0.

15TH QUESTION --> ANS: REDACTED

1. To identify the parent process of the powershell.exe process which is a child process, we can use plugin pstree to list all the process and it's child process.

2. Based from the result above, we can conclude that cmd.exe is the parent process.

16TH QUESTION --> ANS: REDACTED

1. Things to note, the attacker should use a browser to login a social media, hence we just need to dump the memory of the browser exe file.
2. Based from the previous pslist result, we identified only one browser used. The microsoft edge.
3. In volatility, we can dump that using plugin memmap.

python3 ../../volatility3/vol.py -f recollection.bin -o . windows.memmap --dump --pid 2380

1. Then, let's strings the .dmp file and search for .gmail.com.

2. Noticed, we found a .gmail.com account and a URL encoded data.

3. Upon decode the URL, it's clear that mafia_code1337@gmail.com is used for login.

17TH QUESTION --> ANS: REDACTED

1. To identify the SIEM's solution name, we can use filescan plugin and search for history. Remember to use -i flag for insensitive search.

python3 ../../volatility3/vol.py -f recollection.bin windows.filescan | grep -i history

1. Seems we found our interest is at offset 0x11e0d16f0, because it stored all the browser history.
2. Let's dumps it using dumpfiles plugin.

python2 ../../volatility/vol.py -f recollection.bin --profile=Win7SP1x64 dumpfiles --dump-dir=. -Q 0x11e0d16f0

1. Great! Based from the result, our interest should be at the .dat file (because it contains the history).

2. To open it, in Linux we can run --> open.

3. Then go to tabel -> keyword_search_terms then right click and choose browse data.

4. Based from the results above, we can conclude that the victim search about WAZUH. The WAZUH itself is the SIEM solution's name.

18TH QUESTION --> ANS: REDACTED

1. To identify the malware .exe file, we can start by listing all the files inside /Downloads directory.

2. Noticed there's a process named csrsss.exe which is a typo process name. The "s" character should no more than 2.

3. Knowing this, we can conclude that the malware exe file that the user downloaded is csrsss.exe.

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED
• 12TH QUESTION --> ANS: REDACTED
• 13TH QUESTION --> ANS: REDACTED
• 14TH QUESTIOM --> ANS: REDACTED
• 15TH QUESTION --> ANS: REDACTED
• 16TH QUESTION --> ANS: REDACTED
• 17TH QUESTION --> ANS: REDACTED
• 18TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using volatility to do RAM forensic.
2. Identifying an alias attempt for IEX (Invoke Expression).
3. Dumping browser history.
4. Identify malicious downloaded filename.