SmartyPants

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Forela's CTO, Dutch, stores important files on a separate Windows system because the domain environment at Forela is frequently breached due to its exposure across various industries. On 24 January 2025, our worst fears were realised when an intruder accessed the fileserver, installed utilities to aid their actions, stole critical files, and then deleted them, rendering them unrecoverable. The team was immediately informed of the extortion attempt by the intruders, who are now demanding money. While our legal team addresses the situation, we must quickly perform triage to assess the incident's extent. Note from the manager: We enabled SmartScreen Debug Logs across all our machines for enhanced visibility a few days ago, following a security research recommendation. These logs can provide quick insights, so ensure they are utilised.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: EVTX.

Detailed Investigation

1. On 24 January 2025, an intruder gained unauthorized access to Forela’s fileserver, installed utilities to facilitate their actions, exfiltrated critical files, and then deleted them to prevent recovery.
2. This security breach has led to an extortion attempt, with the attackers demanding a ransom. The legal team is currently handling the extortion aspect, but our primary focus is conducting an immediate triage to assess the full extent of the incident.

1ST QUESTION -> ANS: REDACTED

1. To review the log for logon using RDP, there are many RDP-related event logs. Interestingly, the logon attempt is not logged inside the Security event log. As you can see below, there is no successful logon with logon type 10.

2. Note that there are many event logs related to RDP and in this case we could identify the logon attempt from this event log -> Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.

3. Upon reviewing the log, found the log that indicates successful event logon at timestamp 2025-01-24 10:15:14 and reviewing other logs, no other RDP login attempt.

4. This should be the initial login access of the attacker, because there is no other login attempt.

2ND QUESTION -> ANS: REDACTED

1. We can further investigate the threat actor's activity with ease, because the Smart Screen Debug Logs is enabled.
2. Note that, Smart Screen Debug Logs is from Microsoft Defender SmartScreen and this function primarily works as preventive measure rather than tool / binary removal. Which means it focuses on protecting users from malicious downloads, websites, and app installers.
3. So if we found the C2 or malicious binary installation performed by the threat actor, it shall shown at the log.
4. Upon reviewing the log, not long after the initial access, at 2025-01-24 10:17:14 a WinRAR software setup binary is executed.

WinRAR.exe binary execution

3RD QUESTION -> ANS: REDACTED

1. Next, continue reviewing the log, we can identify another interesting binary named Everything.exe executed at timestamp 2025-01-24 10:17:33.

2. Searching on the internet regarding this binary, found a research article published by CYRFIRMA regarding ELPACO-team Ransomware.

3. The binary seems a file search utility.

4TH QUESTION -> ANS: REDACTED

1. Based on our previous finding, the execution timestamp is 2025-01-24 10:17:33.

5TH QUESTION -> ANS: REDACTED

1. Next, upon continue reviewing the log. Found a PDF file which likely the first document that the attacker got their hands on.

6TH QUESTION -> ANS: REDACTED

1. Found another PDF that should be the second stolen document.

7TH QUESTION -> ANS: REDACTED

1. To identify the installed cloud utility used to steal and exfiltrate the documents, we just need to continue review the same event log file.
2. Found a downloaded setup binary for MEGAsync and not long after that you shall identify MEGAsync.exe binary execution.

8TH QUESTION -> ANS: REDACTED

1. Again, based on our previous finding, we can identify the timestamp for this utility execution is at 2025-01-24 10:22:19.

9TH QUESTION -> ANS: REDACTED

1. Again, while continuing the review. Found a binary execution named File Shredder at timestamp 2025-01-24 10:26:40. A file shredder is a specialized tool that permanently deletes files by overwriting them multiple times.

10TH QUESTION -> ANS: REDACTED

1. To identify an attempt to clear log files, we need to check the Security event log and filter for eventID 1102.

2. Now we know the timestamp for log clear activity is at 2025-01-24 10:28:41.

3. Great! We've investigated the case.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS: REDACTED
• 2ND QUESTION -> ANS: REDACTED
• 3RD QUESTION -> ANS: REDACTED
• 4TH QUESTION -> ANS: REDACTED
• 5TH QUESTION -> ANS: REDACTED
• 6TH QUESTION -> ANS: REDACTED
• 7TH QUESTION -> ANS: REDACTED
• 8TH QUESTION -> ANS: REDACTED
• 9TH QUESTION -> ANS: REDACTED
• 10TH QUESTION -> ANS: REDACTED

Lessons Learned

1. Identify & Analyze Windows RDP-Related Event Logs.
2. Using event log explorer and event viewer to analyze windows event logs.
3. Reviewing Smart Screen Debug logs.