Tracer

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

A junior SOC analyst on duty has reported multiple alerts indicating the presence of PsExec on a workstation. They verified the alerts and escalated the alerts to tier II. As an Incident responder you triaged the endpoint for artefacts of interest. Now please answer the questions regarding this security event so you can report it to your incident manager.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: prefetch, memory, registry, MFT, database, ntfs.

Detailed Investigation

1. In this challenge we're given few files of windows event log and prefetch files.

1ST QUESTION --> ANS: REDACTED

1. To identify how many times was PsExec executed by the attacker, we need to analyze the Security event log file.

2. Analyzing the content of the latest log, we can identified the attacker's binary filename.

3. As you can see, it states Caller Process Name, it means the result is executed using this binary.

4. Hence, to check how many times it executed we just need to filter the Event ID displayed to --> 4625.

5. I count it manually, by reviewing each contents. Counted +1 if psexesvc.exe executed.

2ND QUESTION --> ANS: REDACTED

1. Based from our previous identification, we identified the binary filename is --> psexesvc.exe.

3RD QUESTION --> ANS: REDACTED

1. Next, to get the timestamp for the 5th last instance of the PsExec, I tried to parse the prefetch file we extracted from the .zip file before.

Why prefetch file is the interest now?
-> Because Prefetch files is used to preloading certain data and code into memory.
Hence analyzing it helps us to understand the execution patterns of applications on a system,
as these files can provide insights into which applications are frequently used and how they are
loaded into memory during system startup.

1. To parse the prefetch file I used this online tool created by Eric Zimmerman.

.\PECmd.exe -f 'C:\Users\saput\Downloads\CYBERDEFENDER\Tracer\C\Windows\prefetch\PSEXESVC.EXE-AD70946C.pf'

1. Noticed, there's a run count header which states 9. Another solution is to parse the prefetch file if we want to identify how many times a binary is executed.
2. Based from the Github's documentation, we can extract the information to a json or csv format.
3. I tried to extract the information into csv format and saved them to a directory named new_directory.

.\PECmd.exe -f 'C:\Users\saput\Downloads\CYBERDEFENDER\Tracer\C\Windows\prefetch\PSEXESVC.EXE-AD70946C.pf' --csv new_directory

1. The output_timeline csv should be our interest here.

2. Simply viewing the timeline for the 6th row shall gave us the correct timestamp.

4TH QUESTION --> ANS: REDACTED

1. To identify the hostname, we just need to view the Files Referenced result from the prefetch parser.

5TH QUESTION --> ANS: REDACTED

1. To identify the fullname of the key file dropped by 5th last instance, we can try to parse the Master File Table (MFT).

MFT stands for Master File Table, and it is a crucial component of the NTFS (New Technology File System) file system used in Windows operating systems.
The MFT is a database that stores information about every file and directory on an NTFS-formatted volume.
It acts as a centralized index, keeping track of metadata for each file, including attributes such as file name, size,
creation time, permissions, and the location of the file data on the disk.

1. To parse it, we can use an online tool created by Eric Zimmerman named MFTECmd.
2. I tried to extract the information into csv format and stored it on a directory named --> mftparse_result.

.\MFTECmd.exe -f 'C:\Users\saput\Downloads\CYBERDEFENDER\Tracer\C\$Extend\$J' --csv mftparse_result

1. Upon analyzing the csv file, I noticed the timestamp is descending. To get the correct key, we just need to search for timestamp which is ONE SECOND different than the execution of the last 5th instance.

2. Long story short, I managed to find the correct key at row 145570. Noticed the timestamp is different one second only.

3. Alternatives way to identify it, simply check the results from PECmd.exe at the Files Referenced header.

6TH QUESTION --> ANS: REDACTED

1. We managed to find the timestamp previously.

7TH QUESTION --> ANS: REDACTED

1. To identify the fullname of the named Pipe ending with stderr keyword, we can start by analysing Sysmon event log.

Sysmon logs events related to various system activities, providing detailed information about processes, network connections, file creation, registry modifications, and more. The information logged by Sysmon can be crucial for detecting and investigating security incidents.

1. As we know, sysmon provide many event log. However there is a way to speeding the analysis, first we just need to analyze the same timestamp as the 5th.

2. Then our second interest is this timestamp:

3. Just focusing when the second timestamp is close to 12:06:55.

4. Long story short, found the correct name.

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Analyzing windows event log file.
2. Parsing a prefetch file and extract the information into csv format using PECmd.
3. Parsing $MFT using MFTECmd.
4. Analyzing USN Journal data stream -> $J.
5. Analyzing sysmon operational event log to identify fullname of the named Pipe ending with stderr.