← Back to Writeups
HTBEasySOC/DFIR
Bookmark

Trojan

D3v0o0Nu119/2/20262 min read
#soc/dfir#htb#easy

Trojan

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

John Grunewald was deleting some old accounting documents when he accidentally deleted an important document he had been working on. He panicked and downloaded software to recover the document, but after installing it, his PC started behaving strangely. Feeling even more demoralised and depressed, he alerted the IT department, who immediately locked down the workstation and recovered some forensic evidence. Now it is up to you to analyze the evidence to understand what happened on John's workstation.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source

Evidence Analysed

  • Tools: john.
  • Artifacts: per the investigation narrative.

Detailed Investigation

1ST QUESTION -> ANS: REDACTED

2ND QUESTION -> ANS: REDACTED

3RD QUESTION -> ANS: REDACTED

4TH QUESTION -> ANS: REDACTED

5TH QUESTION -> ANS: REDACTED

6TH QUESTION -> ANS: REDACTED

7TH QUESTION -> ANS: REDACTED

8TH QUESTION -> ANS: REDACTED

9TH QUESTION -> ANS: REDACTED

10TH QUESTION -> ANS: REDACTED

11TH QUESTION -> ANS: REDACTED

12TH QUESTION -> ANS: REDACTED

13TH QUESTION -> ANS: REDACTED

Findings

  1. Persistence mechanism — As documented in the investigation steps.
  2. Initial access — As documented in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
Command and ControlIngress Tool TransferT1105

Answers / Flags

  • 1ST QUESTION -> ANS: REDACTED
  • 2ND QUESTION -> ANS: REDACTED
  • 3RD QUESTION -> ANS: REDACTED
  • 4TH QUESTION -> ANS: REDACTED
  • 5TH QUESTION -> ANS: REDACTED
  • 6TH QUESTION -> ANS: REDACTED
  • 7TH QUESTION -> ANS: REDACTED
  • 8TH QUESTION -> ANS: REDACTED
  • 9TH QUESTION -> ANS: REDACTED
  • 10TH QUESTION -> ANS: REDACTED
  • 11TH QUESTION -> ANS: REDACTED
  • 12TH QUESTION -> ANS: REDACTED
  • 13TH QUESTION -> ANS: REDACTED

Lessons Learned

  1. Correlate artifacts across evidence sources to build a timeline.
  2. Map findings to MITRE ATT&CK techniques.
  3. Document IoCs for detection engineering.