Unit42

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto's Unit42 recently conducted research on an UltraVNC campaign, wherein attackers utilized a backdoored version of UltraVNC to maintain access to systems. This lab is inspired by that campaign and guides participants through the initial access stage of the campaign.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: powershell.
• Artifacts: EVTX, memory, registry.

Detailed Investigation

1. In this challenge, we're tasked to analyze malicious act on a Windows system by reviewing a Windows Event Log file which contains sysmon logs.

NOTES:

Sysmon (System Monitor) logs are a type of log generated by the Sysinternals Sysmon utility, which is a Windows system
service and device driver thatprovides advanced system monitoring and logging capabilities. Sysmon logs capture
detailed information about various activities happening on a Windows system, including process creation,
network connections, file creation, registry modifications, and more.

1. To analyze this type of log file we can use Event Viewer.

Result in Event Viewer

1ST QUESTION --> ANS: REDACTED

1. There are 2 ways to identify the total logs for EventID 11. The first one is by filtering the log displayed in EventViewer then count it manually or check the top diplayed number.

2. Or, simply execute this powershell command.

COMMAND

 ps read-only • copy allowed Copy
Get-WinEvent -Path '.\Microsoft-Windows-Sysmon-Operational.evtx' -FilterXPath "*[System[(EventID=11)]]" | Measure-Object

THE RESULT OF PS COMMAND

2ND QUESTION --> ANS: REDACTED

1. In analyzing sysmon logs, I used this online WIKI to help me identify the meaning of each eventID.

2. It said that there is a malicious process that infected the victim's system, hence we can conclude that the malicious process is created in memory and it should be logged.

3. To hunt the malicious process, let's filter the logs displayed to logs which have EventID 1.

4. We got 6 results. Long story short, after reviewing each logs, found one log with suspicious binary name.

5. It has double extension. The easiest way to bust whether it's the malware or not is not by contextual analysis. But sends the hash values provided at the sysmon log to virustotal.

RESULT IN VIRUSTOTAL

1. It's tagged as malicious! Noticed it's categorized as Trojan and it's family is winvnc. Exactly what is the scenario told us.
2. Hence we hunted the malware.

NOTES:

WinVNC (Windows Virtual Network Computing) malware is a specific type of malicious software that exploits
the VNC protocol to gain unauthorized remote desktop access to a victim's computer running the Windows operating system.

3RD QUESTION --> ANS: REDACTED

1. At the first sysmon log, we can identified that there is an access to a cloud storage named dropbox from the victim's system.

2. EventID 22 itself indicates a DNSEvent.

3. The next sysmon log has eventID 11 which indicates a file creation event.

4. Interesting! We can speculate that the dropbox google cloud is accessed and the malware is downloaded to the victim's system from there.

5. Our speculation can be proven by reviewing the 2nd eventID 11 log and the 4th eventID 11 log.

6. There is a .part file for skZdsnwf.exe file. This indicates a download is attempted and not finished.

7. Then at the 4th log with eventID 11, we can see a firefox.exe still used at the same timestamp as the previous download attempt but this time the malware is downloaded.

8. It's clear that dropbox is the cloud used to distribute the malware.

4TH QUESTION --> ANS: REDACTED

1. To identify an attempt for modifying file creation time, we can filter for EventID 2.

2. Long story short, found the log which contain a pdf file and it's the only one.

3. Based from the log's content above, it's clear that the attacker used the malicoius file to modify the pdf timestamp to 2024-01-14 08:10:06. To make it appear old.

4. To make sure of it, open the Details tab. We can see that the creation timestamps is changed.

5TH QUESTION --> ANS: REDACTED

1. Further analysis, noticed that the malicious file dropped several files to the vicim's system. One of them is once.cmd. The full path is shown at the log's general tab.

6TH QUESTION --> ANS: REDACTED

1. To identify which dummy domain accessed by the malicious file, we can easily find it by filter the log shown with EventID 22 (DNSEvent).
2. Reviewing the 3rd log shown, we can identified that www.example.com is the dummy domain accessed by the malicious file.

7TH QUESTION --> ANS: REDACTED

1. If a process tried to reach a network connection, hence sysmon log with EventID 3 is created.
2. Reviewing the content of it, we can identified that the malicious process tried to establish a connection to 93.184.216.34.

8TH QUESTION --> ANS: REDACTED

1. At certain time, the malicious file terminated it's process after infecting the PC with a backdoored varient of UltraVNC.
2. If a process is terminated, then EventID 5 is created. Reviewing the log's content, we can identify the timestamp of the termination.

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Sysmon EventID definition.
2. Reviewing sysmon logs using Event Viewer.
3. Analyzing UltraVNC Infection Incident.