A targeted phishing campaign was carried out against our organization. The phishing email was opened on 3 systems. A quick triage image was collected from one of the infected systems and provided for TTP identification. The goal is to identify the Techniques and Tactics used by the attacker so the incident response team can respond and mitigate further compromise across the network.
Artifact: Relevent Artifacts.ad1 — FTK Imager forensic image
Password: infected
Compromised user: CyberJunkie
| Tool | Purpose |
|---|---|
| FTK Imager 4.7 | Mount and browse the AD1 forensic image |
| ShellBags Explorer (EZ Tools) | Identify deleted/accessed folder paths |
| RBCmd (EZ Tools) | Parse Recycle Bin artifacts to recover deleted files |
| AmcacheParser (EZ Tools) | Identify executed binaries and their full paths |
| MFTECmd / MFTExplorer (EZ Tools) | Parse $MFT for MACB timestamps and detect timestomping |
| RegistryExplorer (EZ Tools) | Analyze registry hives for persistence mechanisms |
| bmc-tools | Decode RDP bitmap cache tiles |
| RdpCacheStitcher | Reconstruct RDP session screenshots from bitmap cache |
| DeepBlueCLI | Threat hunting via Windows Event Logs |
The artifact Relevent Artifacts.ad1 was loaded into FTK Imager via File → Add Evidence Item → Image File.
The evidence tree revealed the following structure relevant to the investigation:
[root]
├── $MFT
├── $Recycle.Bin
├── Users/
│ └── CyberJunkie/
│ ├── AppData/
│ │ └── Local/Microsoft/
│ │ ├── Terminal Server Client/Cache/ ← RDP bitmap cache
│ │ └── Windows/UsrClass.dat ← ShellBags
│ ├── Documents/
│ └── Desktop/
└── Windows/
├── appcompat/Programs/Amcache.hve
├── Prefetch/
└── System32/
├── config/ (SAM, SECURITY, SOFTWARE, SYSTEM)
└── winevt/Logs/
The Downloads folder was absent from the user profile, indicating it had been deleted post-compromise. To recover the path, ShellBags artifacts were analyzed using ShellBags Explorer.
The UsrClass.dat hive was loaded (holding SHIFT during load) from:
[root]\Users\CyberJunkie\AppData\Local\Microsoft\Windows\UsrClass.dat
ShellBags revealed a previously existing folder that had been removed from disk, confirming where mail attachments were saved.
✅ Answer:
c:\users\cyberjunkie\downloads\maildownloads
Since the document was deleted, the Recycle Bin was analyzed using RBCmd against the $Recycle.Bin artifacts in the image:
RBCmd.exe -d "[root]\$Recycle.Bin" --csv C:\Output\The output revealed the original filename of the deleted document before it was moved to the Recycle Bin.
✅ Answer:
security awareness.docx
AmcacheParser was run against Amcache.hve to identify recently executed binaries:
AmcacheParser.exe -f "[root]\Windows\appcompat\Programs\Amcache.hve" --csv C:\Output\Reviewing Amcache_UnassociatedFileEntries.csv, a suspicious entry was identified:
| Field | Value |
|---|---|
| FileName | SecurityPatch.exe |
| ParentPath | \Users\CyberJunkie\Desktop |
The name SecurityPatch.exe is a masquerading technique (T1036) — naming a malicious binary after a legitimate-sounding Windows process to avoid suspicion.
✅ Answer:
c:\users\cyberjunkie\desktop\securitypatch.exe
The attacker used Timestomping (T1070.006) to manipulate the $STANDARD_INFORMATION (SI) timestamps of SecurityPatch.exe, making it appear far older than it actually was.
The $MFT was analyzed with MFTExplorer, comparing two timestamp attributes:
| Attribute | Description | Timestamp |
|---|---|---|
$FILE_NAME (FN) |
OS-controlled — cannot be modified by user-mode tools | 2022-08-21 13:02:23.66 |
$STANDARD_INFORMATION (SI) |
User-writable — tampered by attacker | 2021-12-25 15:34:32 |
Key concept: A mismatch between SI and FN timestamps is the primary forensic indicator of timestomping. The
$FILE_NAMEattribute is updated by the NTFS kernel driver and is resistant to user-mode manipulation.
✅ Answer (ORIGINAL : TAMPERED):
2022-08-21 13:02:23.66 : 2021-12-25 15:34:32
The attacker used the Image File Execution Options (IFEO) + SilentProcessExit technique (T1546.012). This allows a payload to execute silently whenever a specific monitored process exits — making it invisible to standard autoruns tools.
RegistryExplorer was used to load the SOFTWARE hive (hold SHIFT on load) and navigate to:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\
A rogue subkey was found under this path identifying the process being monitored.
✅ Answer:
explorer.exe
Within the SilentProcessExit\explorer.exe key, the MonitorProcess value contained the full path of the attacker's persistence payload — a separate binary from the initial stager, located in the Documents folder:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\explorer.exe
MonitorProcess = c:\users\cyberjunkie\documents\getpatch.exe
✅ Answer:
c:\users\cyberjunkie\documents\getpatch.exe
The RDP Bitmap Cache files were extracted from:
[root]\Users\CyberJunkie\AppData\Local\Microsoft\Terminal Server Client\Cache\
├── Cache0000.bin
└── bcache24.bmc
bmc-tools was used to extract ~2,350 bitmap tile images:
python3 bmc-tools.py -s Cache0000.bin -d ./output/The tiles were then loaded into RdpCacheStitcher to visually reconstruct the RDP session. The reconstructed screen revealed a CMD window open on the remote machine with the first command executed by the attacker for local privilege/group reconnaissance.
✅ Answer:
net localgroup
Continuing the RDP cache reconstruction in RdpCacheStitcher, additional tiles revealed a browser download dialog on the second machine. The attacker downloaded a PowerShell-based Active Directory reconnaissance tool commonly used for privilege escalation path discovery.
✅ Answer:
powerview.ps1
Method 1 — Manual Event Log review
Analyzing System.evtx in Event Viewer, the first suspicious entry flagged a CMD pipe command consistent with a Metasploit named pipe impersonation attack:
cmd.exe /c echo kyvckn > \\.\pipe\kyvckn
Method 2 — DeepBlueCLI automated analysis
Running the PowerShell threat hunting module against the exported event logs confirmed the same entry and attributed it to Metasploit.
.\DeepBlue.ps1 .\System.evtx✅ Answer:
cmd.exe /c echo kyvckn > \\.\pipe\kyvckn
DeepBlueCLI explicitly identified the attack framework based on the named pipe convention (\\.\pipe\<random>) and shellcode patterns in the Windows event logs — a well-known Metasploit indicator.
✅ Answer:
metasploit
[1] INITIAL ACCESS
└── Phishing email → "security awareness.docx" downloaded to MailDownloads
└── User opens document → execution triggered
[2] EXECUTION & C2
└── SecurityPatch.exe (stager) executed from Desktop
└── Timestomped to 2021-12-25 to evade timeline analysis
└── Beacons to Metasploit C2 via named pipe
[3] PERSISTENCE
└── IFEO + SilentProcessExit configured in SOFTWARE hive
└── explorer.exe exit → triggers getpatch.exe from Documents folder
[4] LATERAL MOVEMENT
└── RDP from CyberJunkie machine to internal second machine
└── First command: "net localgroup" (local group reconnaissance)
[5] POST-EXPLOITATION
└── powerview.ps1 downloaded via browser on second machine
└── AD enumeration for privilege escalation path discovery
[6] PRIVILEGE ESCALATION
└── cmd.exe /c echo kyvckn > \\.\pipe\kyvckn
└── Metasploit named pipe impersonation → SYSTEM privileges
| Type | Value |
|---|---|
| Phishing document | security awareness.docx |
| Document download path | c:\users\cyberjunkie\downloads\maildownloads |
| Stager | SecurityPatch.exe |
| Stager full path | c:\users\cyberjunkie\desktop\securitypatch.exe |
| Real timestamp (FN) | 2022-08-21 13:02:23.66 |
| Tampered timestamp (SI) | 2021-12-25 15:34:32 |
| Persistence trigger process | explorer.exe |
| Persistence registry key | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\explorer.exe |
| Persistence payload | c:\users\cyberjunkie\documents\getpatch.exe |
| Lateral movement protocol | RDP (mstsc.exe) |
| Recon tool | powerview.ps1 |
| Priv esc command | cmd.exe /c echo kyvckn > \\.\pipe\kyvckn |
| C2 Framework | Metasploit |
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Spearphishing Attachment | T1566.001 |
| Execution | User Execution: Malicious File | T1204.002 |
| Defense Evasion | Masquerading | T1036 |
| Defense Evasion | Timestomping | T1070.006 |
| Persistence | IFEO Injection (SilentProcessExit) | T1546.012 |
| Lateral Movement | Remote Desktop Protocol | T1021.001 |
| Discovery | Local Groups Discovery | T1069.001 |
| Discovery | Domain Trust Discovery (PowerView) | T1482 |
| Privilege Escalation | Named Pipe Impersonation | T1134.001 |
| Defense Evasion | Clear Windows Event Logs | T1070.001 |
- IFEO + GlobalFlags Persistence — Oddvar Moe
- Persistence via IFEO Injection — PentestLab
- RDP Bitmap Cache Forensics
- bmc-tools — ANSSI-FR
- RdpCacheStitcher — BSI
- DeepBlueCLI — SANS Blue Team
- Eric Zimmerman Tools
- LetsDefend — Windows Forensics Challenge
Write-up by alexrepsec — LetsDefend DFIR Series