Boogeyman 1

A new threat actor emerges from the wild using the name Boogeyman. Are you afraid of the Boogeyman?

CONTEXT

Challenge Link: TryHackMe - BoogeyMan 1

I. Background

Julianne, a finance employee working for Quick Logistics LLC, received a follow-up email regarding an unpaid invoice from their business partner, B Packaging Inc. Unbeknownst to her, the attached document was malicious and compromised her workstation.

II. Tools and Artifacts

1. Exfiltration

2. PowerShell Events

3. Protocol Heirarchy

ANALYSIS

I. Email Analysis

The security team was able to flag the suspicious execution of the attachment, in addition to the phishing reports received from the other finance department employees, making it seem to be a targeted attack on the finance team. Upon checking the latest trends, the initial TTP used for the malicious attachment is attributed to the new threat group named Boogeyman, known for targeting the logistics sector.

1. Exchange Information

Looking at the following information, an email was sent by Arthur Griffin ([email protected]) to Julianne Westcott ([email protected]):

2. Security Headers

Both SPF and DMARC were marked as passed which shows that there is an unlikely event of email spoofing. The email also passed the DKIM check where two signatures were detected -- bpakcaging.xyz and elasticemail.com. The latter seems to be the MTA (Mail Transfer Agent) used by the attacker.

3. Email Body

It states that there is an encrypted attachment that could be opened with the password, Invoice2023!.

4. Email Attachment

A zip file, Invoice.zip, was attached to the email.

Taking the attachment then extracting its contents using the given password, Invoice2023!:

Examining the contents of Invoice_20230103.lnk:

It executes an encoded PowerShell command which when decoded downloads a file, update, and executes it in memory:

II. LOG ANALYSIS

Based on the initial findings, we discovered how the malicious attachment compromised Julianne's workstation:

  • A PowerShell command was executed.

  • Decoding the payload reveals the starting point of endpoint activities.

1. Timestamp Fix

The JSON included has mixed timestamps and to fix that:

2. PowerShell Logs

Looking at the executions relevant to this case, the attacker was able to do the following:

The initial execution of downloading update from http://files.bpakcaging.xyz:

Execute a C2 connection via HTTP Protocol Tunnelling to cdn.bpakcaging.xyz:8080:

Which when expanded:

Upload and execute Seatbelt (host enumeration tool) to the workstation:

Locate a KeePass database -- C:\Users\j.westcott\Documents\protected_data.kdbx

Read an SQLite3 database from Microsoft Sticky Notes stored in the user's Local AppData folder:

C:\Users\j.westcottAppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

Exfiltrate via DNS the contents of protected_data.kdbx through nslookup to 167.71.211.113 as a subdomain of bpakcaging.xyz.

Which when cleaned up a bit:

III. Network Analysis

Based on the PowerShell logs investigation, we have seen the full impact of the attack:

  • The threat actor was able to read and exfiltrate two potentially sensitive files.

  • The domains and ports used for the network activity were discovered, including the tool used by the threat actor for exfiltration.

1. HTTP Traffic

Looking at the servers associated with the domain, bpakcaging.xyz:

an Apache and Python one were identified. The latter, given the count, could be associated with the file server where the executables found during the log analysis were downloaded from:

All requests to the Apache server could be traced to http://cdn.bpakcaging.xyz:8080:

To add, all requests made to /27fe2489 were found to be POST:

2. Command Executions

Looking at the POST data of a sample packet, it contains what seems to be decimal values:

Now, converting the data of all POST requests from decimal to ASCII:

It shows that a KeePass database was indeed found from the workstation:

As well as its master password stored in Microsoft Sticky Notes:

Where the password is -- %p9^3!lL^Mz47E2GaT^y:

3. DNS Exfiltration

Based on the decoded POST data, the attempt for exfiltration was indeed as a subdomain of bpakcaging.xyz:

Looking at the packet capture, the chunked exfiltrated could also be seen:

Cleaning the chunked data and putting it together retrieves the KeePass database file:

Finally, opening the KeePass database using the password, %p9^3!lL^Mz47E2GaT^y, reveals information of a company card with an account number, 4024007128269551:

PreviousBoogeyman 2NextTempest

Last updated