Wowza Enterprise (Wowza Inc.) engaged an IR team to investigate a workstation belonging to employee Otello John after the desktop wallpaper was changed to a questionable image. The IT team provided initial context: all internal sites use AD-integrated SSO, RDP is enabled (misconfiguration — policy prohibits remote access), Windows Defender was disabled during the incident window, and systeminfo was observed crashing on the machine. The incident timeframe is bounded by Otello’s last login on 28 May 2025.
Evidence was collected via KAPE using SANS_TRIAGE, CertUtil, and StartupFolders targets, producing:
Local accounts: wowzaadmin (local admin), otello.j (victim user).
Phase 1 — Credential Harvesting via Phishing
The KAPE SANS_TRIAGE target collects browser artifacts. Opening C:\Users\otello.j\AppData\Local\Google\Chrome\User Data\Default\History in DB Browser for SQLite reveals 43 URL entries. The victim used Chrome rather than the default Edge browser. Internal Wowza services were accessed at wowzainc.co.th. Entry 35 is the pivot point: the user clicked a link in a company email at http://mail.wowzainc.co.th/inbox/email_content1.html (titled “Important Update”) which redirected to a typosquatted login page — http://login.wowzalnc.co.th/logon.php. The legitimate domain is wowzainc.co.th; the phishing domain substitutes ln for in. Because the internal site uses AD SSO, the attacker captured domain credentials. The same browser history also shows visits to freehackingtool.com — attacker tool downloads that came later but confirm the same browser session. The WebKit timestamp for the phishing visit converts to 2025-05-25 10:36:42 UTC.
Phase 2 — RDP Initial Access
With harvested credentials the threat actor authenticated remotely. All workstations in the environment had RDP enabled despite policy prohibiting it — a misconfiguration highlighted in the initial IT briefing. Security.evtx (2.1 MB — significantly larger than other event logs, last modified 28 May 2025 10:42 PM) is parsed with EvtxECmd.exe -f Security.evtx --csv output --csvf security.csv and opened in Timeline Explorer. Filtering for Event ID 4624 with Logon Type 10 (RemoteInteractive) and user otello.j shows two successful logons from a Kali Linux host at 192.168.189.129:
Phase 3 — Sensitive File Discovery
With GUI access via RDP the attacker browsed the victim’s filesystem. The AutomaticDestinations JumpList folder (C:\Users\otello.j\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\) is examined with JumpList Explorer. Three recent file entries appear after the second logon, including a PowerPoint on the victim’s desktop:
C:\Users\otello.j\Desktop\Working\Proposal to CFO.pptx
The Windows Recent folder also shows shortcuts to Script, Working, The Internet, and Wowza Budgeting — confirming the attacker was browsing work-related content.
Phase 4 — Privilege Escalation Discovery
The Chrome download history (downloads table in the History SQLite database) shows three files downloaded from freehackingtool.com:
SeManageVolumeExploit.exe → C:\Users\otello.j\Downloads\PrintConfig.dll → (no current path — interrupted)a.vbs → C:\Users\otello.j\Downloads\SeManageVolumeExploit.exe is a public PoC that abuses SeManageVolumePrivilege — a Windows privilege allowing volume-level FSCTL operations. The exploit enables the privilege, opens a handle to \\.\C: with SYNCHRONIZE | FILE_TRAVERSE, then sends FSCTL_SD_GLOBAL_CHANGE to replace the Administrators SID (S-1-5-32-544) with the Users SID (S-1-5-32-545), granting any user in the Users group full write access to the C drive. Event ID 4672 (special privilege assignment) was not recorded for this privilege, suggesting it was already assigned to the account.
Phase 5 — LOLBIN Download Cradle (certutil)
The attacker attempted to download PrintConfig.dll directly via Chrome from http://freehackingtool.com/tools/PrintConfig.dll. The downloads table shows received_bytes = 0 and interrupt_reason = 41. Chrome’s download_interrupt_reason_values.h maps code 41 to “Browser Shutdown” — the attacker closed the browser before the download completed (or Safe Browsing blocked it and the browser was shut down).
Because the direct download failed, the attacker fell back to certutil.exe as a download cradle — confirmed by the CertUtil KAPE target. The CryptnetUrlCache\MetaData folder at C:\Users\otello.j\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ contains metadata files for each URL fetched; one entry decodes to http://freehackingtool.com/tools/PrintConfig.dll, confirming certutil downloaded it successfully.
The USN Journal ($J) was parsed alongside the MFT using MFTECmd.exe -f $MFT --csv output --csvf mft.csv -m $J to include parent paths. Filtering for PrintConfig.dll shows the file was created in C:\Users\otello.j\Downloads\ at 2025-05-28 12:45:37.
Phase 6 — DLL Replacement for SYSTEM Shell (PrintNotify COM Abuse)
The SeManageVolumeExploit gave the attacker write access to C:\Windows\System32\spool\drivers\x64\3\. The attack technique involves replacing the legitimate Printconfig.dll at that path with a malicious Meterpreter DLL, then triggering it to load by instantiating the PrintNotify COM object (CLSID {854A20FB-2D44-457D-992F-EF13785D2B51}) via PowerShell:
$type = [Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}")
$object = [Activator]::CreateInstance($type)This is confirmed in the PowerShell Console Host history at C:\Users\otello.j\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.
USN Journal timeline for PrintConfig.dll:
| Time | Event |
|---|---|
| 12:45:37 | Malicious DLL created in C:\Users\otello.j\Downloads\ |
| 12:47:06 | Legitimate C:\Windows\System32\spool\drivers\x64\3\Printconfig.dll deleted |
| 12:47:40 | Malicious DLL renamed and moved to the spool path |
Windows Defender (re-enabled during evidence collection) queried the DLL via cloud at 2025-05-28 15:19:28 and detected it as Trojan:Win64/Meterpreter.E, removing it at 2025-05-28 15:19:35. The SHA1 hash logged by Defender: 916564984e38f8bb91921cd4e40b64156a72142b.
Phase 7 — Second DLL + VBScript Persistence
A second DLL — tzres.dll — was also downloaded from freehackingtool.com using certutil (executed under the SYSTEM account obtained via the PrintNotify shell). The MFT shows it was written to C:\Windows\System32\wbem\tzres.dll at 2025-05-28 12:54:23. Windows Defender did not detect this file.
The persistence mechanism exploits a known DLL hijack: when systeminfo is run, the WMI provider host wmiprvse.exe attempts to load tzres.dll from C:\Windows\System32\wbem\ — a path that doesn’t normally contain this file. Placing a malicious DLL there causes it to execute under the NT AUTHORITY\Network Service account each time systeminfo is triggered.
To automate the trigger, the attacker moved a.vbs (downloaded earlier) to the Global Startup folder:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\a.vbs
The VBS content:
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "cmd.exe /c systeminfo", 0, FalseThe file was hidden using the hidden attribute at 2025-05-28 12:56:11 (confirmed via BasicInfoChange event in the USN Journal) so it would not appear in Explorer without “Show hidden items” enabled.
Phase 8 — Wallpaper Defacement
The PowerShell Console Host history also contains the wallpaper command executed immediately after the PrintNotify COM object was instantiated:
reg add "HKCU\control panel\desktop" /v wallpaper /t REG_SZ /d "C:/Users/Public/Pictures/gg.bmp" /fThe image gg.bmp was downloaded via certutil (under SYSTEM) to C:\Users\Public\Pictures\gg.bmp. The registry write was captured in PowerShell Script Block Logging (Event ID 4104) at 2025-05-28 12:59:30. Opening the BMP reveals a hacker stock-photo with the text: “HACKED BY ANARCHY”.
Phase 9 — Victim Returns
Security event log filtered for Event ID 4624 with Logon Type 2 (interactive/local) and user otello.j shows the victim logged back into the workstation at 2025-05-28 15:04:41 — approximately two and a half hours after the attacker’s second RDP session — and discovered the altered wallpaper, triggering the IR engagement.
| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Link | T1566.002 | Typosquat login page sent via internal email lure |
| Valid Accounts | T1078 | Stolen AD credentials used for RDP authentication |
| Remote Services: RDP | T1021.001 | Attacker initial access and post-exploit activity via RDP |
| File and Directory Discovery | T1083 | Attacker browsed victim’s work folder, accessed PowerPoint |
| Abuse Elevation Control Mechanism | T1548 | Volume management privilege exploited for C drive access |
| Signed Binary Proxy Execution: Certutil | T1218 | Certutil used as download cradle to bypass Safe Browsing |
| Hijack Execution Flow: DLL Side-Loading | T1574.001 | Legitimate DLL deleted, replaced with malicious version |
| Command and Scripting Interpreter: VBScript | T1059.005 | VBScript executed to load second malicious DLL |
| Boot or Logon Autostart Execution | T1547 | VBScript placed for persistence, hidden from GUI |
| Impair Defenses | T1562.001 | Windows Defender disabled during attack window |
| Internal Defacement | T1491.001 | Desktop wallpaper changed as attacker calling card |
Network access: Restrict remote access and firewall rules should block port 3389 at the network perimeter.certutil.exe -urlcache and certutil.exe -decode command-line patterns via Sysmon Event ID 1.HKLM\SOFTWARE\Classes\CLSID\ for unexpected DLL path changes. Any unsigned DLL loaded by a system COM component should trigger an alert.wscript.exe / cscript.exe with unusual parent processes is a detection opportunity.