🥡 The Stolen Szechuan Sauce — DFIR Case 001 · Solved
2026-06-26 · DFIR Madness Case 001 (Albert Hui & Josiah Wu question set) · solved from disk + RAM only, both hosts · derived end-to-end from the artifacts — no walkthrough consulted · evidence staged & processed on homelab node .180 (~/szechuan/)
▸ New here? The 20-second story (plain language)
- A small company (domain C137 — yes, Rick & Morty) had its secret Szechuan-sauce recipe stolen. We were handed two dead machines' disk images and RAM dumps and asked to reconstruct what happened.
- What happened: an attacker reached the Domain Controller over the internet via Remote Desktop (RDP), dropped malware (
coreupdater.exe = Meterpreter + PowerShell-Empire), gained persistence, stole the domain's password database, hopped from the DC to the Windows-10 desktop with the stolen admin password, read the secret files (the sauce, "Beth's secret"), deleted & replaced the Beth file with a decoy, and timestomped the decoy to hide it. The malware was still phoning home when the evidence was captured.
- Every claim below traces to a specific artifact (a log entry, a registry value, a memory structure, an MFT record). Click any "evidence" toggle to see the raw proof.
Confirmed breach. External RDP into the DC (194.61.24.102, 2020-09-19 03:22 UTC) → Meterpreter coreupdater.exe injected into spoolsv.exe, C2 to 203.78.103.109:443 (Thailand) → service + Empire-registry persistence → full NTDS credential theft → lateral DC→Desktop via stolen domain-admin → secret files read & the sauce exfiltrated → "Beth's secret" deleted, replaced with a decoy, and the decoy timestomped. C2 still live at acquisition.
⏱ Clock provenance — read this before any timestamp. All disk / EVTX / memory timestamps are stored in
UTC; this dashboard quotes
UTC as ground truth. The victim VMs' clock is mis-set to
Pacific (UTC−7 / PDT) while the org is physically in Colorado (
UTC−6 / MDT) — so the host's wall-clock reads ~1 h off the "network" narration. The analysis box (
.180) is HKT (UTC+8); any
istat output shown was converted by −8.
evidence
SYSTEM\ControlSet001\Control\TimeZoneInformation → TimeZoneKeyName = Pacific Standard Time, ActiveTimeBias = 420 (=UTC−7, daylight). Bias 480 (UTC−8) standard.- Scenario page states the org is in Colorado, September → UTC−6. Net-vs-host skew is therefore ~1 h — exactly the documented "game-ism".
① Core Questions (1–13)
1. OS of the Server? — Windows Server 2012 R2 Standard (Evaluation), build 9600 (NT 6.3); it is the Domain Controller CITADEL-DC01, domain C137.local.
evidence
- volatility3
windows.info: NtMajorVersion 6 / NtMinorVersion 3, NtProductLanManNt (=DC role), build 9600.
SOFTWARE\Microsoft\Windows NT\CurrentVersion → ProductName=Windows Server 2012 R2 Standard Evaluation, InstallationType=Server.SYSTEM\…\ComputerName → CITADEL-DC01; NTDS domain = C137.local.
2. OS of the Desktop? — Windows 10 Enterprise (Evaluation), build 19041 (v2004); workstation DESKTOP-SDN1RPT.
evidence
- volatility3
windows.info: NtMajorVersion 10, Major/Minor 15.19041, NtProductWinNt.
SOFTWARE\…\CurrentVersion → EditionID=EnterpriseEval, InstallationType=Client, build 19041.
3. Local time of the Server? — Pacific Standard Time, active offset UTC−7 (PDT) — mis-configured vs the org's true UTC−6. See the clock card above.
4. Was there a breach? — Yes — confirmed by ≥5 independent artifacts (external RDP, injected Meterpreter, Empire persistence, live C2, credential + data theft).
5. Initial entry vector? — External RDP to the internet-exposed DC. Successful interactive RDP as C137\Administrator from 194.61.24.102 at 2020-09-19 03:22:37 UTC — 90 s before the malware was dropped.
evidence & the brute-force caveat
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational EID 21 (session logon): 03:22:37Z · C137\Administrator · 194.61.24.102; disconnect (24) 03:52:46Z; reconnect 03:56:04Z. This log survived the Security-log blackout.- Brute-force = inferred, not log-proven: the DC
Security.evtx contains only 1 failed logon (4625) and no type-10 RDP — because the log's last event is 01:23:23Z (right after a 01:22:38 reboot) and the entire attack (03:2x–03:5x) falls in that blackout. RDP exposed straight to the internet + a sudden external admin logon is consistent with credential brute-force/stuffing; the failed-attempt storm simply isn't in the on-disk window.
6. Was malware used? — Yes — two kits: Meterpreter (coreupdater.exe → injected into spoolsv.exe) and PowerShell Empire (registry stager).
| sub-question | answer |
|---|
| i. malicious process | coreupdater.exe (DC PID 3644, session 2; ran 03:56:37–52Z) + the injected spoolsv.exe (DC PID 3724 / Desktop PID 2188) holding the live C2 |
| ii. IP that delivered payload | 194.61.24.102 (dropped it over the RDP session); second-stage pulled from C2 203.78.103.109 |
| iii. C2 IP | 203.78.103.109 : 443 |
| iv. on disk | C:\Windows\System32\coreupdater.exe (7168 bytes) — on both hosts |
| v. first appeared | DC 2020-09-19 03:24:06–12Z; Desktop 03:40:00Z |
| vi. capabilities | Meterpreter: full C2, file transfer, process injection/migration, pivot, credential theft; Empire: PowerShell post-exploitation. Runs as LocalSystem. |
| vii. easily obtained? | Yes — Metasploit/msfvenom + PowerShell Empire are free & open-source |
| viii. moved? | Yes — the same binary was redeployed DC→Desktop (lateral) |
| ix. persistence? | Yes, on BOTH hosts — see below |
evidence (memory injection, C2, persistence)
- Injection — vol3
malfind on DC spoolsv.exe PID 3724: multiple PAGE_EXECUTE_READWRITE regions with MZ headers; one starts 4D 5A 41 52 55 48 89 E5 ("MZARUH…") = the Meterpreter x64 reflective-loader stub.
- C2 — vol3
netscan: DC 10.42.85.10:62613 → 203.78.103.109:443 ESTABLISHED (owner coreupdater PID 3644); Desktop 10.42.85.115 → 203.78.103.109:443 ESTABLISHED ×2. It is the only non-RFC1918 C2 in the capture.
- Persistence #1 (service) —
SYSTEM\…\Services\coreupdater: Start=2 (auto), ImagePath=C:\Windows\System32\coreupdater.exe, ObjectName=LocalSystem — identical on both hosts.
- Persistence #2 (Empire registry) —
SOFTWARE\…\Run\coreupdate = powershell -nop -w hidden -c "iex([…]FromBase64String((Get-Item 'HKLM:Software\9sEoCawv').GetValue('45SVAG2o')))"; the decoded blob is an Empire launcher (GzipStream+base64 scriptblock). On both hosts.
7. Malicious IPs involved? — 194.61.24.102 (external RDP attacker) and 203.78.103.109:443 (C2; Thailand-based per scenario).
- i. Known adversary infra? Both are external/non-RFC1918;
203.78.103.109 is the dedicated C2. Threat-intel enrichment (VT/AbuseIPDB) is the right next step — not performed here to avoid fabricating reputation data; presented as IOCs.
- ii. Other attacks around that time? Requires the TI lookup above — flagged, not asserted.
8. Did the attacker access other systems? How / when / data? — Yes — the Desktop (DESKTOP-SDN1RPT, 10.42.85.115). How: RDP as C137\Administrator from the DC (10.42.85.10) using stolen domain-admin creds. When: 2020-09-19 03:36:25 UTC. Data: full domain credential DB (NTDS) dumped; secret files read.
evidence
- Desktop
TerminalServices-LocalSessionManager EID 21: 03:36:25Z · C137\Administrator · source 10.42.85.10 (the DC). Disconnect 03:52:13Z.
- Confirmed by
coreupdater.exe appearing on the Desktop at 03:40:00Z (MFT $SI/$FN) and the same C2 beacon in Desktop RAM.
9. Network layout? — Domain C137 / C137.local, subnet 10.42.85.0/24. DC CITADEL-DC01 = .10; workstation DESKTOP-SDN1RPT = .115. RDP exposed to the internet; external attacker 194.61.24.102; C2 203.78.103.109.
10. Architecture changes (immediate)? — Pull RDP off the internet → VPN + MFA / RD-Gateway; segment the DC; deploy EDR; egress-filter to kill the C2; centralize logs to a SIEM so host-side blackouts don't blind the investigation.
11. Steal the Szechuan sauce? Time? — Yes — C:\FileShare\Secret\Szechuan Sauce.txt opened by the attacker at 2020-09-19 03:32:21 UTC. Recipe recovered in full.
evidence + the recipe
…\Administrator\…\Recent\Szechuan Sauce.lnk mtime 11:32:21 HKT = 03:32:21Z (shortcut written when the file was opened).- Contents: ¼ cup low-sodium soy sauce · 2 tbsp maple syrup/brown sugar · 1 tbsp cornstarch · 1 tbsp chili-garlic sauce · 1 tbsp rice vinegar · ½ tsp Chinese 5-spice · ½ tsp red-pepper flakes · ½ tsp garlic powder · ½ tsp ground ginger — "From gimmesomeoven.com".
12. Other sensitive files accessed? Times? — Yes — SECRET_beth.txt opened 03:32:13Z (then deleted & replaced); PortalGunPlans.txt, NoJerry.txt in the same share; and the entire domain credential store (ntds.dit).
evidence
- Administrator Recent LNKs:
SECRET_beth.lnk 03:32:13Z, Beth_Secret.lnk / Secret.lnk 03:35:07Z.
ntds.dit + SYSTEM hive yielded all domain NT hashes (see B6).
13. Last known contact with the adversary? — The C2 channel was still ESTABLISHED at acquisition — DC RAM captured 2020-09-19 04:39:59 UTC, Desktop RAM 05:10:39 UTC; attacker RDP last reconnect 03:56:04Z. The attacker was still interactive when imaged.
② Attack timeline (UTC · 2020-09-19 unless noted)
| time (UTC) | event | source |
|---|
| 01:22:38 | DC reboots; Security log goes dark 01:23:23 (Desktop 01:24:08) — the blackout window | RAM / EVTX |
| 03:22:37 | RDP into DC as C137\Administrator from 194.61.24.102 (initial access) | TS-LSM |
| 03:24:06–12 | coreupdater.exe dropped on DC System32 | $MFT |
| 03:29:40 | spoolsv.exe (PID 3724) — Meterpreter injection target | RAM pslist |
| 03:32:13 / 03:32:21 | Attacker opens SECRET_beth.txt then the Szechuan Sauce recipe | LNK |
| 03:34:27 | SECRET_beth.txt deleted to Recycle Bin | $I file |
| 03:34:56 | Decoy Beth_Secret.txt created ($FN); $SI then timestomped → 2020-09-18 23:33:54 | $MFT |
| 03:36:25 | Lateral RDP DC→Desktop as C137\Administrator from 10.42.85.10 | Desktop TS-LSM |
| 03:40:00 | coreupdater.exe dropped on Desktop System32 | $MFT |
| 03:56:04–52 | Attacker RDP reconnect to DC; coreupdater process runs (PID 3644), C2 beacon | TS-LSM / RAM |
| 04:39:59 / 05:10:39 | DC then Desktop RAM acquired — C2 still ESTABLISHED | RAM SystemTime |
③ Bonus Questions (B1–B8)
B1. CIS / SANS controls that would have prevented this? — CIS v8 #4 (secure config — no internet-facing RDP), #6 (access control / MFA), #5 (account mgmt — kill the weak passwords), #8 (centralized audit logs), #10 (malware defenses / EDR), #13 (network monitoring to catch the C2). MFA + no-public-RDP would have directly stopped the initial access.
B2. Major architecture improvement? — Remove RDP from the internet entirely; place behind VPN + MFA or an RD Gateway; segment the DC from general workstations.
B3. Policy / control improvements? — Enforce a strong password policy (P@$$w0rd, Jessica@1 cracked instantly), MFA everywhere, least-privilege (no day-to-day domain-admin), centralized logging/SIEM, EDR, and egress filtering.
B4. Users who logged onto the DC? — C137\Administrator (interactive/RDP), plus network (type-3) logons from .115 as ricksanchez, mortysmith, Administrator.
B5. Users who logged onto the Desktop? — Local Admin, ricksanchez, mortysmith (and defaultuser0 during OS build).
B6. Passwords for the domain users? — Dumped all NT hashes from ntds.dit (impacket secretsdump), cracked 6/9 against rockyou (pure-Python MD4):
| account | password | NT hash |
|---|
| C137\Administrator (RID 500) | )&Denver89 | 10e63d3f2c9924bae49241cff847e405 |
| local Administrator | P@$$w0rd | f56a8399599f1be040128b1dd9623c29 |
| jerrysmith | !BETHEYBOO12! | bc51f858ccacc9db408c0ba511d5d639 |
| mortysmith | Jessica@1 | dc8b282b8f4e1dd3c5f95fd491ff6d8d |
| bethsmith | RedWine1! | b9cc9177094af2e17b413a0cbf63fac2 |
| birdman | (dimension5150) | 944055b77ebe7d6fd80f24b5fce634fb |
| ricksanchez | not in rockyou | 746447f27820a9d863eea94d176cc135 |
| summersmith | not in rockyou | 26b2cc706093c4fa46e0519ec5feaeaf |
krbtgt & machine-account hashes also recovered (omitted; random). ricksanchez/summersmith would need a rules/mask attack.
B7. Recover the file about Beth's Secret — original name & contents?
- Original name:
C:\FileShare\Secret\SECRET_beth.txt
- Original contents: "Earth beth is the real beth."
- What the attacker did: deleted it (Recycle Bin, 03:34:27Z), then planted a decoy
Beth_Secret.txt reading "Space Beth is the real Beth".
evidence (Recycle Bin recovery)
- Recovered from
$Recycle.Bin\S-1-5-21-…-500\$RU2L112.txt (the deleted data) — content "Earth beth is the real beth."
- Companion
$IU2L112.txt metadata → original path C:\FileShare\Secret\SECRET_beth.txt, deleted 2020-09-19 03:34:27Z. Corroborated by the SECRET_beth.lnk Recent shortcut.
B8. What file was timestomped? — C:\FileShare\Secret\Beth_Secret.txt — the decoy. Its $STANDARD_INFORMATION times were backdated ~4 h and the sub-seconds zeroed, while $FILE_NAME reveals the true creation.
| attribute | Created | tell |
|---|
| $SI (shown to users) | 2020-09-19 07:33:54.000000000 (host) | backdated + zeroed µs = stomped |
| $FN (true) | 2020-09-19 11:34:56.970445 (host) = 03:34:56Z | real creation, sub-second intact |
evidence + why the others are clean
istat on the decoy: $SI ≪ $FN by ~4 h and $SI µs = all-zero — the classic Metasploit/Empire timestomp double-signature.- The other three secret files (
NoJerry.txt, PortalGunPlans.txt, Szechuan Sauce.txt) have matching $SI/$FN with non-zero sub-seconds → not stomped. The legit binary coreupdater.exe was also not stomped on either host ($SI = $FN), which is how we know the stomp was deliberate and targeted at the decoy.
④ Extra Questions (not in the original CTF)
Other artifacts revealing how evidence was collected? — Yes — FTK Imager.exe (running from E:\) is visible in DC RAM (PID 2840), matching the client interview ("FTK Imager Lite + Redline Collector"). The 01:22 reboot + Security-log blackout is the acquisition/IR footprint, not attacker log-clearing (no 1102 event exists).
How many times did the attacker log in? — ≥2 external RDP connections to the DC from 194.61.24.102 (initial 03:22:37Z + reconnect 03:56:04Z after a 03:52 disconnect), plus 1 lateral RDP DC→Desktop (03:36:25Z).
Identify the outlier login without prior IOCs (frequency analysis)? — Group RDP sessions by source: all historical sessions are internal (WIN-E0PO207ERMD, host-local). Exactly one source — 194.61.24.102 — is external and appears only on 2020-09-19; it's the lone outlier and the lead.
What files did the attacker open (LNK artifacts)? — From Administrator's Recent shortcuts: Szechuan Sauce.txt, SECRET_beth.txt, Beth_Secret.txt, and the Secret folder (03:32–03:35Z).
Multiple sources of persistence within the malware? — Yes — (1) auto-start service coreupdater, (2) HKLM Run-key Empire PowerShell stager coreupdate, (3) in-memory Meterpreter migrated into spoolsv.exe — all replicated on both hosts (≈4 footholds total).
⑤ Indicators of Compromise (IOCs)
| type | value | role |
|---|
| IP | 194.61.24.102 | external RDP source (initial access) |
| IP:port | 203.78.103.109:443 | Meterpreter C2 (both hosts) |
| file | C:\Windows\System32\coreupdater.exe | Meterpreter service binary (7168 B) |
| service | coreupdater (auto, LocalSystem) | persistence #1 |
| registry | HKLM\SOFTWARE\…\Run\coreupdate → HKLM\Software\9sEoCawv\45SVAG2o | Empire persistence #2 |
| process | injected spoolsv.exe (RWX + MZ "MZARUH") | migrated Meterpreter |
▸ Methodology & toolchain (for the curious / the next analyst)
- Scope: disk + RAM only, both hosts (Ultra-Violence tier). No PCAP / autoruns / protected-files — extracted hives, EVTX, $MFT, NTDS ourselves, as the exercise intends.
- Integrity: all four evidence zips MD5-verified against the published hashes before processing.
- Disk:
ewfmount (E01→raw) → mmls → ntfs-3g ro mount → fls/icat/istat (Sleuth Kit); analyzeMFT for the $MFT timeline; manual $SI-vs-$FN comparison for timestomp.
- Memory: volatility3 —
windows.info / pstree / psscan / netscan / cmdline / svcscan / malfind.
- Registry:
regipy (timezone, services, Run keys, OS, decoded the Empire blob).
- Logs: EVTX parsed via the
python-evtx library (4624/4625, TerminalServices LSM 21/24, System 7045).
- Credentials: impacket
secretsdump (LOCAL: SAM + NTDS); cracked with pure-Python MD4 (impacket compute_nthash) over rockyou.
- Discipline: every answer derived from artifacts; the published "answers"/walkthrough pages were deliberately not opened.
Verdict: a complete, evidence-backed reconstruction — internet-exposed RDP → Meterpreter + Empire → domain-wide credential theft → DC→Desktop lateral → recipe & secret exfil → deletion, decoy, and timestomp to cover tracks, with the C2 still live at capture. All 13 core + 8 bonus + 5 extra questions answered, each traceable to a specific artifact.