🥡 The Stolen Szechuan Sauce — Case 001 · Verified & Corrected
2026-06-26 · my blind solve (disk+RAM only) now checked against the official DFIR Madness answer key + 2 independent subagents + Codex (separate model lineage) · magenta = I was wrong / missed cyan = verified right (diverged from key & confirmed) · the original blind render is frozen read-only as evidence (…-FROZEN.html, md5 e1a289c7…)
▸ How to read this edition
- Every original answer is preserved verbatim (green = what I concluded blind). Beneath it, a coloured block shows the verification result: magenta = I was wrong / missed / imprecise (fix it); cyan = verification confirmed I was right in a spot where my artifact evidence diverged from — or was richer than — the official key. One colour, one meaning.
- Headline result: the attack narrative I reconstructed blind is fully corroborated by the official key. Magenta defects: one systematic +1h clock offset, one substantive miss (the exfil archives), one over-attribution ("Empire"), and a handful of refinements. Cyan wins: four spots where I diverged from the key and verification proved me right (Pacific/UTC−7, the
coreupdater.exe spelling, mortysmith, the local-Admin password).
- Verification was adversarial on purpose: the checkers were told to distrust me and hunt for errors. Codex (GPT, different lineage) adjudicated the cases where my disk/RAM evidence diverges from the key.
Blind solve verdict: substantially correct. Initial vector, both OSes, malware family, C2 IP, attacker IP, process-injection chain, persistence, network layout, lateral-movement mechanism, credential theft, Beth-secret recovery, and the timestomped file all match the official key — several with more precision than the key itself.
⏱ CORRECTION #1 — systematic clock offset (affects every timestamp I reported)
I reported all times in host-artifact UTC and treated them as ground truth. They are true UTC + 1 hour. Subtract 1 hour from every time in the original answers to get real-world (PCAP-authoritative) UTC. Confirmed independently by both subagents and Codex.
Mechanism: the VM was set to Pacific (UTC−7/PDT) but its wall-clock held Colorado/Mountain local time; Windows therefore added 7 h instead of 6 when writing UTC into EVTX/$MFT/memory, so host artifacts read 1 h late. The PCAP router (correctly UTC−6) is the authority. The key itself shows this: the lateral RDP is "02:35:54 true / 03:35:54 host-uncorrected." My event ordering and relative timing are correct — only the absolute clock was shifted. e.g. coreupdater drop 03:24:06Z → 02:24:06 true; sauce access 03:32:21Z → 02:32:21 true.
+1h
clock offset (all times)
1
over-attribution (Empire)
5/5
cracked pw exact-match
3
checkers (2 agents+Codex)
⚖️ Corrections at a glance
| # | topic | what changed | type |
|---|
| 1 | All timestamps | −1h to get true UTC (host clock ran +1h) | systematic error |
| 2 | Exfil data (Q8/Q12) | Missed secret.zip (DC, exfil ~02:31 true) & loot.zip (Desktop, ~02:48) — created via GUI, exfiltrated via meterpreter, deleted | substantive miss |
| 3 | Malware ID (Q6) | "PowerShell Empire" over-claimed (~35% conf); it's Empire-like registry PowerShell, equally consistent with Metasploit's own persistence | over-attribution |
| 4 | Initial vector (Q5) | Brute-force is confirmed (Hydra), not just inferred; missed the 02:19 NMAP 3389 recon probe | under-claim + miss |
| 5 | Payload delivery (Q6.ii) | Delivered via IE over HTTP from 194.61.24.102; drop my "2nd stage from C2 203.x" clause (203 is C2 only) | imprecision |
| 6 | "Moved" (Q6.viii) | Key means local move Downloads → System32, not my cross-host reading | misinterpretation |
| 7 | Service install time (Q6) | DC service installed 02:27:49 true — I couldn't time it (gapped Security log) | miss |
| 8 | Threat intel (Q7) | 194.61.24.102 = known RDP brute-forcer; 203.78.103.109 briefly tied to happydoghappycat-th.com/APT (later retracted) | now sourced |
| 9 | Passwords (B6) | + ricksanchez 800PortalsForMe%, summersmith 34MarvelBootySalmon$$ (not in rockyou) | completion |
| — | Q3 / filename / B5 / local-pw | NOT errors — verification confirmed my artifact evidence is right / richer than the key (see inline, in cyan) | verified right |
① Core Questions (1–13) — original answers + corrections
⏱ Clock provenance (original note — correct as far as it went). Host TZ = Pacific (UTC−7 active); org is Colorado (UTC−6). All host timestamps stored in UTC.
▸ refine What I under-stated: the misconfig didn't just mislabel the zone, it shifted the absolute UTC by +1h vs the PCAP. Treat every host time as −1h for reality. (See Correction #1.)
1. OS of the Server? — Windows Server 2012 R2 Standard (Eval), build 9600; DC CITADEL-DC01, domain C137.local. ✓ match (richer than key's "Windows 2012")
2. OS of the Desktop? — Windows 10 Enterprise (Eval), build 19041; DESKTOP-SDN1RPT. ✓ match
3. Local time of the Server? — Pacific Standard Time, active UTC−7 (PDT).
▸ verified right — my artifact answer stands The key's headline answer says "Mountain UTC−6", but the registry artifact says Pacific/UTC−7 (and the key's own author confirms in the comments it's a "bad admin" misconfig). So: the machine was configured to Pacific/UTC−7 (my answer, forensically correct); UTC−6 is merely the zone it should have been. This very misconfig is what causes Correction #1.
4. Was there a breach? — Yes. ✓ match
5. Initial entry vector? — External RDP; logon as C137\Administrator from 194.61.24.102 @ 03:22:37Z; brute-force inferred (Security log blacked out before the window).
▸ correction — upgrade to confirmed + a miss Per the key, brute-force is confirmed: tool was Hydra, and it was preceded by an NMAP probe of TCP 3389 at 02:19 true (which I missed — it's only in the PCAP I didn't have). Logon true time → 02:22:37. My RDP-from-194.61.24.102 finding (from the surviving TS log) was right; I just over-hedged on "inferred" because my host Security log was gapped.
6. Malware? — Yes — coreupdater.exe (Meterpreter) injected into spoolsv.exe; + a registry PowerShell stager I labelled "Empire".
| sub-q | my answer | verdict |
|---|
| i. process | coreupdater + injected spoolsv (PIDs given) | ✓ exact match (coreupdater→spoolsv migration) |
| ii. delivery IP | 194.61.24.102 (+ "2nd stage from C2 203.x") | IP ✓; mechanism = IE/HTTP download; drop the "2nd-stage from 203" clause |
| iii. C2 | 203.78.103.109:443 | ✓ exact |
| iv. on disk | C:\Windows\System32\coreupdater.exe | ✓ verified right — key's "coreupdate.exe" is a key typo; mine confirmed in $MFT+registry+RAM |
| v. first appeared | DC 03:24:06–12Z; Desktop 03:40:00Z | ✓ sequence; true = 02:24:06 / 02:40 (−1h) |
| vi. capabilities | full Meterpreter (+Empire) | Meterpreter ✓; the "+Empire" tag is the over-claim (see correction below) |
| vii. easily obtained | Yes (free/open-source) | ✓ |
| viii. moved? | "redeployed DC→Desktop" | wrong axis — see below |
| ix. persistence | service + Run-key, both hosts | ✓ exact ("both registry and service") |
▸ correction — Empire over-attribution I called the Run-key PowerShell stager PowerShell Empire. Codex (independent) rates that ~35% confidence: a base64+gzip+IEX Run-key launcher is Empire-like but not uniquely diagnostic — Metasploit's own PowerShell/registry persistence produces the same shape, and the official key attributes everything to Metasploit/meterpreter only. Correct framing: "registry-resident base64/gzip/IEX PowerShell persistence (Empire-style; attribution unconfirmed)." The service + Run-key dual persistence is real either way.
▸ correction — "moved" (viii) The key's "moved" = the binary was relocated from the Administrator's Downloads folder to C:\Windows\System32\ on disk. I answered a different fact (cross-host deployment). Both happened, but the intended answer is the local Downloads→System32 move.
▸ correction — payload delivery (ii) & service-install time The binary arrived via Internet Explorer over HTTP from 194.61.24.102 (not "pulled from the C2"); 203.78.103.109 is C2 only. The DC service was installed at 02:27:49 true — I couldn't timestamp it because the host Security log was gapped.
7. Malicious IPs? — 194.61.24.102 (RDP attacker) + 203.78.103.109:443 (C2). TI attribution deferred (declined to fabricate). ✓ IPs exact
▸ now sourced (I correctly didn't guess; the key supplies it) 194.61.24.102 was being tracked as hostile prior to the incident — specifically for RDP brute-force. 203.78.103.109 was briefly attached to happydoghappycat-th.com and an alleged APT, but that was later reported as not involved. So Q7.i/ii = "yes, known adversary infra, seen in other attacks" — with the APT caveat.
8. Other systems accessed? How/when/data? — Desktop (10.42.85.115) via RDP from the DC (10.42.85.10) as C137\Administrator @ 03:36:25Z; data = NTDS credential dump + secret files. (Noted no exfil zips persisted on disk.)
▸ correction — the exfil archives (my biggest miss) + time True lateral-move time → 02:35:54 (−1h). And the actual "what was stolen" answer is two staged archives I missed: secret.zip built on the DC via the GUI and exfiltrated ~02:31 true, and loot.zip on the Desktop, exfiltrated ~02:48 true — both then deleted via meterpreter. My "no zip on disk" was literally true (they were deleted) but I missed that they existed and were the exfil vehicle; they'd be recoverable from the USN journal / $LogFile / memory — a gap in my pass. (The credential + secret-file theft I did find still stands.)
9. Network layout? — C137 / C137.local, 10.42.85.0/24; DC .10, Desktop .115; ext attacker 194.61.24.102; C2 203.78.103.109. ✓ match (richer)
10. Architecture changes? — RDP off the internet (VPN+MFA/RD-Gateway), segment DC, EDR, egress filtering, central SIEM. ✓ match (richer)
11. Steal the sauce? Time? — Szechuan Sauce.txt opened @ 03:32:21Z. ✓ exact event
▸ time True time → 02:32:21 (key: "accessed 02:32:21"; "stolen approx 0230"). Event and second-precision matched exactly; only the +1h applies.
12. Other sensitive files? Times? — SECRET_beth.txt opened 03:32:13Z, deleted 03:34:27Z; PortalGunPlans.txt; NoJerry.txt; full NTDS.
▸ time + the zips again True → opened 02:32:13, deleted 02:34:27 (key: "Beth's secrets manipulated ~0234"). Key also notes "Morty's thoughts stolen ~0234" = the loot material. Reiterate the missed secret.zip / loot.zip exfil vehicles from Correction #2.
13. Last known contact? — C2 still ESTABLISHED at acquisition (DC 04:39:59Z / Desktop 05:10:39Z); RDP last reconnect 03:56:04Z; attacker still interactive. ✓ conclusion matches
▸ time True → captures 03:39:59 (DC) / 04:10:39 (Desktop); last reconnect 02:56:04 (key: "last interactive logoff ~0300 UTC; still interacting at capture"). Conclusion was correct.
② Attack timeline — host UTC (as I reported) → true UTC (−1h)
| host UTC | true UTC | event |
|---|
| — | 02:19 | NMAP probe TCP 3389 from 194.61.24.102 (I missed — PCAP-only) |
| 03:22:37 | 02:21–02:22 | Hydra RDP brute-force → Administrator logon from 194.61.24.102 |
| 03:24:06–12 | 02:24:06 | coreupdater.exe delivered (IE/HTTP) & dropped on DC |
| — | 02:27:49 | coreupdater installed as AutoStart service on DC (I missed the time — gapped log) |
| — | ~02:30 / ~02:31 | secret.zip built (GUI) & exfiltrated, then deleted (I missed) |
| 03:32:21 | 02:32:21 | Szechuan Sauce.txt accessed |
| 03:34:27 | 02:34 | SECRET_beth.txt deleted; decoy Beth_Secret.txt created |
| ~03:38 | ~02:38 | Beth_Secret.txt timestomped (to match PortalGunPlans.txt) |
| 03:36:25 | 02:35:54 | lateral RDP DC→Desktop as Administrator (from 10.42.85.10) |
| 03:40:00 | 02:40 | coreupdater dropped on Desktop; @02:41 persistence (svc+registry) |
| — | ~02:46 / ~02:48 | loot.zip built (GUI) & exfiltrated, then deleted (I missed) |
| 03:56:04 | 02:56 | attacker RDP reconnect; meterpreter restarted & migrated |
| 04:39:59 / 05:10:39 | 03:39:59 / 04:10:39 | DC then Desktop RAM acquired — C2 still ESTABLISHED |
③ Bonus (B1–B8)
B1–B3 (controls/architecture/policy) — No internet RDP, MFA, segmentation, strong passwords, central logging, EDR, egress filtering. ✓ aligns (VPN/IPS/firewall/password-complexity/EDR)
B4. Users on the DC? — Administrator (interactive) + network logons from .115 (ricksanchez, mortysmith, Administrator). ✓ (key: "Administrator")
B5. Users on the Desktop? — local Admin, ricksanchez, mortysmith (+ defaultuser0 build).
▸ verified right — my evidence is richer, not wrong Key lists "Administrator and Rick Sanchez". My disk shows a mortysmith profile folder AND mortysmith type-2 logon events, so including him is evidence-backed (Codex agreed: key is terse/incomplete). Keeping mortysmith.
B6. Domain passwords? — Cracked 6/9 from ntds.dit; all matched the key exactly:
| account | my result | key |
|---|
| Administrator | )&Denver89 | ✓ |
| jerrysmith | !BETHEYBOO12! | ✓ |
| mortysmith | Jessica@1 | ✓ |
| bethsmith | RedWine1! | ✓ |
| birdman | (dimension5150) | ✓ |
| ricksanchez | not in rockyou | 800PortalsForMe% |
| summersmith | not in rockyou | 34MarvelBootySalmon$$ |
| local Administrator | P@$$w0rd | ✓ verified-right extra — not in key, recovered from local SAM |
▸ completion The two I couldn't crack are complex (not in rockyou) — supplied by the key: ricksanchez = 800PortalsForMe%, summersmith = 34MarvelBootySalmon$$. A rules/mask attack would have gotten them. All 5 (+local) I did crack are exact.
B7. Recover Beth's secret — name & contents? — Original SECRET_beth.txt = "Earth beth is the real beth." (recovered from Recycle Bin); decoy Beth_Secret.txt = "Space Beth is the real Beth". ✓ match
▸ casing nit Key spells it Secret_Beth.txt and "Earth Beth is the real Beth." — substance identical; capitalisation differs.
B8. Timestomped file? — Beth_Secret.txt (the decoy); $SI backdated + sub-seconds zeroed vs real $FN. ✓ exact
▸ corroboration Key adds the tell I observed but didn't name: it was stomped to match PortalGunPlans.txt's timestamp (both share the :33:54 second — confirms it).
④ Extra Questions
⑤ IOCs (with verified threat-intel)
| type | value | role / intel |
|---|
| IP | 194.61.24.102 | RDP brute-force source (Hydra); tracked hostile pre-incident |
| IP:port | 203.78.103.109:443 | Meterpreter C2 (both hosts); briefly linked to happydoghappycat-th.com/APT, later retracted |
| file | C:\Windows\System32\coreupdater.exe | Meterpreter service binary (7168 B); moved from …\Administrator\Downloads |
| service | coreupdater (auto, LocalSystem) | persistence — installed DC 02:27:49 true |
| registry | HKLM\…\Run\coreupdate → HKLM\Software\9sEoCawv\45SVAG2o | PowerShell stager persistence (Empire-style, unconfirmed) |
| archives | secret.zip (DC) · loot.zip (Desktop) | exfil vehicles — created via GUI, exfiltrated, deleted |
▸ Verification methodology (how this edition was checked)
- Source of truth: the official DFIR Madness answer key (fetched via the real browser once the blind solve was frozen). The key is explicitly a "functional / not-final" draft and is itself imprecise in places (e.g. the
coreupdate.exe typo, the Pacific-vs-Mountain headline).
- Checker 1 & 2 (subagents): split Q1–Q7 and Q8–B8; each told to distrust the analyst and emit a discrepancy table.
- Checker 3 (Codex, GPT lineage): adjudicated the clock-skew math (sign/direction), and classified each divergence as analyst-wrong vs key-incomplete — the cross-lineage check that a second Claude couldn't provide. It also down-graded the "Empire" attribution.
- Convergence: all three independently confirmed the +1h offset and the exfil-zip miss; all three agreed Q3/filename/B5/local-pw are cases where the host-artifact evidence is more complete than the key, not errors.
- Discipline preserved: the original blind solve never consulted any answer/walkthrough; this edition annotates it after the fact. The frozen original is read-only.
Final verdict: the blind reconstruction was correct on every load-bearing fact — vector, malware, C2, injection, persistence, lateral movement, credentials, data targets, recovery, and timestomp — and frequently more precise than the key. The honest defects: a uniform +1h clock offset (must subtract an hour), a missed pair of exfil archives (secret.zip / loot.zip, deleted post-exfil), and an over-confident "Empire" label. Net: a high-fidelity solve from disk + RAM alone, with its own errors now mapped in magenta.