HackTheBox Sherlock DFIR Easy Scenario "CAMouflage"
Sherlock Scenario: A newly launched campaign has been detected targeting multiple users utilizing cracked applications. We received an alert indicating unusual behavior from one of our user’s laptops and performed an initial triage. Your task is to conduct a deep dive investigation to determine the root cause and extent of the incident.
Start
CAMouflage is a Windows DFIR Sherlock focused on analyzing the execution of a trojanized cracked software installer. At the first you have to find is the cracked software. A good starting point is the $MFT table and $USN journal:
Open the csv with TimeLineExplorer for example or with any text editor and search for 'Cracked' keyword. You'll find DOWNLOAD MASTERCAM X9 FULL.
The investigation begins with a user (victim) searching for and downloading a cracked version of Mastercam. The installer drops several disguised files into the user's temporary directory, extracts a CAB archive, performs antivirus and EDR checks, reconstructs an AutoIt payload, and contacts command-and-control infrastructure.
Start by extracting the challenge files:
7z x CAMouflage.zip -phacktheblue -oCAMouflage
7z x CAMouflage/2025-06-21T205150_output.zip -oCAMouflage/evidence
This is a preview of an article or content section that is not ready to be disclosed.
It starts with limited visibility...
For this lab, use PECmd, MFTECmd, Registry Explorer, DB Browser for SQLite, PowerShell, and a hex editor to examine the collected Windows artifacts. The main goal is to reconstruct the malware execution timeline, identify the dropped and reconstructed payloads, deobfuscate the batch script, and determine the command-and-control infrastructure without executing the sample.