Week 8 - Last Ascent: ICS/SCADA Incident Response Investigation#

Question#

Identify how the Powergrid was shut down. State the technical status of the turbines after the attack (flags, control bits, output states) and provide the IP address of the system from which the attack was performed.

Answer#

Evidence Collection#

1
import Evtx.Evtx as evtx
2

3
evtx_path = r'RESOURCES\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx'
4

5
with evtx.Evtx(evtx_path) as log:
6
    for record in log.records():
7
        xml = record.xml()
8
        if '192.168.1.253' in xml:
9
            print(xml[:3000])

1
<Event>
2
  <System>
3
    <EventID>3</EventID>  <!-- Network Connection -->
4
    <TimeCreated SystemTime="2025-10-30 08:59:58.343"/>
5
    <Computer>RESOURCES.scada.megacorpone.com</Computer>
6
  </System>
7
  <EventData>
8
    <Data Name="Protocol">tcp</Data>
9
    <Data Name="SourceIp">192.168.1.2</Data>
10
    <Data Name="DestinationIp">192.168.1.253</Data>
11
    <Data Name="DestinationPort">22</Data>
12
  </EventData>
13
</Event>

Question#

From where did the attacker gain the knowledge necessary to perform this attack? If from a file, include the complete filename and its SHA-256 hash.

Answer#

Evidence Collection#

Hash Verification:

1
certutil -hashfile "RESOURCES\Shares\SCADA\docs\WT-PLC_Turbine_Control_Manual.pdf" SHA256

Output:

1
SHA256 hash: 635598615d4a9823b36163796fdc3c45702280097bad8df23fc1b8c39c9d7101

Key Information in Manual:

• Complete Modbus Register Map (coils, discrete inputs, holding registers)
• Operating procedures with Python code examples
• Lockout trigger conditions (>20% change in 2 minutes)
• Modbus TCP ports (1502-1505 for turbines)

Question#

How was the attacker able to compromise the RESOURCES machine? Provide the name of the exploited program and the SHA-256 hash of the malicious file used in the compromise.

Answer#

Evidence Collection#

Source Files:

• RESOURCES\Shares\Monitoring\MonitorTool.xml (Scheduled Task)
• RESOURCES\Shares\Monitoring\monitor.log (Execution Log)

Scheduled Task Analysis:

1
<Task>
2
  <Triggers>
3
    <TimeTrigger>
4
      <Repetition>
5
        <Interval>PT10M</Interval>  <!-- Runs every 10 minutes -->
6
      </Repetition>
7
    </TimeTrigger>
8
  </Triggers>
9
  <Actions>
10
    <Exec>
11
      <Command>C:\Shares\Monitoring\MonitorTool.exe</Command>
12
    </Exec>
13
  </Actions>
14
</Task>

Attack Timeline from Logs:

1
C:\Shares\Monitoring\CheckHealth.exe not found
2
Backing up PCAPs off of router2
3
...
4
Executing C:\Shares\Monitoring\CheckHealth.exe  <-- Malicious file executed!

Attack Mechanism: Binary Planting / DLL Search Order Hijacking

• MonitorTool.exe runs as a scheduled task every 10 minutes
• Attacker placed malicious CheckHealth.exe in the Monitoring share
• MonitorTool.exe executed the malware with elevated privileges

Question#

What two pieces of information did the attacker obtain on the RESOURCES system that enabled them to pivot to the next system in the attack path?

Answer#

Evidence Collection#

Source File: CLIENT8\amara.okafor\.ssh\router2.privkey

1
Get-ChildItem "CLIENT8\amara.okafor\.ssh" -Recurse
2
# Output: router2.privkey

Key Metadata:

1
-----BEGIN OPENSSH PRIVATE KEY-----
2
nukingdragons@blackarch  <-- Attacker attribution
3
-----END OPENSSH PRIVATE KEY-----

Question#

How did the attacker harvest credentials on CLIENT8? Enter the SHA-256 hash of the tool or technique responsible for the credential harvesting.

Answer#

Investigation Process#

1
Get-ChildItem "CLIENT8\System32" | Where-Object { $_.Name -eq "ssp.dll" }

1
Name     Length  LastWriteTime
2
----     ------  -------------
3
ssp.dll  14848   10/30/2025 4:49:20 AM  <-- Attack timestamp!

1
$hash = (Get-FileHash "CLIENT8\System32\ssp.dll" -Algorithm SHA256).Hash
2
# Output: 566DEE9A89CE772E640CDB1126480F83EE048CEA4B7661A9427AF42A9FAB8B46

Question#

What is the domain of the phishing website and the user’s browser name along with its version accessed by Amara on CLIENT8?

Answer#

Investigation Process#

1
$versionPath = "CLIENT8\amara.okafor\AppData\Local\Google\Chrome\User Data\Last Version"
2
Get-Content $versionPath
3
# Output: 137.0.7151.56

1
$historyPath = "CLIENT8\amara.okafor\AppData\Local\Google\Chrome\User Data\Default\History"
2
[System.Text.Encoding]::UTF8.GetString([System.IO.File]::ReadAllBytes($historyPath)) |
3
    Select-String -Pattern "microsoft-login" -AllMatches

Phishing Attack Analysis#

• Malicious Domain: microsoft-login.com - Typosquatting domain mimicking Microsoft
• Legitimate Domain: login.microsoftonline.com or login.microsoft.com
• Attack Flow: User received phishing email Clicked link Visited fake login Credentials harvested

Question#

How did the attacker elevate their privileges on CLIENT8? Enter the name and SHA-256 hash of the program responsible for the elevation of privileges. What is the CVE related to the vulnerability that was used to escalate their privileges?

Answer#

Investigation Process#

1
Get-ChildItem "CLIENT8\System32" | Where-Object { $_.Name -like "*BitLocker*" }

1
Name                          Length  LastWriteTime
2
----                          ------  -------------
3
BitLockerDeviceEncryption.exe 184320  5/7/2022 12:39:28 PM   <-- Legitimate
4
BitLockerDeviceEncrypton.exe  29184   10/30/2025 4:43:50 AM  <-- MALICIOUS (typo!)

How Do We Know BitLockerDeviceEncrypton.exe and CVE-2024-35250 Are Connected?#

1
<EventData>
2
  <Data Name='ImageLoaded'>C:\Windows\System32\drivers\mskssrv.sys</Data>
3
  <Data Name='Hashes'>SHA256=6B712ADDF7C6B583F23F518BF35F7ECBBFA632F14E29EBE2A8E38043B1269E74</Data>
4
  <Data Name='Signed'>true</Data>
5
  <Data Name='Signature'>Microsoft Windows</Data>
6
</EventData>

1
STACKID: \driver\ksthunk,\driver\mskssrv,\driver\swenum
2
Service: mskssrv
3
DriverName: mskssrv.sys

File Hashes (SHA-256)#

Malicious Domains#

Network Indicators#

File Paths (Attacker Artifacts)#

1
C:\Windows\System32\ssp.dll
2
C:\Windows\System32\BitLockerDeviceEncrypton.exe
3
CLIENT8\amara.okafor\.ssh\router2.privkey

CVE References#

Immediate Actions#

1. Isolate CLIENT8 from the network
2. Reset all credentials for amara.okafor and carmen.santos
3. Block domain microsoft-login.com at network perimeter
4. Deploy IOC signatures to EDR/SIEM
5. Manual turbine restart after 24-hour lockout expires

Long-term Mitigations#

1. Patch CVE-2024-35250 on all Windows systems
2. Enable Credential Guard to protect LSASS
3. Implement phishing-resistant MFA (FIDO2/WebAuthn)
4. Network segmentation between IT and OT networks
5. Monitor SSP registry keys for unauthorized modifications
6. ICS-specific monitoring for Modbus protocol anomalies
7. Remove unnecessary documentation from SCADA shares