Fruitzy

Scenario

CyberJunkie started out as a junior QA Analyst at his friend's startup. He called the CEO of the startup because he believed he had mistakenly downloaded something malicious. The CEO sought help from you, his friend in the cybersecurity field. You sent him a guide on collecting evidence from the machine using KAPE. Now you have been given the forensic image so you can analyze and help your friends, as they cannot afford to hire an MSSP.

We are provided with Fruitzy.zip, it contains:

Special Party Invitation from JANET CARNAHAN.eml
2026-03-04T171958_forensicdata.zip

The forensics data zip contains:

2026-03-04T171958_forensicdata.vhdx

Tasks

What is the Subject/topic of the Phishing email?

From the .eml file (this is an email), we can see the Subject field:

Special Party Invitation from JANET CARNAHAN

What is the malicious URI that the malicious link redirected to?

From the email again we have a couple of important information:

The Date field: Wed, 4 Mar 2026 19:48:56 +0500
The original url: hXXps[://]pomi[.]digital/premium?<SNIP>

Though we wont get the 'redirected' url from the email, we have to go in and dig the forensics image. For .vhdx we can use libguestfs-tools. I first tried mounting the image but I had some errors, we can access the guestfish shell instead:

              guestfish -a 2026-03-04T171958_forensicdata.vhdx

# Welcome to guestfish, the guest filesystem shell for
# editing virtual machine filesystems and disk images.
#
# Type: ‘help’ for help on commands
#       ‘man’ to read the manual
#       ‘quit’ to quit the shell
#
><fs> run
#  100% ⟦▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒⟧ 00:00
><fs> list-filesystems
# /dev/sda1: ntfs
><fs> mount /dev/sda1 /
><fs> ls /
# 2026-03-04T17_19_58_7518108_CopyLog.csv
# 2026-03-04T17_19_58_7518108_SkipLog.csv.csv
# C
# System Volume Information

            

We're not going to manually traverse the computer, instead we can refer to the CopyLog.csv file, it contains all the files that were copied by KAPE.

><fs> download /2026-03-04T17_19_58_7518108_CopyLog.csv ./CopyLog.csv

We find this line in particular:

2026-03-04 17:20:19.9523402,C:\Users\cyberjunkie\AppData\Local\Microsoft\Edge\User Data\Default\History,<SNIP>

This is the Edge history sqlite3 database, we can transform the path into a linux path and download it:

              ><fs> download "/C/Users/cyberjunkie/AppData/Local/Microsoft/Edge/User Data/Default/History" edge_history.db

            

Now let's query it:

              sqlite3 edge_history.db .tables
-- cluster_keywords                  edge_urls
-- cluster_visit_duplicates          edge_visits
-- clusters                          history_sync_metadata
-- clusters_and_visits               keyword_search_terms
-- content_annotations               meta
-- context_annotations               segment_usage
-- downloads                         segments
-- downloads_slices                  urls
-- downloads_url_chains              visit_source
-- edge_favicons                     visited_links
-- edge_keyword_search_terms_source  visits

sqlite3 edge_history.db '.schema urls'
CREATE TABLE urls(id INTEGER PRIMARY KEY AUTOINCREMENT,url LONGVARCHAR,title LONGVARCHAR,visit_count INTEGER DEFAULT 0 NOT NULL,typed_count INTEGER DEFAULT 0 NOT NULL,last_visit_time INTEGER NOT NULL,hidden INTEGER DEFAULT 0 NOT NULL);
CREATE INDEX urls_url_index ON urls (url);

sqlite3 edge_history.db 'select last_visit_time,url from urls;' | head -n 2
-- 13416251593160980|https://www.microsoft.com/edge/welcome?form=MT00LJ&form=MT004A&OCID=MT004A
-- 13416251593160980|https://www.microsoft.com/en-us/edge/welcome?form=MT00LJ&form=MT004A&OCID=MT004A&cs=1851577920

            

We won't be able to use the timestamp since it doesn't align at all with the email timestamp, not sure why, let's look for the original url instead:

              sqlite3 edge_history.db 'select url from urls;' | grep -A 2 "pomi.digital"
-- hXXps[://]pomi[.]digital/premium?__cf_chl_tk=6SX3C1utT5mfbwmflZyMDU.WICiyPkGsBkaOTitVBss-1772039836-1.0.1.1-JvMwxVsDmAF0zIVuaF0XNh73a8usyjzPeFDOJpaT4j8
-- hXXps[://]pomi[.]digital/premium?__cf_chl_rt_tk=w59oZWvS3Vz.mLudGWf5hrJd1Qc6TuOHBoGAt5pnySE-1772642625-1.0.1.1-xz5vcohmM5zoiCOoHJcn3YCxKEyiezQL.lAujKNV9t8
-- hXXps[://]pomi[.]digital/premium?__cf_chl_tk=w59oZWvS3Vz.mLudGWf5hrJd1Qc6TuOHBoGAt5pnySE-1772642625-1.0.1.1-xz5vcohmM5zoiCOoHJcn3YCxKEyiezQL.lAujKNV9t8
-- hXXps[://]pomi[.]digital/premium/
-- hXXps[://]pomi[.]digital/premium/windows_download.php

            

The malicious redirection url is hXXps[://]pomi[.]digital/premium/windows_download.php

What is the name of the downloaded file?

Back in the database, we have a downloads table:

              sqlite3 edge_history.db 'select target_path,danger_type from downloads;' | head -n 10
-- C:\Users\cyberjunkie\Downloads\premium.exe|6

The name of the downloaded file is premium.exe

When was the downloaded file executed by the victim according to Amcache?

We can check for where the Amcache hive is located in the CopyLog.csv:

2026-03-04 17:20:22.3859286,C:\Windows\AppCompat\Programs\Amcache.hve,<SNIP>
2026-03-04 17:20:22.4170898,C:\Windows\AppCompat\Programs\Amcache.hve.LOG1,<SNIP>
2026-03-04 17:20:22.4450479,C:\Windows\AppCompat\Programs\Amcache.hve.LOG2,<SNIP>

Ok now we need a tool to parse it, on linux we can use RegRipper:

apt install regripper -y

Then download the file from guestfish and parse it:

              regripper -r Amcache.hve -p amcache | tee amcache.dmp
# Launching amcache v.20200515
# amcache v.20200515
# (amcache) Parse AmCache.hve file
# <SNIP>

            

Looking inside the dump for premium.exe we find:

              c:\users\cyberjunkie\downloads\premium.exe  LastWrite: 2026-03-04 16:44:33Z
Hash: 405481d3d5529445c546d4429b72c5827ebde840

The file was executed on 2026-03-04 16:44:33

What is the SHA256 hash of the malicious executable downloaded from the phishing Website?

I don't really know of any local way of getting this data, KAPE doesn't save personal user files (e.g., Downloads/), the hash seen above is a SHA1, and there is no trace of the file anywhere else.

The only solution I see is using that SHA1 on virustotal, which gives up a result, and the SHA256:

af240a2c2a4b42e3a130f47ccaab9aa2e20a1a586bc959ee9efd7475055ea7e3

The user executed the file, but no invitation appeared or was found. They then used Microsoft Defender to scan the file. When was this scan initiated?

We can use CopyLog.csv again to look for the Defender event logs file:

2026-03-04 17:20:20.5420248,C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx,<SNIP>

To parse .evtx on linux we can use evtx_dump (download latest standalone):

              # Note: KAPE seems to store `winevt/Logs` as `winevt/logs` (case).
download "/C/Windows/System32/winevt/logs/Microsoft-Windows-Windows Defender%4Operational.evtx" defender.evtx

              evtx_dump defender.evtx -o jsonl | grep "premium.exe" | jq '.Event'
# ...

# "TimeCreated": {
#   "#attributes": {
#     "SystemTime": "2026-03-04T16:48:00.982830Z"
#   }
# },

# ...

# "Scan Resources": "file:_C:\\Users\\cyberjunkie\\Downloads\\premium.exe",

            

Scan initiated: 2026-03-04 16:48:00

The malware installed a Remote Monitoring and Management (RMM) tool as a backdoor for potential remote access. What was the service name?

Defender didn't pick up on the malware in the first place, it was a manual scan from the user.

Since we're looking for services, we can check the services.evtx file:

2026-03-04 17:20:21.9934181,C:\Windows\System32\winevt\logs\System.evtx,<SNIP>

EventID 7045 is "A service was installed in the system", we can filter for that (grep is easier since the EventID has a qualifier it's a mess):

              evtx_dump System.evtx -o jsonl | grep 7045 | jq .Event.EventData.ImagePath
# <SNIP>
# "C:\\WINDOWS\\system32\\dllhost.exe /Processid:{858F0962-5A53-4B4A-968C-89830DD455AC}"
# "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{71C8F664-6121-42DB-BACB-B9FB403C94CA}\\MpKslDrv.sys"
# "\"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26010.5-0\\MpDefenderCoreService.exe\""
# "system32\\drivers\\wd\\KslD.sys"
# "\"C:\\Program Files (x86)\\CentraStage\\CagService.exe\""

            

That last one is weird let's check it out:

              evtx_dump System.evtx -o jsonl | grep CagService.exe | jq '{ TimeCreated: .Event.System.TimeCreated, EventData: .Event.EventData }'
# {
#   "TimeCreated": {
#     "#attributes": {
#       "SystemTime": "2026-03-04T16:44:45.514466Z"
#     }
#   },
#   "EventData": {
#     "ServiceName": "CentraStage",
#     "ImagePath": "\"C:\\Program Files (x86)\\CentraStage\\CagService.exe\"",
#     "ServiceType": "user mode service",
#     "StartType": "auto start",
#     "AccountName": "LocalSystem"
#   }
# }

            

Since the user first started the malware, then did the scan at 16:48, it makes sense that the service was installed at 16:44

The service name is CentraStage

The malicious backdoor installation time stomped the RMM executables. What was the modified timestamp set to these executables?

"Time stomping" is a technique where the timestamp is changed to hide a file, it can randomly set a date, copy the date of another process.

Looking around the Amcache dump we find this:

              c:\program files (x86)\centrastage\putty.exe  LastWrite: 2026-03-04 17:12:59Z
Hash:

c:\program files (x86)\centrastage\uninst.exe  LastWrite: 2026-03-04 17:12:59Z
Hash:

c:\program files (x86)\centrastage\cagservice.exe  LastWrite: 2026-03-04 17:15:08Z
Hash: d4e71d00d95dede191e1347dd4bf284908705cd2

c:\program files (x86)\centrastage\csexec.service.exe  LastWrite: 2026-03-04 17:12:59Z
Hash:

c:\program files (x86)\centrastage\gui.exe  LastWrite: 2026-03-04 17:12:59Z
Hash:

            

All CagService files are the same timestamp except for the malicious one. Though LastWrite is not the modified timestamp, for that we need to cross reference this file, I looked in Amcache and the CopyLog for any other information, but we don't have anything and the file was already deleted when KAPE ran, looking at the filesystem I see that we have /C/$MFT which is the Master File Table from the filesystem, this could contain extra information about files that were deleted.

We can use analyzeMFT to parse it:

              analyzeMFT -f MFT -o MFT.csv --csv
# <SNIP>
# 2026-05-04 12:22:23 - analyzeMFT.cli - WARNING - Analysis complete. Results written to /workspace/Fruitzy/MFT.csv

head -n 1 MFT.csv
# Record Number,Record Status,Record Type,File Type,Sequence Number,Parent Record Number,Parent Record Sequence Number,Filename,Filepath,SI Creation Time,SI Modification Time,SI Access Time,SI Entry Time,FN Creation Time,FN Modification Time,FN Access Time,FN Entry Time,Object ID,Birth Volume ID,Birth Object ID,Birth Domain ID,Has Standard Information,Has Attribute List,Has File Name,Has Volume Name,Has Volume Information,Has Data,Has Index Root,Has Index Allocation,Has Bitmap,Has Reparse Point,Has EA Information,Has EA,Has Logged Utility Stream,Attribute List Details,Security Descriptor,Volume Name,Volume Information,Data Attribute,Index Root,Index Allocation,Bitmap,Reparse Point,EA Information,EA,Logged Utility Stream,MD5,SHA256,SHA512,CRC32

            

There's a lot here, what we care about is, Filename, SI Modification Time (this is the time stomped timestamp), and FN Modification Time (this is the original timestamp).

              head -n 1 MFT.csv | cut -d ',' -f8,11,15
# Filename,SI Modification Time,FN Modification Time

grep -ia "cagservice.exe" MFT.csv | cut -d ',' -f8,9,11,15
# CAGSERVICE.EXE-98A61B5F.pf,2026-03-04T16:44:55.693Z,2026-03-04T17:20:12.753Z
# CagService.exe,2026-02-09T07:56:40.000Z,2026-03-04T16:44:34.019Z
# CagService.exe.config,2026-03-04T16:44:44.448Z,2026-03-04T16:44:34.021Z
# CagService.exe_Url_nin2uaxj2lsg1o0rsz2amvmcciusvum4,2026-03-04T16:44:51.465Z,2026-03-04T16:44:51.465Z
# CAGSERVICE.EXE-98A61B5F.pf,2026-03-04T16:44:55.693Z,2026-03-04T16:44:55.693Z

            

Ok, we see the second result CagService.exe has a original time of 16:44:34, which matches with what we saw earlier.

The time was stomped to 2026-02-09 07:56:40

What is the name of the company whose product is the RMM tool?

Looking online for CentraStage we find their documentation, which seem to be relate to a company called Datto.

Datto

Pivoting back to the malicious link, when was the domain registered?

My first thought was to check crt.sh, but it's down, I tried whois but it doesn't work for the digital TLD, I looked for some alternatives:

              curl -sL https://rdap.org/domain/pomi.digital | jq '.events'
[
  {
    "eventAction": "expiration",
    "eventDate": "2027-02-20T01:06:05.634Z"
  },
  {
    "eventAction": "registration",
    "eventDate": "2026-02-20T01:06:05.634Z"
  },
  {
    "eventAction": "last changed",
    "eventDate": "2026-02-25T01:06:48.535Z"
  },
  {
    "eventAction": "last update of RDAP database",
    "eventDate": "2026-05-04T11:01:48.376Z"
  }
]

            

The domain was registered on 2026-02-20

Utilizing threat intelligence sources, what is another name for the executable that was initially downloaded?

Looking again on VirusTotal (we can use either the SHA256 or SHA1), in the "Details" pane and below on the "Names" section we find:

5bxrx.exe

IoCs

Windows Artifacts

Files:

405481d3d5529445c546d4429b72c5827ebde840 - premium.exe
d4e71d00d95dede191e1347dd4bf284908705cd2 - CagService.exe

Services:

CentraStage (Datto RMM)

Domains

pomi.digital

MITRE ATT&CK

Initial Access: Phishing: Spearphishing Link (T1566.002)
Execution: User Execution: Malicious Link (T1204.001)
Defense Evasion: Indicator Removal: Timestomp (T1070.006)
Persistence: Create or Modify System Process: Windows Service (T1543.003)
Command and Control: Remote Access Tool: Remote Desktop Software (T1219.002)

← BACK