================================================================================
SIMULATED FILESYSTEM TIMELINE -- FORENSIC TRAINING EXERCISE
Case: INTL-2025-0042 | Source: NTFS MFT parsed via The Sleuth Kit
Generated: mactime -b bodyfile.txt -d > timeline.csv
Image: disk.img (256 GB SSD) | SHA-256: b7d2e4f1a8c3...9e1a (simulated)
================================================================================

Format: Date,Size,Type,Mode,UID,GID,Meta,File Name
Type codes: m=modified, a=accessed, c=changed, b=born(created)

NOTE ON TIMESTOMPING: Several entries show "born" (b) timestamps AFTER "modified" (m)
timestamps. This is physically impossible under normal operation and indicates the
attacker used timestamp manipulation tools (e.g., timestomp) to backdate file creation.

Date,Size,Type,Mode,UID,GID,Meta,File Name
--- Normal baseline activity (July 14, 2025) ---
2025-07-14 08:15:02,0,macb,drwxrwxrwx,0,0,5,"C:/Windows/System32"
2025-07-14 08:15:31,4521984,macb,-rwxrwxrwx,0,0,187254,"C:/ProgramData/Microsoft/Windows Defender/Platform/4.18.25060.7/MsMpEng.exe"
2025-07-14 09:02:45,4774400,macb,-rwxrwxrwx,0,0,201338,"C:/Windows/explorer.exe"
2025-07-14 09:05:22,342016,...b,-rwxrwxrwx,0,0,203456,"C:/Windows/System32/Taskmgr.exe"
2025-07-14 09:12:01,2457600,macb,-rwxrwxrwx,0,0,210042,"C:/Program Files/Google/Chrome/Application/chrome.exe"
2025-07-14 14:22:10,45056,macb,-rw-rw-rw-,0,0,215678,"C:/Users/jdoe/Documents/Q3_Report.docx"
2025-07-14 16:45:33,12288,macb,-rw-rw-rw-,0,0,216890,"C:/Users/jdoe/Documents/meeting_notes.txt"

--- Compromise begins (July 15, 2025 ~02:45 UTC) ---
2025-07-15 02:45:18,847,macb,-rw-rw-rw-,0,0,220101,"C:/Users/jdoe/AppData/Local/Temp/update_check.hta"
2025-07-15 02:46:55,0,...b,drwxrwxrwx,0,0,220150,"C:/Users/jdoe/AppData/Local/Temp/tmpA3F2"
2025-07-15 02:47:02,73216,macb,-rwxrwxrwx,0,0,220155,"C:/Users/jdoe/AppData/Local/Temp/tmpA3F2/stager.ps1"
2025-07-15 02:47:33,452608,.a..,drwxrwxrwx,0,0,78442,"C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe"

--- Attacker drops tools to %TEMP% ---
2025-07-15 02:49:44,98304,macb,-rwxrwxrwx,0,0,220201,"C:/Windows/Temp/svc_update.exe"
2025-07-15 02:49:45,335872,macb,-rwxrwxrwx,0,0,220202,"C:/Windows/Temp/beacon.dll"
2025-07-15 02:49:46,163840,macb,-rwxrwxrwx,0,0,220203,"C:/Windows/Temp/inject_helper.dll"
2025-07-15 02:49:47,245760,macb,-rwxrwxrwx,0,0,220204,"C:/Windows/Temp/update.dll"

--- TIMESTOMPED files: creation time set to June 2025, but MFT $SI modified in July ---
--- Born (b) = 2025-06-01 but Modified (m) = 2025-07-15 -- IMPOSSIBLE without tampering ---
2025-06-01 12:00:00,98304,...b,-rwxrwxrwx,0,0,220201,"C:/Windows/Temp/svc_update.exe"
2025-06-01 12:00:00,335872,...b,-rwxrwxrwx,0,0,220202,"C:/Windows/Temp/beacon.dll"
2025-06-01 12:00:00,163840,...b,-rwxrwxrwx,0,0,220203,"C:/Windows/Temp/inject_helper.dll"
2025-06-01 12:00:00,245760,...b,-rwxrwxrwx,0,0,220204,"C:/Windows/Temp/update.dll"
--- MFT $FILENAME timestamps (cannot be easily timestomped) confirm July 15 creation ---
--- $FN Created: 2025-07-15 02:49:44 vs $SI Created: 2025-06-01 12:00:00 = TIMESTOMPING ---

--- Reconnaissance output saved ---
2025-07-15 02:48:22,4096,macb,-rw-rw-rw-,0,0,220210,"C:/Windows/Temp/recon_output.txt"
2025-07-15 02:48:45,8192,macb,-rw-rw-rw-,0,0,220211,"C:/Windows/Temp/domain_admins.txt"
2025-07-15 02:49:01,2048,macb,-rw-rw-rw-,0,0,220212,"C:/Windows/Temp/trust_info.txt"

--- Persistence: scheduled task created ---
2025-07-15 02:51:30,2048,macb,-rw-rw-rw-,0,0,220250,"C:/Windows/System32/Tasks/Microsoft/Windows/Maintenance/SystemHealthCheck"
2025-07-15 02:51:30,0,m.c.,-rw-rw-rw-,0,0,44210,"C:/Windows/System32/Tasks"

--- Persistence: new service binary registered ---
2025-07-15 02:51:44,98304,.a..,-rwxrwxrwx,0,0,220201,"C:/Windows/Temp/svc_update.exe"

--- Modified system binary (DLL search order hijacking) ---
2025-07-15 03:05:17,245760,m.c.,-rwxrwxrwx,0,0,220300,"C:/Windows/System32/wbem/wmiutils.dll"
--- Original wmiutils.dll hash: sha256:8a4f2b... | Modified hash: sha256:c3e9d1... ---
--- File size changed from 221,184 to 245,760 bytes -- MODIFIED SYSTEM BINARY ---

--- Certutil download activity ---
2025-07-15 03:22:08,524288,macb,-rw-rw-rw-,0,0,220350,"C:/Windows/Temp/payload.b64"
2025-07-15 03:22:15,393216,macb,-rwxrwxrwx,0,0,220351,"C:/Windows/Temp/payload.exe"
2025-07-15 03:22:20,524288,macb,-rw-rw-rw-,0,0,220352,"C:/Users/jdoe/AppData/LocalLow/Microsoft/CryptnetUrlCache/Content/E0F4A72B..."

--- Web shell planted on IIS server ---
2025-07-15 03:30:44,0,...b,drwxrwxrwx,0,0,220400,"C:/inetpub/wwwroot/aspnet_client/system_web/4_0_30319"
2025-07-15 03:30:45,15360,macb,-rw-rw-rw-,0,0,220401,"C:/inetpub/wwwroot/aspnet_client/system_web/4_0_30319/error_handler.aspx"
--- NOTE: .aspx file in a directory that should only contain static client-side files ---
--- Content includes: eval(Request["cmd"]) -- CLASSIC WEB SHELL ---

--- Second web shell (backup) ---
2025-07-15 03:31:02,8192,macb,-rw-rw-rw-,0,0,220402,"C:/inetpub/wwwroot/images/logo_old.aspx"
--- NOTE: .aspx extension disguised with image-related name in images directory ---

--- Data staging for exfiltration ---
2025-07-15 03:45:10,0,...b,drwxrwxrwx,0,0,220450,"C:/Users/jdoe/AppData/Local/Temp/~DF8832"
2025-07-15 03:45:22,52428800,macb,-rw-rw-rw-,0,0,220451,"C:/Users/jdoe/AppData/Local/Temp/~DF8832/archive.zip"
2025-07-15 03:46:01,52428800,.a..,-rw-rw-rw-,0,0,220451,"C:/Users/jdoe/AppData/Local/Temp/~DF8832/archive.zip"

--- Cleanup attempt by attacker ---
2025-07-15 04:10:33,0,m.c.,-rw-rw-rw-,0,0,220210,"C:/Windows/Temp/recon_output.txt"
2025-07-15 04:10:33,0,m.c.,-rw-rw-rw-,0,0,220211,"C:/Windows/Temp/domain_admins.txt"
2025-07-15 04:10:33,0,m.c.,-rw-rw-rw-,0,0,220212,"C:/Windows/Temp/trust_info.txt"
--- NOTE: Files truncated to 0 bytes but not deleted -- metadata still intact ---

--- Prefetch evidence (execution artifacts) ---
2025-07-15 02:47:33,42768,macb,-rw-rw-rw-,0,0,230001,"C:/Windows/Prefetch/POWERSHELL.EXE-A]B1C2D3.pf"
2025-07-15 02:49:44,18420,macb,-rw-rw-rw-,0,0,230002,"C:/Windows/Prefetch/SVC_UPDATE.EXE-E4F5A6B7.pf"
2025-07-15 02:52:01,15678,macb,-rw-rw-rw-,0,0,230003,"C:/Windows/Prefetch/RUNDLL32.EXE-C8D9E0F1.pf"
2025-07-15 03:22:08,12456,macb,-rw-rw-rw-,0,0,230004,"C:/Windows/Prefetch/CERTUTIL.EXE-A2B3C4D5.pf"

--- Windows Registry hive modification ---
2025-07-15 02:51:40,16777216,m.c.,-rw-rw-rw-,0,0,1024,"C:/Windows/System32/config/SYSTEM"
2025-07-15 02:51:42,262144,m.c.,-rw-rw-rw-,0,0,1025,"C:/Windows/System32/config/SOFTWARE"
--- NOTE: Registry modifications at same time as service installation ---

================================================================================
END OF SIMULATED FILESYSTEM TIMELINE
================================================================================

KEY FORENSIC FINDINGS:
1. Initial access via .hta file at 02:45 UTC, triggering PowerShell stager
2. Attacker tools dropped to C:\Windows\Temp with timestomping (backdated to June 2025)
3. Timestomping detected by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps
4. Persistence via scheduled task "SystemHealthCheck" and new service
5. System binary modified: wmiutils.dll (DLL search order hijacking)
6. Two web shells planted in IIS wwwroot directory
7. Data staged in temp directory (~50 MB archive.zip)
8. Partial cleanup attempted -- recon files truncated but not securely deleted
9. Prefetch files confirm execution of attacker tools
