The Miner That Mined the Victim

The brief

A user was desperate to find quick ways to earn money online. After browsing for free earning tricks, crypto mining tools, and cracked software, they found a Telegraph page advertising "CoinBoost Pro v3.2 - Free Mining Optimizer". You have been given a triage-style C drive artifact collection from the victim machine. Reconstruct the attack chain and understand what actually happened in there.

• the-miner-that-mined-the-victim.zip, 409 MB

In short

A free mining optimizer turned out to be ransomware. The lab rebuilt the attack from a Windows triage, browser history, prefetch, Sysmon and NTFS metadata, and answered all 14 questions of the live service in one connection.

A free miner that was not

The victim ran CoinBoost Pro, a free mining optimizer from LimeWire. It was ransomware on .NET 9, and its own debug log gave the first answer. The service asks 14 questions in order. Three wrong in a row wipe the run.

First, the machine's clock

The SYSTEM hive stores Pacific time, a bias of 480 minutes and a daylight bias of -60. ActiveTimeBias reads 420, so the machine ran on UTC-7 during the attack. Every later answer is in UTC.

From download to first run

Edge history gives the LimeWire link with its fragment and the redirect ID. The download finished at 14:25:36 UTC. The prefetch file, compressed with XPRESS Huffman, shows miner.exe first ran at 14:26:55, once.

Defender off, then encryption

Sysmon shows miner.exe load the .NET cryptography library at 14:26:58 and set DisableAntiSpyware to 1 in the same second. The first .vibed file followed at 14:26:59. In ATT&CK v19 that tampering is T1685.

What the encryption never touched

Small files live inside their MFT record, and the record outlives the file. One named by hash still held the 35 bytes of bar.txt. A Recycle Bin $I record gave the deleted folder, 179,623 bytes, gone at 14:27:47.

Fourteen of fourteen, one connection

The last answer was a shred pattern, 0x706c6568, which spells help as little endian bytes. All 14 answers went through one connection and each was accepted. The service printed the flag 31 minutes in.

The insight

The ransomware encrypted the files but not the file system. NTFS kept small files, deletions and their times in metadata it never touched.

The flag

hiCTF{c4r3ful_4b0ut_cr4ck3d_t001s_e4466a87e3}