Day-O — Investigation Challenge
A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.
Disclaimer: This blog post is based on a B2C2B 2026 Oct CTF hosted on TryHackMe and it is intended for educational purposes only.
A document review session took an unexpected turn. Examine a Windows memory capture to reconstruct what ran, trace the suspicious activity, and recover what was left behind.
01 // MISSION
Sophia Reyes opened a document review package. The preview froze, and an unexpected executable region appeared in the application’s memory.
With the workstation’s memory preserved, follow the evidence, uncover the hidden payload, and determine what it was prepared to do.
EVIDENCE PROVIDED
+ Memory Dump
02 // OBJECTIVES
01. Identify the suspicious process and its associated activity.
02. Examine the memory artifacts for evidence of malicious execution.
03. Investigate the malware and determine how it operates.
04. Recover the information needed to understand the compromise.
ANALYST NOTE
A process name tells only part of the story. Compare what was running with what its memory contains, and use the recovered artifacts to support your conclusions.
ANALYST WORKSPACE
+ Evidence: ~/Desktop/artifacts/
+ Tools: ~/Desktop/artifacts/tools/
+ Volatility 3 (vol), Ghidra and Speakeasy are installed for offline analysis.
+ Use the provided analysis-python environment for the bundled Python modules.
💪 Difficulty: Medium
Which executable contains the suspicious payload?
What is the starting virtual address of its private executable memory region?
Which file associated with the process also contains the same payload?
Which MITRE ATT&CK sub-technique best describes how the payload is stored in the recovered PNG file?
Get Jose Praveen’s stories in your inbox
Join Medium for free to get updates from this writer.
T1027.009 https://attack.mitre.org/techniques/T1027/009/
Which Windows API does the payload call to launch its next stage?
What encryption key does the decoded stage use to decrypt the document cache?
What is the flag?
Step 1: Extract the file from memory
vol -f ~/Desktop/artifacts/memory.mem windows.dumpfiles — virtaddr 0xbd8fdbca6650
Step 2: Extract the IV and Ciphertext explicitly
# 1. Grab the 16-byte hex IV directly from the DataSectionObject file
xxd -p -l 16 file.0xbd8fdbca6650.0xbd8fdc40ce10.DataSectionObject.review-cache.dat.dat | tr -d ‘\n’ > iv.txt
# 2. Extract the ciphertext skipping the first 16 bytes
dd if=file.0xbd8fdbca6650.0xbd8fdc40ce10.DataSectionObject.review-cache.dat.dat of=ciphertext.bin bs=1 skip=16
Step 3: Decrypt using OpenSSL
openssl enc -d -aes-256-cbc -in ciphertext.bin -out review-cache.zip -K <previous question answer> -iv $(cat iv.txt)
OpenSSL decrypts the ciphertext using the provided 256-bit AES key and extracted IV, writing the result to review-cache.zip.
Finally, verify the output:
unzip -t review-cache.zip
