Skip to content

Chapter 9

Timeline and takeaways

It took the attacker about ninety minutes to get from a pasted command to SYSTEM on a second workstation. All times are UTC on 2026-10-29 unless noted.

Timeline

ClickFix

jen.walker pastes a PowerShell command into the Run dialog on WS02. It downloads a bundle from update-cache-m9tdco18phmc.com.

Loader

tar unpacks a portable Python. QuickConnectSupport.exe, really a signed pythonw.exe, imports code from DocumentResources.dat and starts QuickConnect.Service.exe, which calls 203.0.113.87:8888.

Discovery

The implant runs whoami /all, ipconfig /all and systeminfo.

Remote access

RustDesk, renamed QuickConnectSupport.exe, connects to the attacker's relay at 192.0.2.146.

Hands on keyboard

Over RustDesk, the attacker types cmd.exe /k whoami.exe & hostname.exe & ipconfig.exe /all into Run. An 84-minute relay session begins.

Staging

Two DLLs land in AppData\Roaming\Greenshot\.

Persistence

reg add sets HKCU\...\Run\Greenshot.

Greenshot takes over

Greenshot is relaunched, loads the attacker's DLL, and takes over the beacon to 203.0.113.87:8888.

Password spray

One password, Meridian2026!, against four accounts via net use \\WS03\IPC$. Three fail.

Valid account

svc.wksdeploy logs on to WS03.

Lateral movement

PAExec copies the implant over ADMIN$ and installs service PAExec-6740-WS02 on WS03.

Second foothold

The implant runs on WS03 as SYSTEM and calls home.

Persistence holds

Greenshot on WS02 beacons until 13:22. svc.wksdeploy is used against WS03 again at 01:28 and 11:08.

Indicators

Don't contact these indicators

The domains are made up and the IPs are from documentation ranges. They're here for detection practice only.

Type Indicator Role
Domain update-cache-m9tdco18phmc.com Download and C2
Domain support-assist-7wfncs.online RustDesk relay server
IP 203.0.113.87 C2 on TCP 8888; download on 443
IP 192.0.2.146 RustDesk relay on TCP 21115 to 21117
File %TEMP%\QuickConnect\QuickConnectSupport.exe Renamed pythonw.exe (loader)
File %TEMP%\QuickConnect\DocumentResources.dat Python code in a zip
File %TEMP%\QuickConnect\python312._pth Likely points Python at the sidecar
File QuickConnect.Service.exe Implant (%TEMP%\QuickConnect\ on WS02, C:\Windows\ on WS03)
File %LOCALAPPDATA%\Programs\QuickConnect Support\QuickConnectSupport.exe Renamed RustDesk
File %APPDATA%\Greenshot\Greenshot.Plugin.QuickConnect.dll, QuickConnect.ImageCache.dll Persistence plugins
Registry HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Greenshot Logon persistence
Service PAExec-6740-WS02 Remote execution on WS03
Account MERIDIAN\svc.wksdeploy Compromised by password spray

What would have caught it sooner

Each of these is a baseline or a simple rule you can build with the data in this lab.

  • Run dialog history. A RunMRU value containing powershell, iwr, curl or -w h is almost never legitimate. One rule on Sysmon event 13 catches ClickFix at the first step.
  • Name versus original file name. A signed binary whose name on disk differs from its original file name, running from a user-writable path. This catches the loader and the renamed RustDesk.
  • First seen remote tools. Keyed on original file name, per host. When there's one sanctioned tool, any other one is worth a look.
  • Programs doing new things. Greenshot doesn't run discovery tools or talk to port 8888 on any other host. pgr() scores each action by how rare it is on other hosts.
  • Workstation to workstation. SMB from one workstation to another's ADMIN$, and a new service from a remote logon, are rare in most networks.
  • Spray shape. Several accounts failing from the same source in under a minute, followed by one success.

Keep going