{"id":2026,"date":"2026-07-20T14:02:01","date_gmt":"2026-07-20T18:02:01","guid":{"rendered":"https:\/\/www.peteonsoftware.com\/?p=2026"},"modified":"2026-07-20T14:02:01","modified_gmt":"2026-07-20T18:02:01","slug":"hack-the-box-walkthrough-romcom","status":"publish","type":"post","link":"https:\/\/www.peteonsoftware.com\/index.php\/2026\/07\/20\/hack-the-box-walkthrough-romcom\/","title":{"rendered":"Hack the Box Walkthrough: RomCom"},"content":{"rendered":"

\"HTBThis time, we’re going to tackle a Sherlock from Hack the Box called RomCom<\/a>. To get started, download the zip, extract it with the password hacktheblue<\/em>, and let’s get ready to work. Our scenario is<\/p>\n

Susan works at the Research Lab in Forela International Hospital. A Microsoft Defender alert was received from her computer, and she also mentioned that while extracting a document from the received file, she received tons of errors, but the document opened just fine. According to the latest threat intel feeds, WinRAR is being exploited in the wild to gain initial access into networks, and WinRAR is one of the Software programs the staff uses. You are a threat intelligence analyst with some background in DFIR. You have been provided a lightweight triage image to kick off the investigation while the SOC team sweeps the environment to find other attack indicators.<\/em><\/p>\n

Inside the zip is a disk image named 2025-09-02T083211_pathology_department_incidentalert.vhdx<\/em>. If we treat this like a real investigation, we need to always make sure that the file is read only. When I mount it in Windows, I can click through and see “stuff”.<\/p>\n

\"Mounting<\/p>\n

Let’s see what we have to do.<\/p>\n

Task 1 Question: What is the CVE assigned to the WinRAR vulnerability exploited by the RomCom threat group in 2025?<\/strong><\/p>\n

So this one is just a Google problem. I searched romcom winrar vulnerability<\/em> and the second link pointed me here<\/a>, which gave the answer.<\/p>\n

Task 1 Answer: CVE-2025-8088<\/strong><\/em><\/p>\n

Task 2 Question: What is the nature of this vulnerability?<\/strong><\/p>\n

Read the link and it is right there at the start.<\/p>\n

Task 2 Answer: path traversal<\/strong><\/em><\/p>\n

Task 3 Question: What is the name of the archive file under Susan’s documents folder that exploits the vulnerability upon opening the archive file?<\/strong><\/p>\n

Here, I just want to dig in and look at the files. The Drive Label is “KAPE (2025-09-02T08:32:11)<\/em>” and inside the C<\/em> folder is an $MFT<\/em> file. We know we’re dealing with KAPE artifacts now, so we need help from hero of the community, Eric Zimmerman<\/a>. I was just going to use his suggestion and grab all tools so that I’m totally up to date. However, the download links are broken at the moment. I’m using a version from Chocolatey “choco install ericzimmermantools<\/em>“, but it isn’t 100% up-to-date. However, I think this will get us enough of the tools to do this easy HTB room.<\/p>\n

One of the tools that I got was called MFT Explorer<\/em>. This is a graphical version of his famed MFTECmd<\/em> tool. I used that to load up the image and here’s what I see.<\/p>\n

\"The<\/p>\n

I used the tool to navigate to c:\\users\\susan\\Documents and this is what I see, telling us the answer.<\/p>\n

\"Susan's<\/p>\n

Task 3 Answer: Pathology-Department-Research-Records.rar<\/strong><\/em><\/p>\n

Task 4 Question: When was the archive file created on the disk?<\/strong><\/p>\n

Look at the SI_Created On<\/em> column.<\/p>\n

Task 4 Answer: 2025-09-02 08:13:50<\/strong><\/em><\/p>\n

Task 5 Question: When was the archive file opened?<\/strong><\/p>\n

You can see this in SI_Record Changed<\/em> or in the Overview <\/em>tab when the file is selected under Record Modified On<\/em>.<\/p>\n

\r\nFlags: Archive, Max Version: 0x0, Flags 2: None, Class Id: 0x0, Owner Id: 0x0, Security Id: 0x9DD, Quota Charged: 0x0 \r\nUpdate Sequence #: 0x364A528\r\n\r\nCreated On:\t\t2025-09-02 08:13:50.5190826\r\nContent Modified On:\t2025-09-02 14:54:54.0000000\r\nRecord Modified On:\t2025-09-02 08:14:04.9807437\r\nLast Accessed On:\t2025-09-02 08:14:18.8730290\r\n<\/pre>\n
Task 5 Answer: 2025-09-02 08:14:04<\/strong><\/em><\/p>\n
Task 6 Question: What is the name of the decoy document extracted from the archive file, meant to appear legitimate and distract the user?<\/strong><\/p>\n
Using the 8:14:04 as a clue, we look in the Documents folder and see that a .pdf was created at 08:14:18 of the same day.  That’s our file.<\/p>\n
Task 6 Answer: Genotyping_Results_B57_Positive.pdf<\/strong><\/em><\/p>\n
Task 7 Question: What is the name and path of the actual backdoor executable dropped by the archive file?<\/strong><\/p>\n
We cheated a bit to get those last 2 answer.  That’s not the best way to go about that.  At this point, we need to not be lazy and do this correctly.  We need to parse the journal and to do that, we’re going to use the MFTECmd.exe<\/em> tool against the $J<\/em> file and also give it the location of where to save the csv and what to call it.<\/p>\n
\r\nPS > MFTECmd.exe -f 'd:\\C\\$Extend\\$J' --csv \"c:\\code\\\" --csvf \"Journal.csv\"\r\nMFTECmd version 2026.5.0\r\n\r\nAuthor: Eric Zimmerman (saericzimmerman@gmail.com)\r\nhttps:\/\/github.com\/EricZimmerman\/MFTECmd\r\n\r\nCommand line: -f d:\\C\\$Extend\\$J --csv c:\\code\\ --csvf Journal.csv\r\n\r\nFile type: UsnJournal\r\n\r\n\r\nProcessed d:\\C\\$Extend\\$J in 0.2817 seconds\r\n\r\nUsn entries found in d:\\C\\$Extend\\$J: 215,579\r\n        CSV output will be saved to c:\\code\\Journal.csv\r\n<\/pre>\n
Okay, now we’re going to use another tool to open that csv called TimelineExplorer.exe<\/em> that also gets installed when you get all of the Eric Zimmerman tools.<\/p>\n
\"Timeline<\/p>\n
I then added a filter for .exe<\/em> files and then sorted by “Update Timestamp<\/em>“.  If we scroll down to the 2025-09-02 08:14:04<\/em> timeframe, we find our problem child.<\/p>\n
\"The<\/p>\n
So we can see the name, but not where it is dropped.  We could look all around the MFT Explorer, but this is what I get for using GUI tools instead of going command line first.  The best way to do this is to parse the $MFT file into a .csv also and use Timeline Explorer to get the path.<\/p>\n
\r\nPS> MFTECmd.exe -f 'd:\\C\\$MFT' --csv \"c:\\code\\\" --csvf MFT.csv\r\nMFTECmd version 2026.5.0\r\n\r\nAuthor: Eric Zimmerman (saericzimmerman@gmail.com)\r\nhttps:\/\/github.com\/EricZimmerman\/MFTECmd\r\n\r\nCommand line: -f d:\\C\\$MFT --csv c:\\code\\ --csvf MFT.csv\r\n\r\nFile type: Mft\r\n\r\nProcessed d:\\C\\$MFT in 1.7880 seconds\r\n\r\nd:\\C\\$MFT: FILE records found: 139,533 (Free records: 0) File size: 136.5MB\r\n        CSV output will be saved to c:\\code\\MFT.csv\r\n<\/pre>\n
Okay, when we open that up and search for the file name, it comes right up.<\/p>\n
\"The<\/p>\n
Task 7 Answer: c:\\users\\susan\\AppData\\Local\\ApbxHelper.exe<\/strong><\/em><\/p>\n
Task 8 Question: The exploit also drops a file to facilitate the persistence and execution of the backdoor. What is the path and name of this file?<\/strong><\/p>\n
Persistence and execution usually means that something needs to run on startup.  So the first thing I’d check would be shortcuts in a startup path, next I’d check for services added.  But when I just do a find for startup<\/em> in Timeline Explorer in the MFT csv, I get 254 lines.  The first one that appears after the incident (and any time for the next several minutes) is a file called Display Settings.lnk<\/em>.<\/p>\n
Task 8 Answer: c:\\users\\susan\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Display Settings.lnk<\/strong><\/em><\/p>\n
Task 9 Question: What is the associated MITRE Technique ID discussed in the previous question?<\/strong><\/p>\n
I googled for mitre id for persistence via the startup folder<\/em> and that let me to T1547:Boot or Logon Autostart Execution<\/em>.  I guessed the wrong sub-technique, thinking that it would be .001: Registry Run Keys \/ Startup Folder<\/em>, but eventually figured that they wanted .009:Shortcut Modification<\/em>.<\/p>\n
Task 9 Answer: T1547.009<\/strong><\/em><\/p>\n
Task 10 Question: When was the decoy document opened by the end user, thinking it to be a legitimate document?<\/strong><\/p>\n
Within the MFT csv, search for the document name Genotyping_Results_B57_Positive.pdf<\/em>, you can see when it was opened and you can confirm it in the Journal.csv.<\/p>\n
Task 10 Answer: 2025-09-02 08:15:05<\/strong><\/em><\/p>\n
That’s it.  Maybe not the most efficient run-through, but we got it done.  Any questions or comments, please let me know.<\/p>\n
\"Sherlock<\/p>\n","protected":false},"excerpt":{"rendered":"
This time, we’re going to tackle a Sherlock from Hack the Box called RomCom. To get started, download the zip, extract it with the password hacktheblue, and let’s get ready to work. Our scenario is …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[153],"tags":[159,141,142],"class_list":["post-2026","post","type-post","status-publish","format-standard","hentry","category-capture-the-flag","tag-blue-team","tag-information-security","tag-infosec"],"_links":{"self":[{"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/posts\/2026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/comments?post=2026"}],"version-history":[{"count":0,"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/posts\/2026\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/media?parent=2026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/categories?post=2026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.peteonsoftware.com\/index.php\/wp-json\/wp\/v2\/tags?post=2026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}