Pinned Loading

1. hackthebox-businessctf-2021-dfir-wri... hackthebox-businessctf-2021-dfir-writeup

   1

   As this was a downloadable OVA file, I figured I needed to import it into VirtualBox and spin-up the machine in order to start.

   2

   3

   After logging in with the provided password Noticed a PowerShell window appearing for a short time (the description mentioned something about ‘blue windows’ popping up so this is interesting).

   4

   5

   A quick look in the Task Manager revealed two suspicious processes with no name; however, when opening the file locations, we can find a weird svchost.exe file in a non-standard location: **C:\ProgramData\windows\svchost.exe**