Operation Tinsel Trace I — IR Report

On November 27, 2023, the threat actor initiated contact with Elfin from the address definitelynotthegrinch@gmail[.]com, posing as "Wendy Elflower" and fabricating a shared familiarity: a classic pretexting technique to establish trust early in the social engineering chain.

Over the course of two days, the threat actor methodically cultivated the relationship, steering the conversation toward Elfin's workplace grievances. This allowed Elfin to voluntarily disclose that he held access to confidential Secret Santa project assets.

Exploiting Elfin's accumulated workplace resentment, the threat actor successfully convinced him to act against his employer's interests.

At 17:01:29 UTC, MFT and USN Journal records from DESKTOP-D32FKTI confirm that Elfin compressed santa_deliveries into santa_deliveries.zip. At 17:01:46 UTC, the archive was transmitted to the threat actor via the em client.

Static analysis of the santa_deliveries binary revealed a hardcoded credential for the elf-admin account. Upon successful authentication, the binary retrieves santa-list.csv from the AWS S3 bucket at https://papa-noel.s3.eu-west-3.amazonaws.com/santa-list.csv.

Following the exfiltration, Chrome browser history recovered from DESKTOP-D32FKTI shows Elfin conducting searches related to circumventing corporate security controls, concealing insider activity, email deletion, and flights to Greece, indicating a clear attempt to cover his tracks and flee.

On November 29, 2023, at 08:24:07 UTC, AWS CloudTrail logs recorded an automated bulk retrieval from 191[.]101[.]31[.]57 targeting the publicly accessible papa-noel S3 bucket. The operation completed within nine seconds at 08:24:16 UTC.

Among the files retrieved from papa-noel was NPoleScripts/claus.py, which contained hardcoded AWS access and secret keys belonging to the elfadmin account, along with a direct reference to the private S3 bucket north-pole-private.

At 10:15:02 UTC, the threat actor began probing the north-pole-private bucket using HeadBucket and GetBucketAcl API calls. At 10:15:28 UTC, the same elfadmin access key was used to successfully execute a ListObjects call against the bucket, confirming partial access.

At 10:16:30 UTC, activity shifted to a second IP address, 45[.]133[.]193[.]41, from which the threat actor retrieved bytesparkle.ovpn at 10:16:53 UTC. The AWS CLI user-agent string captured (aws-cli/2.12.0 Python/3.11.5 Linux/6.1.0-kali9-amd64) is consistent with a Kali Linux host.

The bytesparkle.ovpn OpenVPN configuration file provided the threat actor with authenticated credentials and routing configuration to establish a VPN tunnel directly into the North Pole internal network. This exfiltrated configuration is assessed to be the primary access vector enabling all subsequent on-premises activity.

With authenticated VPN access established, the threat actor pivoted from cloud-based operations to on-premises targets. On November 30, 2023, at 16:42:21 UTC, memory forensics of santaclaus.bin show the Santa Claus account on TINKERTECH-WKS001 accessing the \\SANTA-FS\ImportantFiles network share and copying present_for_santa.zip to the user's Desktop.

At 16:42:28 UTC, the archive was extracted to a present_for_santa folder on the Desktop. The archive contained two malicious files: present.vbs, a heavily obfuscated VBScript dropper, and click_for_present.lnk, a weaponized shortcut designed to trigger the infection chain.

click_for_present.lnk when executed spawned a PowerShell command that recursively searched C:\Users\ for any file matching present*.vbs and invoked it via cscript, executing present.vbs without requiring user awareness of the underlying payload.

The VBScript payload downloaded a shellcode loader (present.exe) from the C2 server at 77[.]74[.]198[.]52 via hxxp[://]77.74.198.52/destroy_christmas/evil_present.jpg, dropping it into the executing user's temp directory before launching it to establish a reverse shell back to the C2.

MFT records corroborate that present.exe was written to disk at 16:42:40 UTC and executed one second later. The shellcode loader retrieved a second-stage shellcode from the C2 on port 445 and injected it into the svchost.exe process (PID 724).

At approximately 16:42:59 UTC, the threat actor executed a PowerShell command to clear all Windows event logs on TINKERTECH-WKS001.

At 16:43:04 UTC, the threat actor attempted to disable Windows Defender via PowerShell, but the command failed due to a syntax error. At 16:43:12 UTC, the threat actor added C:\Users\Public to the Windows Defender exclusion path instead.

At 16:43:18 UTC, Sysinternals ProcDump was transferred onto the host as C:\Users\Public\PresentForNaughtyChild.exe. At 16:43:27 UTC, it was invoked to dump the LSASS process memory to C:\Users\Public\stolen_gift.dmp.

On December 8, 2023, at 12:01:39 UTC, the threat actor conducted a port scan against the NorthPole HP LaserJet 4200n printer (192.168.68.128). The scan revealed TCP 22 (SSH) and TCP 9100 (PJL interface entry point).

At 12:02:14 UTC, the threat actor established a connection to the printer on port 9100, initiating a PJL session.

At 12:03:07 UTC, the threat actor issued a PJL FSUPLOAD command to read 0:/christmas/2023/Nice-kids/list1.txt directly from the printer's internal filesystem, containing full names of children flagged as "Nice."

At 12:03:21 UTC, the threat actor followed up with a second FSUPLOAD request for 0:/christmas/2023/Naughty-kids/list.txt.

At 12:04:18 UTC, the threat actor identified and read 0:/saveDevice/SavedJobs/InProgress/Layoff-notice/Personal-Notice-Employee43.pcl, revealing a termination notice for Elfin.

At 12:08:14 UTC, the threat actor identified the PostScript scheduled print job Announcment-25Dec.ps and retrieved its contents via FSUPLOAD at 12:08:18 UTC.

At 12:09:12 UTC, the threat actor discovered an SSH backup private key at 0:/Administration/securitykeys/ssh_systems/id_rsa and retrieved its contents at 12:09:27 UTC. An attempt to delete the key at 12:18:14 UTC failed.

Building on the credential material harvested from the LSASS dump and internal network persistence from prior phases, the threat actor executed the most destructive stage on December 13, 2023.

At 09:24:21 UTC, the threat actor, operating from internal IP 192.168.68.200, exploited CVE-2020-1472 (ZeroLogon) against DC01.northpole.local, successfully resetting the DC$ machine account password at 09:24:23 UTC.

As part of the exploitation chain, a malicious service named vulnerable_to_zerologon was installed on the domain controller, backed by the binary hAvbdksT.exe.

At 09:27:36 UTC, leveraging the local Administrator account now accessible via the domain controller, the threat actor reset the password of the Bytesparkle domain account, repurposing it as a controlled credential.

At approximately 10:03 UTC, the threat actor established an RDP session to DC01.northpole.local using the newly controlled Bytesparkle account.

At 10:47 UTC, two suspicious files (a masqueraded svchost.exe and an accompanying vnc2.dll) were dropped into C:\Users\bytesparkle\Downloads\svc. Execution at 10:53:21 UTC established a VNC-based remote access channel.

At 10:57:38 UTC, the threat actor created a scheduled task named svc_vnc, establishing a persistence mechanism that would survive a reboot.

At 11:00:16 UTC, the threat actor dropped the ransomware payload splunk_svc.dll into C:\tmp. Execution followed at 11:03:20 UTC, deploying a ransom note to C:\Users\bytesparkle\Desktop\README.txt and beginning file encryption. All encrypted files had their extensions replaced with .xmax. The encryption process completed at 11:07:28 UTC.

Static analysis of splunk_svc.dll (executed at 11:03:20 UTC) reveals a self-contained recursive encryption routine consistent with the observed .xmax extension renaming and ransom note deployment.

The binary implements a depth-first directory walker using FindNextFileW, iterating through the filesystem and checking each discovered file against a hardcoded list of 69 targeted extensions. The target list covers documents, source code, email stores, virtual machine disk images, databases, and archives.

For each matching file, the routine encrypts content byte-by-byte using a repeating 16-byte XOR cipher. The key (EncryptingC4Fun!) cycles across a 16-byte window. This encryption scheme is cryptographically trivial: XOR is symmetric, so the same operation restores plaintext, and the short repeating key is fully recoverable via known-plaintext attack.

The hardcoded ransom note demands 5,000,000 XMAS tokens to wallet GR1NCH-5ANTA-2023XMAS and is signed "The Grinch." The note is deployed to the current user's Desktop after every encrypted file.