As this was a downloadable OVA file, I figured I needed to import it into VirtualBox and spin-up the machine in order to start.
After logging in with the provided password I noticed a PowerShell window appearing for a short time (the description mentioned something about ‘blue windows’ popping up so this is interesting).
A quick look in the Task Manager revealed two suspicious processes with no name; however, when opening the file locations, I found a weird svchost.exe file in a non-standard location: **C:\ProgramData\windows\svchost.exe**
![](https://lh3.googleusercontent.com/keep-bbsk/AGk0z-OVb8Z5A_6Gq5mj9NXe1pK65eQRSoIo1S96qVfJXPh-QZyJIJqbATFKi2h0LcfFPC2KwIMFivwo34ULdJLraEkJbm3-6H9KTxP6sZo)
I quickly saved this file to my main machine for further analysis.
As I wanted to see what the PowerShell window from earlier was, I took a quick look at the Startup tab in Task Manager but there was nothing of interest.
I ran a Sysinternals Autoruns instance and I noticed a weird PowerShell-based Scheduled Task:
![](https://lh6.googleusercontent.com/olTUuo-LcxkdsqcU92Uao80V7wKkf2hNNXqPbH8x64aYX-23ZRIJfuGYSIOsmzCl22hfMEuF-GTnyQfIkY2ofpU0bA6HSCuelK1bsBUYz0HcWfKLXVWArpGzXDpCAJsnh2wMWdlu)
Analyzing this revealed that this Scheduled Task fetched a registry key’s value which was a base64-encoded obfuscated Powershell script then executed it.
![](https://lh3.googleusercontent.com/-moUX1wfx1RGSsfZR9D3PCjtNi0CFz7HA6jXbP9VMj2rYqz6Q70h2KX3XaGpmMRWvYlsSEFCrcwqjBp-ESB0Cc6r9vvZRdPvgvMd5W2q_12qe7foh4a5FgTyONKG7b_WuK35gv1L)
`powershell.exe -w hidden -ExecutionPolicy Bypass -nop -NoExit -C Write-host 'Windows update ready'; iex ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\1X90wOyH).Q4josQ44)));`
This explains the quick Powershell window I saw when the machine booted.
Decoding the base64 registry key revealed the following PS script which contains a part of the flag for this challenge:
![](https://lh4.googleusercontent.com/C5X6WN3VkkVwTIuo9JY6V-XGPiibESTbab3nKgns9Zgdyad6cVW4U-ebdUrwfGoEjsEQKvTg-eKc-0XQV6nb6nzOl-nd3h72cc-d_se0432RSBeAGXAXhR1Z2wujQPYmqZpWwb1r)
After a bit of cleaning-up I got to this:
![](https://lh4.googleusercontent.com/yjB0ANPFJ2fxck9ipL7hazVbSo5l-iS6voEBt3jq2msYIo9Yjla7Kz49Jfdp7Fo6EsdnegjGsOVqlXjOqTLPRk2d86Jh1XVoMlv90KaembuxS9Xqx35M9DZtPc2hjJEB_kIJixZZ)
So indeed the rest of the flag must be related to that svchost.exe file; the web request in the else branch seems to be just for misleading purposes.
Running a quick strings dump on the svchost.exe binary reveals that it’s a **pyinstaller-compiled .exe file**:
![](https://lh4.googleusercontent.com/s6puKyPsiRhhLXHBRkDhdiqSaF2wAO6JK1cr97Z5to-EtCP9toY22nzBJi6aL__kGx1SbO615Wqc0fNxoUWgo2Gb-ZyD8dWv72KCjlgaSNV7WJlM0xUVbDg7HD82ukKbdKOfIQG5)
So the next logical step was to try and extract the file using **pyinstextractor** (https://github.com/extremecoders-re/pyinstxtractor):
![](https://lh3.googleusercontent.com/9rIgDR2CuO59Y1GEicmWjf7ePO63zJApulI67wNKLsOH95cVgLn-eOMA2VkSV-iTr0d987rg7vvlqlculxurl31_Ba0_IE4jzsQPdGOTcMIe3BNm5Cb1gDNnGdRCQ0H2UhoPiYYm)
Indeed I got some .pyc & .pyd files so I continued with trying to decompile them with **uncompyle6** (https://pypi.org/project/uncompyle6/)
![](https://lh6.googleusercontent.com/PYorChmON1Y862vTQi0bp3I_j4K5JM1rtSzvfyuxyBQkwELtSgyOQiQOvQ5Bv6XTLf8LTD17CLfzCdV4w1fjLYledOozbwlDJCZF6w3RH9RlTzrW3nPt7G2BM0zjuQ8bLG_d7cnX)
Taking a look in **logger.py** reveals this svchost.exe file is actually a keylogger that encrypts the keyboard captured data with **AES in CFB mode, then base64-encodes** the cipher text and saves it to a file in the user’s APPDATA directory:
![](https://lh3.googleusercontent.com/xClXdwhOzMi0JknrLPXJ9Fvf1NxOth4xPaV-q-fUldzbM9cs9xTr8FOvdHWzmlbzimjDSP3fHnqDzVISz-gegNv5xIzYd_MJFJZy0dzqV1Ql0DlQcRocKmCpyvNPr-viwB8rvT27)
I saved the key and the initialization vector for the AES decryption and I fetched the **%APPDATA%\anVzdGFuW1l.txt** file which contained Python binary strings (the base64-encoded cipher text from before):
![](https://lh4.googleusercontent.com/rzaP2i7DZgbcw9FiDQGAg7JRvri2OmwUBvzNqcC6g2hItZL1vIpk2paxrnFzlrsh9K9Nig-v9cYtMG8LJ4BFPvmu6FqugUQUqaywuzned1wrEUutc9Jg5RVo8z84_tJxSec_71rq)
I cleaned the file a bit (removed the b’’ stuff) then I tried decrypting it in CyberChef, getting only garbage:
![](https://lh5.googleusercontent.com/Rjhs1yzJl465dakuOceahV7t6hPqpqoOn6yPlpTYpLX5gCyXZfLjUZ76nBBTJQ5Focs1KyMvu9Aflmn1AbcWhwWvkd7QagEYKDdEw5acqwvI-s-Z6w1GuXVPEssWNnOP_CynTbRM)
So I wrote a quick Python script to decrypt the file:
![](https://lh5.googleusercontent.com/-YgyrV-6kYrvT_nsk5VkPwMwOof2fKtidgBlb8jywotFx7oJqsRVFGJDkC_4-PO3alDVwKEwXfmVqLv2LwUAfm6p2jJnZtMdPbHPaZJciOdCSyVem1kpGgz0qeER7Cry4_v13_4G)
Which produced the following output:
![](https://lh3.googleusercontent.com/mMDkxtjGQ7KHlz6jBkwyj0TyLDbDfKU8MsZMpBLFubPVs4JgzMkJSYNWafhUZ3VP-jAvvAXp_ykaasW4C3lcL72E5urdLYZjCwz3QP9__9EldIiSbwH-yvRgZBEFTZtgvnQfRMk_)
After cleaning it a bit I could clearly see an email body:
![](https://lh6.googleusercontent.com/C5hNxNBblkE8fPss1gI_LleYHz-wsy7XzUhU-7GNHtb4FVZ-DJUvOyaRbdKTmdNB372pCW3v08RAAPmBiw14DCXvh8nkKlzIqhvmfYFeJ_-ckgTBNa4BSY0kla5zCsZ2v5qpr_dl)
As the first part of the flag was: **HTB{1_c4n_S33_3v3ryTh1ng_3v3n_y0uR_P1N_**
I figured the PIN from the email has to be the other part and indeed this was the final flag:
**HTB{1_c4n_S33_3v3ryTh1ng_3v3n_y0uR_P1N_50133700013}**