AfterHours — TryHackMe Walkthrough

A suspicious payload buried inside a dump of Windows Group Policy Registry attribute names. How we identified raw DEFLATE compression, extracted the PE binary, and recovered the persistence backdoor flag.

---

Overview

The challenge presents a large registry text dump. Hidden among thousands of lines of normal policy settings is an anomalous base64-encoded string. We are tasked with extracting, decompressing, and analyzing this payload to recover the hidden backdoor flag.

---

Step 1 — Spotting the Anomaly

The dump is mostly noise: repeated Windows policy attribute names cycling in blocks, separated by long runs of UUUUUU.... Mixed in are some hex hashes (DE51E01CC9C7..., D731582B47CFA9BC...) and eventually — one very long base64 string that breaks the pattern entirely.

7VZPbFRFGP/edillgUrBAJWAjy0l5d/r0hYDpIWW7gLF/oMtxRAT...

This is our target payload.

---

Step 2 — Decoding the Base64

We extract and decode the Base64 string to a binary file:

echo "7VZPbFRFGP/..." | base64 -d > base.bin

The output is binary data with no obvious ASCII magic bytes. Let's inspect the first few bytes using xxd:

xxd base.bin | head -5

# Output:
# 00000000: ed56 4f6c 5445 18ff de76 2965 814a c100  .VOlTE...v)e.J..

The first byte is ed 56. This is not a standard PE header (MZ) or a zlib stream (78 9c). However, a high byte of 0xed is highly indicative of raw DEFLATE compression (RFC 1951) without the 2-byte zlib wrapper or Adler-32 checksum.

---

Step 3 — Decompressing (Raw DEFLATE)

We can write a short Python script using the zlib library. Passing -15 as the window bits parameter (wbits) instructs the library to decompress raw DEFLATE streams without looking for headers:

import zlib
data = open('base.bin','rb').read()
dec = zlib.decompress(data, -15)   # -15 = raw deflate, no zlib header
open('blob.exe','wb').write(dec)
print('Decompressed:', len(dec), 'bytes')

# Output:
# Decompressed: 4096 bytes

The script runs successfully, producing a 4096-byte Windows PE executable named blob.exe.

---

Step 4 — Extracting Strings from the PE

Since Windows PE files store resources and metadata in UTF-16 Little Endian format, running a regular ASCII strings check might miss key details. We can write a quick Python script to search for wide strings:

import re
data = open('blob.exe','rb').read()
hits = re.findall(b'(?:[\x20-\x7e]\x00){6,}', data)
for h in hits:
    print(h.decode('utf-16-le', errors='replace'))

Running this script prints the wide-character strings inside the PE resource area:

bytelotusdc
cmd.exe
/c net user patch VEhNe1A0dGNoX29wM25lZF90aDNfQmFjS2QwMHJ9 /add
Execution halted: Environment mismatch.
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
FileDescription
FileVersion
0.0.0.0
InternalName
updates.exe
LegalCopyright
OriginalFilename
updates.exe
ProductVersion
0.0.0.0
Assembly Version
0.0.0.0

---

Step 5 — Decoding the Flag

The password argument passed to the backdoor user creation script is a Base64-encoded string. We decode it to recover the cleartext flag:

echo "VEhNe1A0dGNoX29wM25lZF90aDNfQmFjS2QwMHJ9" | base64 -d

# Output:
# THM{P4tch_op3ned_th3_BacKd00r}

---

Attack Chain Summary

[Registry Policy String Dump]
        │
        │  Spot anomalous base64 string
        ▼
[Base64 Encoded Stream]
        │
        │  Identify raw DEFLATE header structure (0xed)
        ▼
[Compressed PE Executable]
        │
        │  Decompress using zlib (wbits = -15)
        ▼
[PE Executable (updates.exe)]
        │
        │  Scan UTF-16LE strings for payload
        ▼
[Backdoor User Password Decoded]
        │
        │  THM{P4tch_op3ned_th3_BacKd00r} 🚩

---

Key Takeaways / Remediation

Vulnerability / Vector	Mitigation / Remediation
Persistence Backdoor	Implement Endpoint Detection and Response (EDR) agents to flag unauthorized local account creations (e.g., net user).
Malware Evasion	Use behavior monitoring and heuristics. Attackers commonly compress and encode PE assets to bypass signature-based AV filters.