Maromalix Corporation — Incident Investigation Lab

Technical Walkthrough

On the morning of March 22, 2026, Maromalix Corporation became the victim of a targeted ransomware attack. Prior to the incident, the company's public-facing website was silently compromised by a threat actor. The attacker modified a single page on the site to display a convincing browser error message, instructing any visitor to run a short command on their machine to "fix" the issue — and one employee did exactly that.

Your objective is to trace the attacker's full activity across the environment, from that first command all the way to ransomware deployment.

Before You Begin

This walkthrough covers every question in the lab in order. The primary investigation tool is Elastic (ELK Stack), supplemented by offline forensic artifact analysis using Timeline Explorer, MFTECmd, RegRipper, DB Browser for SQLite, CyberChef, 1768.py, and DNSpy.

The following data sources are indexed in ELK and available for investigation:

• winlogbeat-* — Windows event logs forwarded from all machines in the domain, including Sysmon events. This is the primary index used throughout the lab.
• packetbeat-* — Network flow data capturing connections between machines. Useful for correlating lateral movement and C2 communication patterns.
• filebeat-* — Log files collected from various sources on the machines, including application logs.

A general note on hunting approach: when you are unsure where to start for any question, the most reliable pivot point is always Sysmon Event ID 1 (process creation). It captures the full command line, the executable path, the original file name, the parent process, and all associated IDs — making it the backbone of most questions in this lab.

Initial Access

Q1 — The attack chain begins with a single employee visiting the company compromised page. Who was it, and when did that visit occur?

We should start by hunting for unusual activity that would …