01 // Scenario
A production workstation (PROD-WORKSTATIO) has been compromised. The admin account was taken over by an attacker who used it to browse the local user steve's profile, search for sensitive files, access network shares, and stage data for exfiltration.
We are provided with KAPE-collected registry hives and asked to reconstruct the attacker's post-compromise activity using Shellbag artifacts - Windows Explorer's persistent record of folder navigation history.
02 // Evidence Overview
The KAPE collection (Baggage.zip, password: hacktheblue) contains registry hives from two user profiles and the system default:
Baggage/ ├── 2025-09-03T07_52_57_9138085_ConsoleLog.txt # KAPE execution log ├── 2025-09-03T07_52_57_9138085_CopyLog.csv # File copy manifest with hashes └── C/ ├── Users/ │ ├── admin/ │ │ ├── NTUSER.DAT (+LOG1, LOG2) # Admin's user registry hive │ │ └── AppData/Local/Microsoft/Windows/ │ │ └── UsrClass.dat (+LOG1, LOG2) # Admin's shellbag hive │ ├── steve/ │ │ ├── NTUSER.DAT (+LOG1, LOG2) # Steve's user registry hive │ │ └── AppData/Local/Microsoft/Windows/ │ │ └── UsrClass.dat (+LOG1, LOG2) # Steve's shellbag hive │ └── Default/ │ └── NTUSER.DAT (+LOG1, LOG2) └── Windows/System32/config/ └── DEFAULT (+LOG1, LOG2)
PROD-WORKSTATIO |
OS: Windows 10 (Build 22621) |
Collection time: 2025-09-03 07:52:57 UTC |
Target: RegistryHivesUser (18 files collected)
03 // Tools and Methodology
| Tool | Purpose |
|---|---|
| regipy (v6.3.0) | Python-based Windows registry parser with shellbag plugin support |
| regipy-plugins-run | CLI tool to run the usrclass_shellbag_plugin against UsrClass.dat hives |
| Python 3 | JSON processing and timeline correlation |
# Install regipy with full shellbag support pip install "regipy[full]" # The [full] extra installs libfwsi-python and libfwps-python # (required for proper shellbag item parsing) # Parse both UsrClass.dat hives regipy-plugins-run -o admin_shellbags.json /path/to/admin/UsrClass.dat regipy-plugins-run -o steve_shellbags.json /path/to/steve/UsrClass.dat
04 // Shellbag Fundamentals
Where are they stored?
| Hive | Registry Path | What It Records |
|---|---|---|
UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\BagMRU | Folder tree structure and navigation order |
UsrClass.dat | Local Settings\Software\Microsoft\Windows\Shell\Bags | View settings (icon size, sort order, column widths) |
NTUSER.DAT | Software\Microsoft\Windows\Shell\BagMRU | Desktop and special folder navigation |
Timestamp types
| Timestamp | Source | Meaning |
|---|---|---|
creation_time | File/folder metadata | When the folder was created on disk |
access_time | File/folder metadata | When the folder was last accessed on disk |
modification_time | File/folder metadata | When the folder was last modified on disk |
last_write | Registry key | When Windows Explorer wrote this shellbag entry - when the user navigated to this folder |
last_write is the most reliable indicator of when navigation actually occurred. The file-level timestamps (creation_time, access_time, modification_time) reflect the file system metadata at the time the shellbag was created, which may differ from when the attacker browsed to that location.
Shell types
| Type | Description |
|---|---|
Root Folder | Top-level namespace (My Computer, Network, etc.) |
Volume | Drive letter or special folder (Downloads, Documents) |
Directory | A regular folder |
Network Location | A UNC path (network share) |
Users Property View | A network computer in the Network Neighborhood |
05 // Analysis and Attack Timeline
Parsing both UsrClass.dat files produced 14 shellbag entries for the admin account and 30 entries for steve. The admin's shellbags show the attacker navigating from My Computer into C:\Users\steve. Steve's shellbags contain a richer set of entries because the attacker's navigation through steve's profile folders updated the shell namespace tracked in steve's own UsrClass.dat.
Attack timeline
The following timeline is reconstructed from the shellbag last_write timestamps:
Attacker navigates C:\ → C:\Users → C:\Users\steve
Documents\Engineers Tab (engineering documentation) →
Documents\OT Station 3 internal VPN (VPN configs for OT network) →
Documents\OnePassword MasterPass (password vault directory)
Attacker discovers and navigates to \\Prod-ns-2\prodshare on the network
Downloads 1.zip containing Everything-1.4.1.1028.x64.zip -
a legitimate filesystem search utility used to rapidly locate sensitive files
VPN folder re-accessed (likely copying configs) →
Network share prodshare\Construction 2027 browsed →
Dam Construction Engineer Plans.zip identified for exfiltration
Staging folder created at C:\Users\steve\Pictures\a (using Pictures to avoid detection) →
Folder compressed to a.zip (exfiltration archive ready)
Incident response team executes KAPE to collect registry hives - 18 minutes after the last attacker activity
06 // Attack Flow Diagram
+---------------------+
| Compromised Admin |
| Account |
+----------+----------+
|
+----------+----------+
| Navigate to steve's |
| profile (C:\Users\ |
| steve) |
+----------+----------+
|
+----------------+----------------+
| | |
+--------+-------+ +-----+----------+ +---+-------------------+
| Documents | | Downloads | | Network Share |
| | | | | |
| - Engineers Tab| | - 1.zip | | \\Prod-ns-2\prodshare |
| - VPN configs | | (Everything | | Construction 2027\ |
| - Passwords | | search) | | Dam Plans.zip |
| (OnePass) | | | | |
+-------+--------+ +------+---------+ +-----------+-----------+
| | |
+------------------+-----------------------+
|
+-----------+-----------+
| Staging Folder |
| C:\Users\steve\ |
| Pictures\a |
+-----------+-----------+
|
+-----------+-----------+
| Exfiltration Archive |
| Pictures\a.zip |
| (ready for exfil) |
+-----------------------+
07 // Task Solutions
How to find: Parse steve's UsrClass.dat with regipy-plugins-run. Look through the output for entries under My Computer\Downloads with a .zip extension. The entry My Computer\Downloads\1.zip appears with creation_time: 2025-09-03T07:25:48 and last_write: 2025-09-03T07:26:18, showing when the archive was downloaded and first opened.
Inside the downloaded archive, the shellbag tree shows:
Temp1_1.zip\1\Everything-1.4.1.1028.x64.zip
How to find: In the shellbag output, follow the temp extraction path created when Windows Explorer opens a zip file: AppData\Local\Temp\Temp1_1.zip\1\Everything-1.4.1.1028.x64.zip. The Temp1_ prefix is Windows' naming convention for zip contents browsed in Explorer. The tool name and version are in the filename. Strip the .x64 suffix per the answer format.
Everything is a legitimate Windows search utility that indexes the entire NTFS filesystem in seconds. Attackers commonly use it during post-exploitation to rapidly locate sensitive files without relying on the slower Windows Search.
Steve's shellbag entry for OT Station 3 internal VPN:
creation_time: 2025-09-03T07:10:58,
access_time: 2025-09-03T07:11:50,
last_write: 2025-09-03T07:31:05.
How to find: In steve's shellbag output, search for entries containing "VPN". The entry OT Station 3 internal VPN appears under My Computer\Documents. The key insight: use the last_write timestamp (when the shellbag registry key was updated), NOT access_time or creation_time. The last_write of 07:31:05 indicates the attacker re-visited the VPN folder later (likely to copy its contents). The earlier creation_time of 07:10:58 is when the folder was first discovered.
Shellbag entry at My Computer\Documents\OnePassword MasterPass:
creation_time: 2025-09-03T07:12:18,
last_write: 2025-09-03T07:31:05.
How to find: In steve's shellbag output, look at the subdirectories under My Computer\Documents. Three folders appear: Engineers Tab, OT Station 3 internal VPN, and OnePassword MasterPass. The name "OnePassword MasterPass" clearly indicates a password storage directory. The attacker accessed it at creation_time: 07:12:18.
Shellbag entry under Computers and Devices\Prod-ns-2:
shell_type: Network Location,
location_description: Microsoft Network,
last_write: 2025-09-03T07:32:23 (steve) / 07:23:52 (admin).
How to find: In the shellbag output, look for entries under the Computers and Devices root folder. This is where Windows stores network browsing history. The entry Prod-ns-2 (type: Users Property View) has a child entry \\Prod-ns-2\prodshare (type: Network Location, description: Microsoft Network). The UNC path is the full network share path.
The network share contained a folder named Construction 2027 at path
\\Prod-ns-2\prodshare\Construction 2027
(creation_time: 2025-09-03T07:00:26,
access_time: 2025-09-03T07:21:46).
How to find: Follow the network share path in the shellbag tree: Computers and Devices\Prod-ns-2\\\Prod-ns-2\prodshare\Construction 2027. The folder name Construction 2027 directly contains the year. This folder was the only subfolder accessed on the share.
When the attacker browsed the staging folder (a.zip), the shellbag tree shows:
Temp1_a.zip\a\Dam Construction Engineer Plans.zip
How to find: In steve's shellbag output, look for the temp extraction paths created when zip files are browsed in Explorer. The path AppData\Local\Temp\Temp1_a.zip\a\Dam Construction Engineer Plans.zip reveals the archive that was inside the staging folder a.zip. The Temp1_a.zip prefix tells you it was extracted from a.zip, and the archive name Dam Construction Engineer Plans.zip is the file from the network share. Original creation: 2024-02-16T12:35:02.
The Construction 2027 folder's shellbag last_write: 2025-09-03T07:34:04 records when the shellbag key was last updated - corresponding to when the attacker navigated into this folder on the network share to access the Dam Construction Engineer Plans.zip archive.
How to find: Look at the Construction 2027 folder entry in steve's shellbags (under the network share path). Use the last_write timestamp on this parent folder's shellbag key (07:34:04), NOT the archive file's own timestamps (2024-02-16 is when the archive was originally created in 2024, not when the attacker accessed it). The last_write records when the attacker navigated into this folder.
Shellbag entry at My Computer\Pictures\a:
creation_time: 2025-09-03T07:33:16,
last_write: 2025-09-03T07:34:30.
How to find: In steve's shellbag output, look for entries under My Computer\Pictures. The entry a (a single-letter folder name) stands out as suspicious. Its creation_time: 07:33:16 is late in the attack timeline (after the attacker already found sensitive files). The location in Pictures (rather than Documents or Desktop) is a basic OPSEC technique. The full Windows path is C:\Users\steve\Pictures\a.
Shellbag entry for My Computer\Pictures\a.zip:
creation_time: 2025-09-03T07:34:24,
access_time: 2025-09-03T07:34:26,
last_write: 2025-09-03T07:34:30.
How to find: In steve's shellbag output, look for a.zip under My Computer\Pictures (right next to the staging folder a). The answer uses the last_write timestamp (07:34:30), which records when the shellbag registry key was written - the moment Windows Explorer registered the new archive file. The creation_time (07:34:24) is when the file was created on disk, and access_time (07:34:26) is when it was first opened. The archive was ready for exfiltration 18 minutes before KAPE collection.
08 // Key Forensic Takeaways
last_write field records when the Windows Explorer shell wrote the registry key - this is the actual moment of user navigation. File-level timestamps (creation_time, access_time) embedded in the shellbag entry are copied from the file system at the time the entry was first created and may not reflect subsequent access.
AppData\Local\Temp\Temp1_<archivename>.zip\<contents>.
These shellbag entries reveal exactly what the attacker examined inside downloaded or network-share archives - even if the archive and temp files are later deleted.
\\Server\Share) appear under the Computers and Devices root folder in the shellbag tree. This provides evidence of which network servers the attacker discovered, which shares were accessed, which folders within shares were navigated, and when each navigation occurred.
UsrClass.dat records the attacker's top-level navigation (entering steve's profile). Steve's UsrClass.dat records the detailed folder-by-folder browsing within steve's namespace. Cross-referencing both provides the complete picture.
MITRE ATT&CK mapping
| Technique | ID | Evidence |
|---|---|---|
| Local Data Staging | T1074.001 | Created C:\Users\steve\Pictures\a as a staging directory |
| Archive Collected Data | T1560.001 | Compressed staging folder to a.zip |
| Data from Local System | T1005 | Accessed Documents (VPN configs, passwords, engineering data) |
| Data from Network Shared Drive | T1039 | Accessed \\Prod-ns-2\prodshare for construction plans |
| File and Directory Discovery | T1083 | Used Everything search utility for rapid filesystem enumeration |
Analysis performed using regipy for registry parsing. All shellbag timestamps are UTC.
Challenge created by CyberJunkie on HackTheBox.