Phantom Check

https://app.hackthebox.com/sherlocks/Operation%2520Blackout%25202025%253A%2520Phantom%2520Check?tab=play_sherlock

There is no machine, just a zip file to analyse.

Usually you just open .evtx files with Event Viewer on windows, but I’ll test on the rust tool evtx_dump on linux.

yay -S evtx
evtx_dump Windows-Powershell-Operational.evtx -o json > output.json

I made a janky parser that grabs the powershell payloads (includes outputs too)

from json import loads
for line in open('output.json').read().splitlines()[1::2][::-1]:
    j = loads(line)["Event"]
    #print(j)
    #print('\n'*10)

    eventdata = j.get("EventData")
    if eventdata is not None:
        payload = eventdata.get("Payload")
        if payload is not None:
            print(f'payload: {payload}')

Scrolling through that we see

payload: CommandInvocation(Get-WmiObject): "Get-WmiObject"
ParameterBinding(Get-WmiObject): name="Class"; value="Win32_ComputerSystem"
CommandInvocation(Select-Object): "Select-Object"
ParameterBinding(Select-Object): name="ExpandProperty"; value="Model"
ParameterBinding(Select-Object): name="InputObject"; value="\\DESKTOP-M3AKJSD\root\cimv2:Win32_ComputerSystem.Name="DESKTOP-M3AKJSD""

So the answer to q1 is Win32_ComputerSystem

I searched for ‘Temperature’ and found one result

payload: CommandInvocation(Get-WmiObject): "Get-WmiObject"
ParameterBinding(Get-WmiObject): name="Query"; value="SELECT * FROM MSAcpi_ThermalZoneTemperature"
ParameterBinding(Get-WmiObject): name="ErrorAction"; value="SilentlyContinue"
NonTerminatingError(Get-WmiObject): "Invalid class "MSAcpi_ThermalZoneTemperature""

So the answer to q2 is SELECT * FROM MSAcpi_ThermalZoneTemperature

I modified the prev parser

from json import loads
for line in open('output.json').read().splitlines()[1::2][::-1]:
    j = loads(line)["Event"]
    #print(j)
    #print('\n'*10)

    eventdata = j.get("EventData")
    if eventdata is not None:
        scriptblocktext = eventdata.get("ScriptBlockText")
        if scriptblocktext is not None:
            print(f'scriptblocktext: {scriptblocktext}')

scroll through that and you can find

scriptblocktext: function Check-VM
...

Search for hklm or HKLM

the correct section is this:

    if (!$hypervm)
        {
            $hyperv = Get-ChildItem HKLM:\SYSTEM\ControlSet001\Services
            if (($hyperv -match "vmicheartbeat") -or ($hyperv -match "vmicvss") -or ($hyperv -match "vmicshutdown") -or ($hyperv -match "vmiexchange"))
                {
                    $hypervm = $true
                }
        }

    #Virtual Box

    $vb = Get-Process
    if (($vb -eq "vboxservice.exe") -or ($vb -match "vboxtray.exe"))
        {
    
        $vbvm = $true
    
        }

Matching their requested format, answer to q5 is vboxservice.exe, vboxtray.exe

For this I used my first parser again.

Search for ‘This is a’, and you can see the output log:

payload: CommandInvocation(Out-Default): "Out-Default"
ParameterBinding(Out-Default): name="InputObject"; value="This is a Hyper-V machine."
ParameterBinding(Out-Default): name="InputObject"; value="This is a VMWare machine."

So answer to q6 is Hyper-V, VMWare