TryHackMe — Conti

1. Connect to VM then open browser with the credentials below;

2. To answer question below;

2.1 First is to check the events by typing “index=*”

2.2 In the left pane click “sourcetype”, then click WinEventlog as shown below;

2.3 Then Click CurrentDirectory on the left pane and click the directory shown below. This looks like the malicious location we are looking for;

2.3 Expand and then get the value below;

3. To answer the question below;

3.1 Go back to Sysmon event by typing the text below, then click the Event Code in the left pane to get the value;

4. To answer the question below;

4.1 Go to CurrentDirectory again, select the highlighted below

4.2 Get the MD5 value as shown below;

5. To answer the question below;

5.1 Go back to Sysmon sourcetype, then click on the TargetFilename at the left pane and get its value as shown below;

Get Allan Abulencia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

6. To answer the question below;

6.1 By checking the security events and account management. There’s a malicious account name created as shown below;

6.2 By going again to Sysmon event and adding the securityninja search parameters;

7. To Answer the question below

7.1 Go to Sysmon event then get the eventcode = 8 and SourceImage

8. To answer the question below;

8.1 Get the targetImage from the previous results

9. To Answer the question below

9.1 Go to Sysmon event then search for aspx

10. To answer the question below

10.1 From the previous results , get the command line value as shown below;

11. To answer the question below;

11.1 Searching on google, here is the CVEs for the Conti’s exploit