PS Eclipse — tryhackme

1. A suspicious binary was downloaded to the endpoint. What was the name of the binary?

Search for the “Source=”winEventLog:Mircrosoft-Windows-Sysmon/Operational” first and through the use of command line arguments. We can get the binary data and decode any base64 encoding of the binary file transfer and analyze the decoded data. Tools such as CyberChef is been used to decode the base64 data and reveal the name of the binary.

2. What is the address the binary was downloaded from? Add http:// to your answer & defang the URL.

The binary was downloaded from the URL after decoding the base64 code and defanging the URL

ANSWER: hxxp://886e-181–215–214–32.ngrok.io.

3. What Windows executable was used to download the suspicious binary? Enter full path.

The exact path of the PowerShell executable used to download the suspicious binary can be obtained from the ParentCommandline field.

ANSWER: The full path is located at C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.

4. What command was executed to configure the suspicious binary to run with elevated privileges?ANSWER: “C:\Windows\system32\schtasks.exe” /Create /TN

We can get the command from command line field search answer:

OUTSTANDING_GUTTER.exe /TR C:\Windows\Temp\COUTSTANDING_GUTTER.exe /SC ONEVENT /EC Application /MO *[System/EventID=777] /RU SYSTEM /f

5. What permissions will the suspicious binary run as? What was the command to run the binary with elevated privileges? (Format: User + ; + CommandLine)

Get Nishigothi’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We can directly search the OUTSTANDING_GUTTER.exe to find the user and commandline

6. The suspicious binary connected to a remote server. What address did it connect to? Add http:// to your answer & defang the URL.

Need to add the field QUERYNAME to get the value of the remote server URL and than decode it

7 A PowerShell script was downloaded to the same location as the suspicious binary. What was the name of the file?

We can find the PowerShell script by searching for files with the “.ps1” extension in the temp folder. The name of the script found in the same location as the suspicious binary OUTSTANDING_GUTTER.exe is script.ps1.

8. The malicious script was flagged as malicious. What do you think was the actual name of the malicious script?

Need to decode the MD5 using virustools to get the actual name

9. A ransomware note was saved to disk, which can serve as an IOC. What is the full path to which the ransom note was saved?

We can locate the ransom note, which is typically saved in a .txt format, by searching the search box and looking for the file path under the keegan user, which serves as an indicator of control.

10. The script saved an image file to disk to replace the user’s desktop wallpaper, which can also serve as an IOC. What is the full path of the image?

Easily we can search .jpg