# First Shift CTF | Zero Tolerance | TryHackMe Walkthrough

## **Task 6:Zero Tolerance**

> ***What is the hostname where the Initial Access occurred?***

we are most probably looking for a file so well first narrow down to a single host & lets check for file downloads

index=\* host=”JP-BROWN-WS” RuleName=Downloads  
| table \_time TargetFilename

![](https://miro.medium.com/v2/resize:fit:1250/1*mh669t-02iS9IUs1LBsvVw.png align="center")

mimikatz and a file with double extension

***Ans: JP-BROWN-WS***

> ***What MITRE subtechnique ID describes the initial code execution on the beachhead?***

***Ans: T1204.002***

> ***What is the full path of the malicious file that led to Initial Access?***

***Ans: C:\\Users\\jp.brown\\Downloads\\TravisClart\_Resume.pdf.lnk***

> ***What is the full path to the LOLBin abused by the attacker for Initial Access?***

index=\* host=”JP-BROWN-WS” NOT *SPLUNK* NOT *google*  
| table *time CommandLine Image ParentImage  
| sort* time

![](https://miro.medium.com/v2/resize:fit:1250/1*pgMjUkPPKOjCawT-rRpLng.png align="center")

set the date & time range

![](https://miro.medium.com/v2/resize:fit:1250/1*ZrGzzX0D94S25EdaXZUh0A.png align="center")

mshta.exe

`mshta.exe` (Microsoft HTML Application Host) is a legitimate Windows utility that runs HTA (HTML Application) files, essentially executing scripts

***Ans: C:\\Windows\\System32\\mshta.exe***

> ***What is the IP address of the attacker’s Command & Control server?***

***Ans: 10.10.14.174***

> ***What is the full path of the process responsible for the C2 beaconing?***

![](https://miro.medium.com/v2/resize:fit:1250/1*DlnARHPgknVPyxcAksEivg.png align="center")

***Ans: C:\\Windows\\Temp\\RuntimeBroker.exe***

> ***What is the full path, modified for Persistence on the beachhead host?***

![](https://miro.medium.com/v2/resize:fit:1250/1*GZQ3V1rVlLXqmCcpiVvjhQ.png align="center")

***Ans: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemMonitor***

> ***What tool and parameter did the threat actor use for credential dumping?***

![](https://miro.medium.com/v2/resize:fit:1250/1*1WAdB8R53bVeNoIA2XRFlA.png align="center")

***Ans: Invoke-Mimikatz -DumpCreds***

> ***The threat actor executed a command to evade defenses.  
> What security parameter did they attempt to change?***

![](https://miro.medium.com/v2/resize:fit:1250/1*p8bvAqBBiemWHMzqtDddkg.png align="center")

***Ans: DisableRealtimeMonitoring***

> ***The threat actor used a tool to execute remote commands on other machines.  
> What is the process ID (PID) that executed the remote command?***

![](https://miro.medium.com/v2/resize:fit:1250/1*oG1mcVMzWOrI2Ugoc7L2ag.png align="center")

mstsc is windows RDP app

***Ans: 6612***

> ***At what time did the threat actor pivot from the beachhead to another system?***

![](https://miro.medium.com/v2/resize:fit:1250/1*-MR0hfQqECYKSiOl_XZLWg.png align="center")

***Ans: 2025–11–14 05:19:42***

> ***What is the full path of the PowerShell script used by the threat actor to collect data?***

![](https://miro.medium.com/v2/resize:fit:1250/1*9l5YIK3Ti_5AWI2AJDXOMw.png align="center")

a file is downloaded ,lets check the file from the given artifacts

![](https://miro.medium.com/v2/resize:fit:875/1*fO8GKVevbkFzK9QhGgC8pg.png align="center")

***Ans: C:\\Windows\\Temp\\Setup-BackupServer.ps1***

> ***What are the first 4 file extensions targeted by this script for exfiltration?  
> Answer format: Chronological, comma-separated***

open the script

***Ans: .bak, .backup, .sql, .mdb***

> ***What is the full path to the staged file containing collected files?***

![](https://miro.medium.com/v2/resize:fit:875/1*DL0Q9w8Uj4kkbEd7pa_KVA.png align="center")

***Ans: C:\\Users\\bkup-svc\\AppData\\Local\\Temp\\sysbackup\_20251114.dat***

**THANK YOU FOR READING!!! ❤️💫**