# New Hire Old Artifacts-TryHackMe Walkthrough

## **Task 1:Investigate the attack**

**Scenario**: You are a SOC Analyst for an MSSP (managed Security Service Provider) company called TryNotHackMe.

A newly acquired customer (Widget LLC) was recently onboarded with the managed Splunk service. The sensor is live, and all the endpoint events are now visible on TryNotHackMe’s end. Widget LLC has some concerns with the endpoints in the Finance Dept, especially an endpoint for a recently hired Financial Analyst. The concern is that there was a period (December 2021) when the endpoint security product was turned off, but an official investigation was never conducted.

Your manager has tasked you to sift through the events of Widget LLC’s Splunk instance to see if there is anything that the customer needs to be alerted on.

Happy Hunting!

> ***A Web Browser Password Viewer executed on the infected machine. What is the name of the binary? Enter the full path.***

![](https://miro.medium.com/v2/resize:fit:1250/1*hreN1ntczg66DZhFrfE9rA.png align="center")

![](https://miro.medium.com/v2/resize:fit:1250/1*Jf0e-XWNIRiFmtlkWODn8A.png align="center")

reads browser data and writes to a file in temp dir

***Ans: C:\\Users\\FINANC~1\\AppData\\Local\\Temp\\11111.exe***

> ***What is listed as the company name?***

***Ans: NirSoft***

> ***Another suspicious binary running from the same folder was executed on the workstation. What was the name of the binary? What is listed as its original filename? (format:*** [***file.xyz***](http://file.xyz)***,***[***file.xyz***](http://file.xyz)***)***

index=\* EventCode=1 CurrentDirectory=”C:\\Users\\Finance01\\AppData\\Local\\Temp\\”

![](https://miro.medium.com/v2/resize:fit:875/1*8BdgevThyjCaIucsPHXtYw.png align="center")

`FINANC~1` is the Windows **8.3 short filename format** automatically created for compatibility with legacy applications. It maps to the full folder name `Finance01`. Both paths refer to the same directory.

![](https://miro.medium.com/v2/resize:fit:1250/1*MbDSj8Z4BJxy1a1YMVYnqQ.png align="center")

***Ans: IonicLarge.exe,PalitExplorer.exe***

> ***The binary from the previous question made two outbound connections to a malicious IP address. What was the IP address? Enter the answer in a defang format.***

index=\* EventCode=3 Image=”C:\\Users\\Finance01\\AppData\\Local\\Temp\\IonicLarge.exe”

![](https://miro.medium.com/v2/resize:fit:875/1*D6DzUCmcLcERkWc0m7MGOg.png align="center")

***Ans: 2\[.\]56\[.\]59\[.\]42***

> ***The same binary made some change to a registry key. What was the key path?***

index=\* EventCode=13 Image=”C:\\Users\\Finance01\\AppData\\Local\\Temp\\IonicLarge.exe”

![](https://miro.medium.com/v2/resize:fit:875/1*5v_tYPjydtNTgjJhnUhXZw.png align="center")

***Ans: HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender***

> ***Some processes were killed and the associated binaries were deleted. What were the names of the two binaries? (format:*** [***file.xyz***](http://file.xyz)***,***[***file.xyz***](http://file.xyz)***)***

index=\* *taskkill /*

![](https://miro.medium.com/v2/resize:fit:875/1*sMb3Ep2CkU5jKEWGpnzINA.png align="center")

***Ans: WvmIOrcfsuILdX6SNwIRmGOJ.exe,phcIAmLJMAIMSa9j9MpgJo1m.exe***

> ***The attacker ran several commands within a PowerShell session to change the behaviour of Windows Defender. What was the last command executed in the series of similar commands?***

![](https://miro.medium.com/v2/resize:fit:875/1*9sF3m5dHO2yGZsRWY8L7iA.png align="center")

![](https://miro.medium.com/v2/resize:fit:1250/1*CXlo4VeSaQ8XLO6Bg7wUFA.png align="center")

`C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe` is the 32-bit version of PowerShell on a 64-bit Windows system. Attackers sometimes use it to execute malicious scripts or bypass detections that monitor only 64-bit PowerShell.

***Ans: powershell WMIC /NAMESPACE:\\root\\Microsoft\\Windows\\Defender PATH MSFT\_MpPreference call Add ThreatIDDefaultAction\_Ids=2147737394 ThreatIDDefaultAction\_Actions=6 Force=True***

It modifies Microsoft Defender’s configuration to set the default response/action for threat ID `2147737394` to action `6`, forcing the change.`6` = Allow — Defender will allow the specified threat instead of taking its normal default action.

> ***Based on the previous answer, what were the four IDs set by the attacker? Enter the answer in order of execution. (format: 1st,2nd,3rd,4th)***

***Ans: 2147735503,2147737010,2147737007,2147737394***

> ***Another malicious binary was executed on the infected workstation from another AppData location. What was the full path to the binary?***

![](https://miro.medium.com/v2/resize:fit:1250/1*oEjGyPkNw5sbYf9B_xhiSA.png align="center")

***Ans: C:\\Users\\Finance01\\AppData\\Roaming\\EasyCalc\\EasyCalc.exe***

> ***What were the DLLs that were loaded from the binary from the previous question? Enter the answers in alphabetical order. (format: file1.dll,file2.dll,file3.dll)***

index=\* Image=”C:\\Users\\Finance01\\AppData\\Roaming\\EasyCalc\\EasyCalc.exe” TaskCategory=”Image loaded (rule: ImageLoad)”  
| table ImageLoaded Description  
| dedup ImageLoaded

![](https://miro.medium.com/v2/resize:fit:1250/1*XyrWtkIpChfkUtTD9rVAHg.png align="center")

These DLLs indicate that **EasyCalc.exe was built using the NW.js framework**, meaning it is likely a **web-based (JavaScript) application packaged as a Windows executable**, which attackers sometimes use to build malware.

***Ans: ffmpeg.dll,nw.dll,nw\_elf.dll***

**THANK YOU FOR READING!!! ❤️💫**