Promotion Night: Splunk (TryHackMe)

Link to the challenge on TryHackMe: Promotion Night

It was a glorious Friday at ProbablyFine Ltd. After weeks of sales calls and PoC demos, the team finally signed a contract with DeceptiTech - a major tech company recently hit with ransomware and in need of an MSSP. Monitoring was set to begin on Monday, but some of their clouds and on-premises systems had already been onboarded into the SIEM.

To celebrate the win, the entire SOC team headed out for a big teambuilding.
Everyone except you - the Level 1 analyst covering the night shift, just in case.

The shift was quiet. Too quiet. Then a critical alert appeared: "Potential Ransom Note on DC-01". You blinked. Then blinked again. Then called your Level 2. No answer - just the automated message saying it's probably fine. Now, it's up to you to triage the alert alone. Tonight will either earn you the quickest promotion ever or be your last day at ProbablyFine. Good luck!

• Splunk challenges are always the most interesting Blue Teaming rooms on THM for me. To be all to complete these challenges, I went through the questions, tried my ways and also engaged Claude, some sections will add notes taken with Claude and also I was stuck on the MD5 hash, but eventually referred to an existing writeup online.

Answer the questions below

What was the network share path where ransomware was placed?

index=* host="DC-01"authentication_method=Negotiate Account_Domain="deceptitech.thm"

• authentication_method - got my eye, then we’ve an account laura.smith

index=* Account_Name="ANONYMOUS LOGON"

10/24/25
4:18:19.000 PM	
10/24/2025 04:18:19 PM
LogName=Security
EventCode=4738
EventType=0
ComputerName=DC-01.deceptitech.thm
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=74174
Keywords=Audit Success
TaskCategory=User Account Management
OpCode=Info
Message=A user account was changed.

Subject:
	Security ID:		S-1-5-7
	Account Name:		ANONYMOUS LOGON
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E6

Target Account:
	Security ID:		S-1-5-21-354406043-2902902395-728316044-1116
	Account Name:		laura.smith
	Account Domain:		DECEPT

Changed Attributes:
	SAM Account Name:	-
	Display Name:		-
	User Principal Name:	-
	Home Directory:		-
	Home Drive:		-
	Script Path:		-
	Profile Path:		-
	User Workstations:	-
	Password Last Set:	-
	Account Expires:		-
	Primary Group ID:	-
	AllowedToDelegateTo:	-
	Old UAC Value:		-
	New UAC Value:		-
	User Account Control:	-
	User Parameters:	-
	SID History:		-
	Logon Hours:		-

Additional Information:
	Privileges:		-
Collapse
host = DC-01source = WinEventLog:Securitysourcetype = WinEventLog

next

index=* Account_Name="ANONYMOUS LOGON"index=* Account_Name="laura.smith"
| table _time, EventCode, host, Account_Name, Logon_Type

next

index=* EventCode=5140 OR EventCode=5145
| table _time, host, Account_Name, Share_Name, Relative_Target_Name

index=* Account_Name="laura.smith" earliest=10/24/2025:16:31:00
| table _time, host, EventCode, Account_Name, Share_Name
| sort _time

index=* EventCode=11 host="DC-01"
| table _time, host, Image, TargetFilename
| sort _time

index=* EventCode=11 host="DC-01" TargetFilename="*readme*" OR TargetFilename="*decrypt*" OR TargetFilename="*ransom*" OR TargetFilename="*RECOVER*" OR TargetFilename="*HOW_TO*"
| table _time, host, Image, TargetFilename

index=* EventCode=11 TargetFilename="*SYSVOL*"
| table _time, host, Image, TargetFilename
| sort _time

index=* EventCode=11 TargetFilename="*gaze.exe*"
| table _time, host, Image, TargetFilename
| sort _time

C:\Windows\SYSVOL\sysvol\gaze.exe created by System at 16:30:18, right before the account tampering (16:31) and the ransom note drop (16:37). This is your placement event.

C:\Windows\SYSVOL\sysvol\ is the local disk path that backs the default SYSVOL network share on every DC. So, translating that to the UNC format the question wants:

\\DC-01\SYSVOL\gaze.exe

That matches your \\*****\******\****.*** template perfectly: hostname \ share \ filename.extension.

This also snaps the whole timeline into place nicely:

1. 16:30:18 gaze.exe dropped into SYSVOL (this is huge, because anything placed there auto-replicates to every DC and gets pulled by every domain-joined machine via GPO processing that's why it showed up spammed across every user profile's Start Menu folders later)

2. 16:31:19-35 laura.smith's account gets manipulated (4738) via ANONYMOUS LOGON, then does an IPC$ share connection, likely the mechanism used to actually place the file remotely

3. 16:37:40-41 gaze.exe executes and drops HOW_TO_RECOVER_DATA.html everywhere

What is the value ransomware created to persist on reboot?

index=* EventCode=13 TargetObject="*\\Run\\*" OR TargetObject="*\\RunOnce\\*"
| table _time, host, Image, TargetObject, Details

Which MITRE technique ID was used to deploy ransomware?

wmiprvse.exe → WMI-based remote execution (T1047 - Windows Management Instrumentation)

deploy: CommandLine: cmd.exe /c copy \\DC-01\SYSVOL\gaze.exe C:\Windows\Temp\gaze.exe && C:\Windows\Temp\gaze.exe

wmiprvse.exe as the actual launcher (spawning that cmd.exe /c copy ... && execute chain) is the WMI remote execution component that's not visible in the ParentImage column you pulled, but must be sitting one level up in the process tree (WMI calls typically spawn cmd.exe under wmiprvse.exe on the target host when triggered remotely). That fits your evidence nicely: eric.portman's credentials being used to trigger remote WMI process creation on both DC-01 and SRV-JMP, which explains how the same copy-and-execute command landed on two separate hosts without SMB admin-share traffic.

Full chain so far reads: (I had answered some other questions before this one)

1. gaze.exe staged in SYSVOL (16:30:18)

2. laura.smith account tampered via ANONYMOUS LOGON, likely a credential/access foothold

3. T1047 (WMI) used with eric.portman's account to remotely trigger cmd.exe /c copy \\DC-01\SYSVOL\gaze.exe ... && execute on DC-01 and SRV-JMP

4. Persistence via BabyLockerKZ Run key

5. Anti-recovery: shadow copy/backup deletion, bcdedit recovery disable

6. Ransom note dropped (HOW_TO_RECOVER_DATA.html)

7. Follow-on credential theft: ruche.dll reading cloud-keys.csv off SRV-ITFS

What ports of SRV-ITFS did the adversary successfully scan?

index=* host="SRV-ITFS" EventCode=3
| table _time, host, Image, SourceIp, DestinationIp, DestinationPort, State
| sort _time

index=* host="SRV-ITFS" EventCode=3
| table _time, Image, SourceIp, SourcePort, DestinationIp, DestinationPort
| sort DestinationPort

index=* SRV-ITFS OR "10.10.110.26"
| stats count by sourcetype

index=* EventCode=3 DestinationIp="10.10.110.26"
| table _time, host, SourceIp, DestinationIp, DestinationPort
| sort _time

_time	host	SourceIp	DestinationIp	DestinationPort
2025-10-23 18:33:41	SRV-ITFS	10.10.252.91	10.10.110.26	3389
2025-10-23 18:34:06	SRV-ITFS	10.10.252.91	10.10.110.26	3389
2025-10-23 18:34:07	SRV-ITFS	10.10.252.91	10.10.110.26	3389
2025-10-24 15:56:39	SRV-ITFS	10.10.252.91	10.10.110.26	3389
2025-10-24 15:56:45	SRV-ITFS	10.10.252.91	10.10.110.26	3389
2025-10-24 16:24:08	SRV-JMP	10.10.90.6	10.10.110.26	135
2025-10-24 16:24:08	SRV-JMP	10.10.90.6	10.10.110.26	139
2025-10-24 16:24:08	SRV-JMP	10.10.90.6	10.10.110.26	445
2025-10-24 16:24:08	SRV-JMP	10.10.90.6	10.10.110.26	3389
2025-10-24 16:24:08	SRV-JMP	10.10.90.6	10.10.110.26	5985
2025-10-24 16:24:09	SRV-ITFS	10.10.90.6	10.10.110.26	3389
2025-10-24 16:24:09	SRV-ITFS	10.10.90.6	10.10.110.26	5985

135, 139, 445, 3389, 5985

10.10.90.6 (from SRV-JMP, which you already know is compromised) scanning 135, 139, 445, 3389, 5985 on SRV-ITFS is a textbook internal recon sweep; those are exactly the ports you'd probe to check for RPC, NetBIOS, SMB, RDP, and WinRM, i.e., "what lateral movement options does this box give me?"

What is the full path to the malware that performed the Discovery?

index=* (EventCode=4698 OR EventCode=1) TargetFilename="*schtasks*" OR CommandLine="*schtasks*"
| table _time, host, Image, CommandLine

_time    host    Image    CommandLine
2025-10-24 16:20:17    SRV-JMP    C:\Windows\System32\schtasks.exe    schtasks  /run /tn "LanguageSync"
2025-10-24 16:20:17    SRV-JMP    C:\Windows\System32\cmd.exe    C:\Windows\system32\cmd.exe /C schtasks /run /tn "LanguageSync"
2025-10-24 16:20:01    SRV-JMP    C:\Windows\System32\schtasks.exe    schtasks.exe  /create /f /tr "rundll32.exe C:\Windows\System32\fr-FR\ruche.dll,StartW" /tn "LanguageSync" /ru "eric.portman" /sc onstart
2025-10-24 16:20:01    SRV-JMP    C:\Windows\System32\cmd.exe    C:\Windows\system32\cmd.exe /C schtasks.exe /create /f /tr "rundll32.exe C:\Windows\System32\fr-FR\ruche.dll,StartW" /tn "LanguageSync" /ru "eric.portman" /sc onstart

Which artifact did the adversary create to persist on the beachhead? LanguageSync

What is the MD5 hash of the embedded initial shellcode? 27B0D51406B5360B49D968D69DF0F3E6

I struggled to get this MD5 hash; I found others that were not correct. The remaining lead was getting the $var_code but couldn't extract it. After all trials, I found the hash from another write-up and used Claude to write the summary below based on what we had tried together so far.

MD5 of the actual decoded shellcode buffer (after XOR with key 35), not the hash of any file on disk. That's why no Splunk query could surface it - it only exists in memory after the PowerShell script runs the decode loop, and requires actually executing (or emulating) that XOR operation against the raw byte array embedded in update.ps1.

So the full answer chain was:

• Extract $var_code byte array from update.ps1

• XOR each byte with 35

• MD5 hash the resulting in-memory buffer = 27B0D51406B5360B49D968D69DF0F3E6

Which C2 framework was used by the adversary in the intrusion? Cobalt Strike

What hostname did the adversary log in from on the beachhead? DESKTOP-J9PR0CO

index=* EventCode=4624 host="SRV-JMP" Account_Name="eric.portman"
| table _time, host, Workstation_Name, Source_Network_Address, Logon_Type
| sort _time

What was the UNC path that likely contained AWS credentials?

ruche.dll

10/24/2025 04:27:35 PM
LogName=Microsoft-Windows-Sysmon/Operational
EventCode=1
EventType=4
ComputerName=SRV-JMP.deceptitech.thm
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Sysmon
Type=Information
RecordNumber=8563
Keywords=None
TaskCategory=Process Create (rule: ProcessCreate)
OpCode=Info
Message=Process Create:
RuleName: -
UtcTime: 2025-10-24 16:27:35.535
ProcessGuid: {69180db6-a8f7-68fb-ce2a-000000001c01}
ProcessId: 7108
Image: C:\Windows\System32\cmd.exe
FileVersion: 10.0.17763.1697 (WinBuild.160101.0800)
Description: Windows Command Processor
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: Cmd.Exe
CommandLine: C:\Windows\system32\cmd.exe /C type \\SRV-ITFS\Integrations\cloud-keys.csv
CurrentDirectory: C:\Windows\system32\
User: DECEPT\eric.portman
LogonGuid: {69180db6-3620-68fa-1bb8-070000000000}
LogonId: 0x7B81B

From which IP address did the adversary access AWS?

index=* sourcetype="aws:cloudtrail" earliest=10/24/2025:00:00:00
| stats count by sourceIPAddress, eventName
| sort -count

Which two sensitive files did the adversary exfiltrate from AWS?

index=* sourcetype="aws:cloudtrail" sourceIPAddress="152.42.128.207" eventName="GetObject"
| table _time, requestParameters.bucketName, requestParameters.key

What file did the adversary upload to S3 in place of the wiped ones?

s3.amazonaws.com object="deceptitech-backups"