The Finance Trail - Splunk (TryHackMe)

Link to the Finance Trail challenge on TryHackMe

Case Briefing

The numbers do not add up.

You have been brought on at THM Security Services (TSS). Click the card below to reveal your role on this case.

Your case briefing is waiting in the TSS Operations Hub. Head to the Active Case tab for everything you need before you begin. The other tabs are there if you want to explore the company, the team, or previous cases.

View Site

Prerequisites

• Splunk: The Basics
• Investigating with Splunk
• Alert Triage with Splunk

The Investigation

A Splunk investigation workstation has been attached to this task with the indexed evidence required for the investigation.

Click Start Machine below. To access Splunk, use this link: https://LAB_WEB_URL.p.thmlabs.com.

Use the questions below to guide your investigation and define the response scope supported by the evidence.

The case starts with the legal-review themed email that Vantara's Security Operations Centre (SOC) escalated. That email led a finance employee to download a ZIP, run the program inside it, and end up with an unfamiliar sync client calling out from the workstation. The questions below follow that chain from delivery to staging.

Answer the questions below

The finance employee's workstation ran a program from inside a downloaded ZIP. Find the delivered email whose sender domain also hosted that ZIP. What is its Message-ID, without angle brackets?

index=* "message-id=" punct="--::.+:--/[]::-=<..@--.>"

2026-10-09T02:29:02.863690+00:00 van-fs-02 postfix/cleanup[147684]: D2898CA1EE: message-id=<20261009022902.06.1a247614eaf9@lawson-rowe-review.com>
Event Actions
Type	
Field	Value	Actions
Selected	
host
VAN-FS-02	
source
syslog://mail.vantara.local/postfix	
sourcetype
finance:mail:postfix	
Event	
message_id
<20261009022902.06.1a247614eaf9@lawson-rowe-review.com>	
Time	
_time
2026-10-09T02:29:02.863+00:00
Default	
index
finance_mail

After the lure email arrived, which parent executable launched the browser process that opened the external review site? Give the .exe filename.

index=* lawson-rowe-review.com exe

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-10-09T02:33:13.7416981Z'/><EventRecordID>1818054</EventRecordID><Correlation/><Execution ProcessID='2912' ThreadID='4468'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>VAN-FIN-WS-014</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-10-09 02:33:13.734</Data><Data Name='ProcessGuid'>{c5d2b969-5269-6ac8-7f07-000000001e01}</Data><Data Name='ProcessId'>664</Data><Data Name='Image'>C:\Program Files\Google\Chrome\Application\chrome.exe</Data><Data Name='FileVersion'>155.0.8059.40</Data><Data Name='Description'>Google Chrome</Data><Data Name='Product'>Google Chrome</Data><Data Name='Company'>Google LLC</Data><Data Name='OriginalFileName'>chrome.exe</Data><Data Name='CommandLine'>"C:\Program Files\Google\Chrome\Application\chrome.exe" http://lawson-rowe-review.com/review/disclosure-schedule</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>VAN-FIN-WS-014\maya.chen</Data><Data Name='LogonGuid'>{c5d2b969-26ec-6ac8-2991-020000000000}</Data><Data Name='LogonId'>0x29129</Data><Data Name='TerminalSessionId'>1</Data><Data Name='IntegrityLevel'>Medium</Data><Data Name='Hashes'>SHA256=F76F0234EFB271041DC84F9F38FB858E01859D5DA6F775F5108668EB3AE80975</Data><Data Name='ParentProcessGuid'>{c5d2b969-4ec4-6ac8-6407-000000001e01}</Data><Data Name='ParentProcessId'>1304</Data><Data Name='ParentImage'>C:\Program Files\Vantara\Finance Client\VantaraFinancePortal.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\Vantara\Finance Client\VantaraFinancePortal.exe"</Data><Data Name='ParentUser'>VAN-FIN-WS-014\maya.chen</Data></EventData></Event>

On the affected workstation, what SHA-256 did Sysmon's file-stream hash event record when Chrome saved the ZIP that contained the executed loader?

index=* zip chrome.exe

What SHA-256 do the extracted loader and installed sync client share in their process-creation events?

index=* sha256 sync

Which scheduled task belongs to the loader's process lineage, not routine document syncing? Omit the leading backslash.

index=* schedule User="VAN-FIN-WS-014\\maya.chen" Company="Microsoft Corporation"

The sync client did not call out the moment it started. How many seconds passed between its Sysmon process-creation UtcTime and its first command-and-control (C2) callback in the Nginx web log, rounded to the nearest second?

index=* VantaraUpdateCheck UtcTime VantaraSync.exe

Record the Sysmon Event ID 1 for VantaraSync.exe --sync, the one with UtcTime: 2026-10-09 02:33:25.981. Several events share the 02:33:25 second, so it’s easy to grab the wrong one, but this is the event the question was measuring from.

Details to note for it:

• Host: VAN-FIN-WS-014, user maya.chen
• Image: C:\Users\maya.chen\AppData\Local\VantaraSync\VantaraSync.exe, PID 4736
• CommandLine: "...\VantaraSync.exe" --sync
• OriginalFileName: ledgerdrop.exe (shows it’s the loader renamed)
• Parent: ledgerdrop.exe from inside Temp1_Disclosure_Schedule_Update.zip, PID 1656
• EventRecordID: 1818992
• Timestamp to cite: the UtcTime field (02:33:25.981), not the record’s SystemTime (02:33:26.240), since the question asks for UtcTime.

Pair it with the first Nginx request (2026-10-09T02:34:13+00:00, client 10.81.70.254, cdn-lawsonreview.net, user agent VantaraSync/4.1) and the 47-second gap becomes a one-line finding.

The other 02:33:25 events are worth keeping as timeline entries, but they’re different steps:

• 02:33:25.521: ledgerdrop.exe first runs (the loader executes).
• 02:33:25.590 to .592: the loader drops VantaraSync.exe into AppData\Local\VantaraSync.
• 02:33:25.624: schtasks /Create makes the VantaraUpdateCheck persistence task.
• 02:33:25.981: the renamed copy starts. This is the one for the callback question.
• Start (Sysmon UtcTime): 02:33:25.981
• First Nginx request: 02:34:13
• Difference: 47.019 s, which rounds to 47

For the loader-installed sync client's first successful callback from the affected workstation, which local TCP source port appears in both Suricata HTTP and the Windows Filtering Platform (WFP) allowed-connection event?

index=* 203.0.113.45 source="WinEventLog:Security"

The main C2 server returned HTTP 503, and after that the sync client used a backup domain. In Suricata, the Domain Name System (DNS) answer of type A for the backup domain was recorded before that 503. How many milliseconds before the 503 was it recorded, to three decimal places?

index=* sourcetype="finance:network:suricata:json" event_type=http src_ip=10.81.70.254 "cdn-lawsonreview.net" 503
| table _time, timestamp, src_ip, dest_ip, http.hostname, http.status, http.url
| sort timestamp

2026-10-09T02:53:21.531963+0000, from 10.81.70.254 to cdn-lawsonreview.net, and it matches the Nginx 503 at 02:53:21.

Calculation (microsecond precision)

• 503 time: 02:53:21.531963
• DNS answer time: 02:53:21.523656
• Difference: 0.008307 s = 8.307 ms

One thing to check before you submit. The DNS response row you pasted earlier was cut off before dns.rrtype, dns.rrname and dns.rdata, so I haven’t seen that it is the type A answer for api-lawsoncdn.net. The timing fits, since the request/response pair is at .523372/.523656, a fraction of a millisecond apart and about 8 ms before the 503. But the question names a specific answer, so confirm the response event has rrtype: A and rrname: api-lawsoncdn.net. This search lists every DNS answer for the backup domain:

index=* sourcetype="finance:network:suricata:json" event_type=dns dns.type=answer "api-lawsoncdn.net"
| table timestamp, src_ip, dest_ip, dns.rrname, dns.rrtype, dns.rdata
| sort timestamp

If it returns more than one A answer, use the last one before 02:53:21.531963. If the 02:53:21.523656 row is the only one (or the latest), then 8.307 is your answer.

Find the PowerShell process that created the archive later written to the share. In that workstation's captured Sysmon process-creation history, which executable last used its process ID before PowerShell started? Give the .exe filename.

index=* host="VAN-FIN-WS-014" EventCode=1 ProcessId=692
| table _time, UtcTime, ProcessId, Image, ProcessGuid, ParentImage
| sort - UtcTime

The attacker staged an archive on the workstation and then moved it to the file server. How many whole seconds passed between the archive’s Sysmon file-creation UtcTime and its successful SMB2 WRITE in Suricata?

index=* sourcetype="finance:network:suricata:json" event_type=smb src_ip=10.81.70.254 dest_ip=10.81.72.63 earliest="10/09/2026:02:53:00" latest="10/09/2026:03:10:00"
| table timestamp, flow_id, tx_id, smb.command, smb.status, smb.filename, smb.share, smb.fuid
| sort timestamp

The answer is 11.

• Archive created (Sysmon 11 UtcTime): 2026-10-09 02:53:29.688, by powershell.exe
• Successful SMB2 WRITE (Suricata): 2026-10-09T02:53:40.986626+0000, flow 1289574328462318, tx 10, STATUS_SUCCESS, file review_notes_2026.zip, share \\VAN-FS-02\FinanceReview
• Difference: 40.986626 − 29.688 = 11.298626 s, so 11 whole seconds

That WRITE belongs to the right file. The tx 9 CREATE and the tx 10 WRITE share smb.fuid dd87e230-0000-0000-930b-177100000000, and the tree connect at tx 7 shows the share name. The source is 10.81.70.254, the same workstation that created the archive.

The 11.298 s figure sits well away from a rounding boundary, so truncating and rounding to the nearest second give the same result. That matters because the question says “whole seconds” and doesn’t say which method to use.

The results only cover the first 20 of 24 events, so page 2 is still hidden. Nothing there should change the answer, because the first successful WRITE for this file is already on page 1 and later rows can only come after it. If page 2 shows a second WRITE for the same fuid, that would only matter if the question meant the last write, and “its successful SMB2 WRITE” reads as the first.