# The Finance Trail - Splunk (TryHackMe)

Link to [**the Finance Trail**](https://tryhackme.com/room/thefinancetrail) challenge on TryHackMe

## Case Briefing

**The numbers do not add up.**

You have been brought on at <u>THM</u> Security Services (TSS). Click the card below to reveal your role on this case.

Your case briefing is waiting in the TSS Operations Hub. Head to the **Active Case** tab for everything you need before you begin. The other tabs are there if you want to explore the company, the team, or previous cases.

View Site

## **Prerequisites**

- [<u>Splunk</u>: The Basics](https://tryhackme.com/room/splunk101)
- [Investigating with Splunk](https://tryhackme.com/room/investigatingwithsplunk)
- [Alert Triage with Splunk](https://tryhackme.com/room/alerttriagewithsplunk)

## The Investigation

A <u>Splunk</u> investigation workstation has been attached to this task with the indexed evidence required for the investigation.

Click **Start Machine** below. To access Splunk, use this link: <https://LAB_WEB_URL.p.thmlabs.com>[.](https://lab_web_url.p.thmlabs.com/)

Use the questions below to guide your investigation and define the response scope supported by the evidence.

The case starts with the legal-review themed email that Vantara's Security Operations Centre (<u>SOC</u>) escalated. That email led a finance employee to download a ZIP, run the program inside it, and end up with an unfamiliar sync client calling out from the workstation. The questions below follow that chain from delivery to staging.

### Answer the questions below

The finance employee's workstation ran a program from inside a downloaded ZIP. Find the delivered email whose sender domain also hosted that ZIP. What is its Message-ID, without angle brackets?

```markdown
index=* "message-id=" punct="--::.+:--/[]::-=<..@--.>"
```

```markdown
2026-10-09T02:29:02.863690+00:00 van-fs-02 postfix/cleanup[147684]: D2898CA1EE: message-id=<20261009022902.06.1a247614eaf9@lawson-rowe-review.com>
Event Actions
Type	
Field	Value	Actions
Selected	
host
VAN-FS-02	
source
syslog://mail.vantara.local/postfix	
sourcetype
finance:mail:postfix	
Event	
message_id
<20261009022902.06.1a247614eaf9@lawson-rowe-review.com>	
Time	
_time
2026-10-09T02:29:02.863+00:00
Default	
index
finance_mail
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/e5832b49-2f87-4766-a1fb-cd5a3025507b.png align="center")

After the lure email arrived, which parent executable launched the browser process that opened the external review site? Give the .exe filename.

```markdown
index=* lawson-rowe-review.com exe
```

```xml
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-10-09T02:33:13.7416981Z'/><EventRecordID>1818054</EventRecordID><Correlation/><Execution ProcessID='2912' ThreadID='4468'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>VAN-FIN-WS-014</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2026-10-09 02:33:13.734</Data><Data Name='ProcessGuid'>{c5d2b969-5269-6ac8-7f07-000000001e01}</Data><Data Name='ProcessId'>664</Data><Data Name='Image'>C:\Program Files\Google\Chrome\Application\chrome.exe</Data><Data Name='FileVersion'>155.0.8059.40</Data><Data Name='Description'>Google Chrome</Data><Data Name='Product'>Google Chrome</Data><Data Name='Company'>Google LLC</Data><Data Name='OriginalFileName'>chrome.exe</Data><Data Name='CommandLine'>"C:\Program Files\Google\Chrome\Application\chrome.exe" http://lawson-rowe-review.com/review/disclosure-schedule</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>VAN-FIN-WS-014\maya.chen</Data><Data Name='LogonGuid'>{c5d2b969-26ec-6ac8-2991-020000000000}</Data><Data Name='LogonId'>0x29129</Data><Data Name='TerminalSessionId'>1</Data><Data Name='IntegrityLevel'>Medium</Data><Data Name='Hashes'>SHA256=F76F0234EFB271041DC84F9F38FB858E01859D5DA6F775F5108668EB3AE80975</Data><Data Name='ParentProcessGuid'>{c5d2b969-4ec4-6ac8-6407-000000001e01}</Data><Data Name='ParentProcessId'>1304</Data><Data Name='ParentImage'>C:\Program Files\Vantara\Finance Client\VantaraFinancePortal.exe</Data><Data Name='ParentCommandLine'>"C:\Program Files\Vantara\Finance Client\VantaraFinancePortal.exe"</Data><Data Name='ParentUser'>VAN-FIN-WS-014\maya.chen</Data></EventData></Event>
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/5beea157-44c3-4946-bb30-cda0646e2001.png align="center")

On the affected workstation, what SHA-256 did Sysmon's file-stream hash event record when Chrome saved the ZIP that contained the executed loader?

```xml
index=* zip chrome.exe
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/a5acad3c-7762-489c-b974-7e55f34475af.png align="center")

What SHA-256 do the extracted loader and installed sync client share in their process-creation events?

```xml
index=* sha256 sync
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f754cd40-b792-4a4d-94a0-34b9a1e8d20f.png align="center")

Which scheduled task belongs to the loader's process lineage, not routine document syncing? Omit the leading backslash.

```xml
index=* schedule User="VAN-FIN-WS-014\\maya.chen" Company="Microsoft Corporation"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/a399896a-f5ab-4f2c-a08b-ff4f1e434075.png align="center")

The sync client did not call out the moment it started. How many seconds passed between its Sysmon process-creation UtcTime and its first command-and-control (C2) callback in the Nginx web log, rounded to the nearest second?

```xml
index=* VantaraUpdateCheck UtcTime VantaraSync.exe
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/dce3c09a-5bc4-4b89-8309-fdde2b3c2e40.png align="center")

> Record the Sysmon Event ID 1 for `VantaraSync.exe --sync`, the one with `UtcTime: 2026-10-09 02:33:25.981`. Several events share the 02:33:25 second, so it’s easy to grab the wrong one, but this is the event the question was measuring from.
>
> Details to note for it:
>
> - **Host:** VAN-FIN-WS-014, user `maya.chen`
> - **Image:** `C:\Users\maya.chen\AppData\Local\VantaraSync\VantaraSync.exe`, PID 4736
> - **CommandLine:** `"...\VantaraSync.exe" --sync`
> - **OriginalFileName:** `ledgerdrop.exe` (shows it’s the loader renamed)
> - **Parent:** `ledgerdrop.exe` from inside `Temp1_Disclosure_Schedule_Update.zip`, PID 1656
> - **EventRecordID:** 1818992
> - **Timestamp to cite:** the `UtcTime` field (02:33:25.981), not the record’s `SystemTime` (02:33:26.240), since the question asks for `UtcTime`.
>
> Pair it with the first Nginx request (`2026-10-09T02:34:13+00:00`, client `10.81.70.254`, `cdn-lawsonreview.net`, user agent `VantaraSync/4.1`) and the 47-second gap becomes a one-line finding.
>
> The other 02:33:25 events are worth keeping as timeline entries, but they’re different steps:
>
> - 02:33:25.521: `ledgerdrop.exe` first runs (the loader executes).
> - 02:33:25.590 to .592: the loader drops `VantaraSync.exe` into `AppData\Local\VantaraSync`.
> - 02:33:25.624: `schtasks /Create` makes the `VantaraUpdateCheck` persistence task.
> - 02:33:25.981: the renamed copy starts. This is the one for the callback question.
> - Start (Sysmon `UtcTime`): 02:33:25.981
> - First Nginx request: 02:34:13
> - Difference: 47.019 s, which rounds to 47

For the loader-installed sync client's first successful callback from the affected workstation, which local TCP source port appears in both Suricata HTTP and the Windows Filtering Platform (WFP) allowed-connection event?

```xml
index=* 203.0.113.45 source="WinEventLog:Security"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/170a2413-9f35-48bc-9bb7-641055a2c99c.png align="center")

The main C2 server returned HTTP 503, and after that the sync client used a backup domain. In Suricata, the Domain Name System (DNS) answer of type A for the backup domain was recorded before that 503. How many milliseconds before the 503 was it recorded, to three decimal places?

```xml
index=* sourcetype="finance:network:suricata:json" event_type=http src_ip=10.81.70.254 "cdn-lawsonreview.net" 503
| table _time, timestamp, src_ip, dest_ip, http.hostname, http.status, http.url
| sort timestamp
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/82b4e6df-f56a-489c-8a81-5ef51b05ae3a.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/2e81ab16-adbe-48e6-babb-c888956ac0ef.png align="center")

> `2026-10-09T02:53:21.531963+0000`, from `10.81.70.254` to `cdn-lawsonreview.net`, and it matches the Nginx 503 at 02:53:21.
>
> **Calculation (microsecond precision)**
>
> - 503 time: 02:53:21.531963
> - DNS answer time: 02:53:21.523656
> - Difference: 0.008307 s = **8.307 ms**
>
> One thing to check before you submit. The DNS response row you pasted earlier was cut off before `dns.rrtype`, `dns.rrname` and `dns.rdata`, so I haven’t seen that it is the type A answer for `api-lawsoncdn.net`. The timing fits, since the request/response pair is at .523372/.523656, a fraction of a millisecond apart and about 8 ms before the 503. But the question names a specific answer, so confirm the response event has `rrtype: A` and `rrname: api-lawsoncdn.net`. This search lists every DNS answer for the backup domain:
>
> ```plaintext
> index=* sourcetype="finance:network:suricata:json" event_type=dns dns.type=answer "api-lawsoncdn.net"
> | table timestamp, src_ip, dest_ip, dns.rrname, dns.rrtype, dns.rdata
> | sort timestamp
> ```
>
> If it returns more than one A answer, use the last one before 02:53:21.531963. If the 02:53:21.523656 row is the only one (or the latest), then **8.307** is your answer.

Find the PowerShell process that created the archive later written to the share. In that workstation's captured Sysmon process-creation history, which executable last used its process ID before PowerShell started? Give the .exe filename.

```xml
index=* host="VAN-FIN-WS-014" EventCode=1 ProcessId=692
| table _time, UtcTime, ProcessId, Image, ProcessGuid, ParentImage
| sort - UtcTime
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/3b4ba75b-48ae-4c0f-a09a-aaed87f2405a.png align="center")

The attacker staged an archive on the workstation and then moved it to the file server. How many whole seconds passed between the archive’s Sysmon file-creation UtcTime and its successful SMB2 WRITE in Suricata?

```xml
index=* sourcetype="finance:network:suricata:json" event_type=smb src_ip=10.81.70.254 dest_ip=10.81.72.63 earliest="10/09/2026:02:53:00" latest="10/09/2026:03:10:00"
| table timestamp, flow_id, tx_id, smb.command, smb.status, smb.filename, smb.share, smb.fuid
| sort timestamp
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/3262ce4b-912f-48c9-8fe5-f0a0910bcea6.png align="center")

> The answer is **11**.
>
> - **Archive created (Sysmon 11** `UtcTime`**):** 2026-10-09 02:53:29.688, by `powershell.exe`
> - **Successful SMB2 WRITE (Suricata):** `2026-10-09T02:53:40.986626+0000`, flow `1289574328462318`, tx 10, `STATUS_SUCCESS`, file `review_notes_2026.zip`, share `\\VAN-FS-02\FinanceReview`
> - **Difference:** 40.986626 − 29.688 = 11.298626 s, so **11** whole seconds
>
> That WRITE belongs to the right file. The tx 9 CREATE and the tx 10 WRITE share `smb.fuid dd87e230-0000-0000-930b-177100000000`, and the tree connect at tx 7 shows the share name. The source is `10.81.70.254`, the same workstation that created the archive.
>
> The 11.298 s figure sits well away from a rounding boundary, so truncating and rounding to the nearest second give the same result. That matters because the question says “whole seconds” and doesn’t say which method to use.
>
> The results only cover the first 20 of 24 events, so page 2 is still hidden. Nothing there should change the answer, because the first successful WRITE for this file is already on page 1 and later rows can only come after it. If page 2 shows a second WRITE for the same fuid, that would only matter if the question meant the last write, and “its successful SMB2 WRITE” reads as the first.