TryHackMe The Last Trial (hard level)

-


 


TryHackMe – The Last Trial


   In this challenge, I investigated a macOS compromise that occurred in parallel with a larger Active Directory–based ransomware attack. The scenario emphasized that not all incidents are targeted attacks—some originate from user curiosity and unsafe software trials.




1. Initial Access via Malicious Software Trials


The attacker gained access after the user downloaded a fake AI development tool installer from a malicious website:


Website: developai.thm


Installer: DevelopAIInstaller.pkg


This reinforced how social engineering and trojanized installers remain effective, especially when they target trending topics like AI tools.


2. macOS Installation and Timeline Analysis


I learned how to determine exact installation timestamps of malicious applications on macOS by analyzing system artifacts, allowing accurate attack timeline reconstruction.


Installation time: 2025-07-04 10:09:03


3. Abuse of macOS Privacy Controls (TCC)


The malware abused macOS Transparency, Consent, and Control (TCC) by requesting sensitive permissions early in the execution chain:


First requested permission: kTCCServiceSystemPolicyDesktopFolder


This showed how attackers can legitimately request access to sensitive user data and blend into normal OS behavior.


4. Command and Control (C2) Communication


I identified the full exfiltration endpoint, learning how to trace outbound connections used for data theft:


C2 URL: http://c7.macos-updatesupport.info:8080


This emphasized the importance of network traffic analysis in macOS incident response.


5. Persistence via LaunchAgents


The attacker maintained persistence using a LaunchAgent, a common and stealthy macOS persistence mechanism that allows malware to execute at user login without elevated privileges.



Comments

Post a Comment

Popular posts from this blog

TryHackMe - Typo Snare Threat Hunter Simulator (medium level)

-
Image
  Threat Hunt Walkthrough The "Typo Snare" scenario on TryHackMe is a fantastic real-world simulation of a sophisticated, multi-stage attack. It starts with a simple mistake and escalates to a full domain compromise, culminating in ransomware. This post will walk you through the entire attack chain, phase by phase, showing you how to find each piece of evidence using Elastic KQL queries. Phase 1: Initial Access & Execution What Happened: The attack began when the user perry.parsons on workstation WKSTN-03 needed a 7-Zip tool. He googled it, clicked a typosquatted link ( 7zipp.org ), and downloaded a trojanized installer. This installer executed a PowerShell script ( 7z.ps1 ) directly from the attacker's server to establish the initial foothold. How to Find It: You are looking for a PowerShell process that was likely spawned by a browser and contains a command to download and execute a script ( iwr for Invoke-WebRequest and iex for Invoke-Expression ). KQL Query...
Read more

TryHackMe - Threat Hunting Simulator - Health Hazard

-
Image
  Scenario overview After months of juggling content calendars and caffeine-fueled brainstorming, co-founder Tom Whiskers finally carved out time to build the company’s first website. It was supposed to be simple: follow a tutorial, install a few packages, and bring the brand to life with lightweight JavaScript magic.   But between sleepless nights and copy-pasted code, Tom started feeling off. Not sick exactly, just off. The terminal scrolled with reassuring green text, the site loaded fine, and everything looked normal.   Then, a strange file appeared on the system. No one could say where it came from. It wasn’t part of the tutorial, didn’t match any known dependencies, and didn’t even run.   It just waited.   Scenario objectives Determine how a threat actor first gained a foothold on the system. Identify suspicious activity that may point to the initial compromise method. Investigate signs of malicious execution following the initial access. Analyse the logs ...
Read more

TryHackMe - Initial Access Pot | CTF | (hard level)

-
Image
  This is another challenge for the Blue Team, but the level here is hard. Once the machine starts, we will receive credentials that allow us to dig into the logs directly. By exploring the attacker’s footsteps, we will identify which pages of the web application they accessed. Additionally, we have full access to the backend code of the running application once we log in via SSH. So I am not running any directory fuzzing tool. All Details are in the video  Thank you for watching 
Read more