SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Exposing a Vast Phishing Campaign by Probing Malicious Emails and URLs
TryHackMe Snapped Phish-ing Line Room Write‑Up
Introduction
Phishing remains one of the most common and consequential threats faced by modern organizations. Even well‑trained employees can be caught off guard by convincing lures, so making rapid investigation is essential. In this write‑up, I walk you through a real-world phishing incident scenario presented in TryHackMe’s Snapped Phish-ing Line room. By analyzing suspicious emails, investigating malicious URLs, retrieving and dissecting the phishing kit, and leveraging threat‑intelligence tools, we will uncover the scope of the attack and gather valuable insights about the adversary.
Context
The phishing kit used in this scenario was retrieved from a real-world phishing campaign.
An Ordinary Midsummer Day…
As an IT department member at SwiftSpend Financial, one of your responsibilities is supporting employees with technical concerns. What began as a routine workday quickly escalated when several employees reported an unusual email they had received some had already entered their credentials and could no longer log in.
You begin your investigation by:
- Analyzing the suspicious emails.
- Examining the phishing URL(s) through a controlled browser session.
- Retrieving the phishing kit used by the adversary.
- Using cyber threat intelligence tooling to gather additional context.
- Analyzing the phishing kit to extract indicators and attacker information.
Questions and Answers
Who is the individual who received an email attachment containing a PDF?
Process: Reviewing the suspicious emails to find one with a PDF attachment.
Answer: William McClean
What email address was used by the adversary to send the phishing emails?
Process: Inspecting the “From” metadata in the email.
Answer: Accounts.Payable@groupmarketingonline.icu
What is the redirection URL to the phishing page for the individual Zoe Duncan? (defanged format)
Process: Checking the HTML attachment in Zoe Duncan’s email.
Answer:
hxxp[://]kennaroads[.]buzz/data/Update365/office365/40e7baa2f826a57fcf04e5202526f8bd/?email=zoe[.]duncan@swiftspend[.]finance\&error
What is the URL to the .zip archive of the phishing kit? (defanged format)
Process: Navigating the malicious address and performing directory traversal to locate the phishing kit archive.
Answer: hxxp[://]kennaroads[.]buzz/data/Update365[.]zip
What is the SHA256 hash of the phishing kit archive?
Process: Downloading the ZIP file and running sha256sum in a Linux terminal.
Answer: ba3c15267393419eb08c7b2652b8b6b39b406ef300ae8a18fee4d16b19ac9686
When was the phishing kit archive first submitted? (format: YYYY-MM-DD HH:MM:SS UTC)
Process: Querying the hash on VirusTotal and checking the “First Submission” entry.
Answer: 2020–04–08 21:55:50 UTC
When was the SSL certificate used by the phishing domain first logged? (format: YYYY-MM-DD)
Process: The online information is no longer available; the TryHackMe tip provides the answer.
Answer: 2020–06–25
What was the email address of the user who submitted their password twice?
Process: Examining the logs generated by the phishing toolkit.
Answer: michael.ascot@swiftspend.finance
What was the email address used by the adversary to collect compromised credentials?
Process: Reviewing the configuration within the downloaded phishing toolkit.
Answer: m3npat@yandex.com
The adversary used other email addresses in the phishing kit. What is the email address that ends with “@gmail.com”?
Process: Inspecting additional configuration files in the phishing toolkit.
Answer: jamestanner2299@gmail.com
What is the hidden flag?
Process: Viewing the flag.txt file and decoding its Base64 content using CyberChef.
Answer: THM{pL4y_w1Th_tH3_URL}
Conclusion
This investigation illustrates how a combination of careful email inspection, controlled URL analysis, threat‑intelligence enrichment, and phishing‑kit forensics can reveal the true scope of a phishing campaign. By dissecting the attacker’s infrastructure and methods, defenders gain valuable insights that can guide incident response, improve security awareness training, and strengthen organizational resilience against future phishing attempts.
