SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Inside a Phishing Attack: TryHackMe First Shift CTF — Task 4: Phishing Books
A SOC phishing analysis: email header forensics, obfuscated payload decoding, and adversary attribution
Introduction
In this investigation, I analyze a phishing email scenario from the TryHackMe First Shift CTF room. This task focuses on identifying phishing indicators, analyzing malicious attachments, and mapping attacker behavior to the MITRE ATT&CK framework.
Here I demonstrate a structured SOC analyst workflow — covering email header analysis, payload inspection, threat intelligence enrichment, and adversary attribution. This reflects how security analysts conduct phishing investigations in a real-world Security Operations Center (SOC).
This article continues from Task 3 (Probably Just Fine), shifting the focus from general threat analysis to phishing detection and investigation.
Scenario
Your SOC inbox receives a suspicious email reported by an employee.
The email claims to be from an online bookstore and includes:
- A link to “track your order”
- An attachment
You suspect phishing.
Objectives
Analyze the email and determine:
- Sender legitimacy
- Indicators of compromise (IOCs)
- Payload behavior
Questions
Q1. Which specific check within the headers explains the bypass of email filters?
Process:
I opened the .eml file in a text editor to review the raw email headers. Within the authentication results, I identified dmarc=none.
Insights:
DMARC (Domain-based Message Authentication, Reporting & Conformance) helps receiving servers validate whether an email is authorized by the sender’s domain. A value of none indicates that no enforcement policy is applied, meaning failed authentication checks do not result in rejection or quarantine.
This significantly increases the likelihood of phishing emails bypassing secure email gateways.
Answer: DMARC=none
Q2. What technique did the attacker use to make the message seem legitimate?
Process:
By comparing sender and recipient domains, I noticed a subtle variation in spelling (e.g., kinglord vs kingford), indicating a deceptive lookalike domain.
Insights:
This is a classic typosquatting technique, where attackers register domains visually similar to legitimate ones. This exploits human oversight and increases trust, especially in phishing campaigns targeting non-technical users.
Answer: Typosquatting
Q3. Which MITRE technique and sub-technique ID best fit this sender address trick?
Process:
Using the MITRE ATT\&CK knowledge base, I mapped typosquatting to Acquire Infrastructure: Domains (T1583.001).
Insights:
This technique highlights how adversaries establish infrastructure (such as deceptive domains) to support phishing and other attack vectors. Recognizing this mapping is critical for threat intelligence correlation and detection engineering.
Answer: T1583.001
Q4. What is the file extension of the attached file?
Process:
Inspecting the raw email content revealed the attachment used a double extension to masquerade as a legitimate PDF.
Insights:
Double extensions are commonly used to deceive users (e.g., invoice.pdf.html). The real file type—HTML—enables execution in a browser, often redirecting victims to credential harvesting pages.
Answer: .html
Q5. What is the MD5 hash of the .HTML file?
Process:
I reviewed the email analysis report and followed the VirusTotal reference link. The MD5 hash was embedded within the URL.
Please look at the bottom of this image to see the reference link
Insights:
Hash values uniquely identify files and are essential for threat intelligence sharing, detection rules, and correlation across platforms.
Answer: 442f2965cb6e9147da7908bb4eb73a72
Q6. What is the landing page of the phishing attack?
Process:
I extracted the Base64-encoded attachment content and decoded it using CyberChef. Within the decoded HTML, I identified obfuscated variables.
By:
- Unescaping Unicode characters
- Reversing encoded strings
I reconstructed the hidden phishing URL from the xanthium variable:
Insights:
This demonstrates layered obfuscation:
- Encoding (Base64)
- Unicode escaping
- String reversal
Such techniques are designed to evade static detection and delay analyst understanding.
Answer: http://lіi2600urar9700utlu-13cwe32432300u.cod600u
Q7. Which MITRE technique ID was used inside the attached file?
Process:
I mapped the obfuscation behavior to Obfuscated Files or Information (T1027) in MITRE ATT\&CK.
Insights:
Obfuscation is widely used to bypass detection systems and hinder reverse engineering, making it a critical behavior for analysts to recognize.
Answer: T1027
Q8. What is the hidden message the attacker left in the file?
Process:
Using the same decoding process as Q6, I analyzed the egassem variable:
- Unicode unescaping
- String reversal
Insights:
While not operationally relevant, such embedded messages are sometimes used by threat actors as signatures, humor, or psychological markers.
Answer: I love to phish books from libraries ^^
Q9. Which line in the attached file is responsible for decoding the URL redirect?
Process:
I reviewed the decoded HTML from the email attachment and identified JavaScript responsible for string manipulation taking the previously discovered variables xanthium and egassem.
Insights:
This line performs string reversal, a simple but effective obfuscation technique used to reconstruct hidden values at runtime.
Note: Even though both lines perform the same kind of operation, theoretically, the first line (from var src) should be the one suitable for this answer, since it is (as asked) the one that specifically decodes the URL redirect (stored in xanthium). But for the platform, the next occurrence seemed to be the right answer.
Answer: var mes = reversed.split(“”).reverse().join(“”);
Q10. What is the first URL in the redirect chain?
Process:
I extracted and executed the attachment in a controlled environment and monitored network activity via browser developer tools.
Insights:
The domain uses Punycode encoding (xn — ), often leveraged in phishing to mimic legitimate domains using Unicode characters (IDN homograph attacks).
Answer: http://xn--librarytlu-13cwe32432-kwr.com:8082
Q11. What is the Threat Actor associated with this malicious file and/or URL?
Process:
Using threat intelligence tooling, I pivoted on the identified domain and retrieved adversary attribution data.
Insights:
Silent Librarian is known for targeting academic institutions and leveraging phishing campaigns for credential theft.
| Answer: Cobalt Dickens | Silent Librarian |
Q12. What is the main target of this Threat Actor according to MITRE?
Process:
I reviewed the threat actor Silent Librarian profile in MITRE ATT&CK.
Insights:
This aligns with known campaigns targeting universities and research organizations to exfiltrate intellectual property.
Answer: Research and proprietary data
Key Takeaways
This investigation demonstrates several core SOC analyst competencies:
- Email header analysis and authentication review (DMARC, SPF, DKIM)
- Detection of social engineering techniques (typosquatting, spoofing)
- Malware and attachment analysis (Base64 decoding, obfuscation handling)
- Use of industry frameworks (MITRE ATT&CK mapping)
- Threat intelligence pivoting and attribution
- Safe dynamic analysis and network monitoring
These are directly applicable to real-world Tier 1 / Tier 2 SOC roles.
Tools & Techniques Used
- Email header analysis
- CyberChef (data decoding)
- Browser Developer Tools (network analysis)
- Threat intelligence platforms
- MITRE ATT&CK framework
Skills Demonstrated
- Threat analysis
- Analytical thinking
- Attention to detail
- Adversary behavior mapping
- Incident investigation workflow
Conclusion
This task highlights how seemingly simple phishing emails can contain multiple layers of deception — from domain impersonation to heavily obfuscated payloads. By applying a structured analytical approach, I was able to uncover attacker techniques, trace infrastructure, and map behaviors to established threat frameworks.
Developing this methodology is essential for detecting and responding to modern phishing campaigns in operational environments.
