SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
Invite Only: A Threat Intelligence Investigation and Malware Analysis writeup
A practical SOC analyst investigation of malicious hashes, phishing techniques, and malware delivery chains from the Invite Only TryHackMe room.
Introduction
Threat intelligence analysis is a critical skill for Security Operations Center (SOC) analysts. In this TryHackMe room, Invite Only, the objective is to investigate suspicious indicators such as IP addresses and file hashes and turn the findings into actionable threat intelligence.
This writeup walks through the investigative process used to analyze flagged indicators, identify related malware activity, and connect them to a known threat campaign. The exercise reflects real-world SOC workflows where analysts must pivot between indicators and correlate information from threat intelligence sources.
TryHackMe Invite Only Writeup
Scenario
You are an SOC analyst on the SOC team at Managed Server Provider TrySecureMe. Today, you are supporting an L3 analyst in investigating flagged IPs, hashes, URLs, or domains as part of incident response activities. One of the L1 analysts flagged two suspicious findings early in the morning and escalated them.
Your task is to analyse these findings further and distil the information into usable threat intelligence.
Flagged IP:
101[.]99[.]76[.]120
Flagged SHA256 hash:
5d0509f68a9b7c415a726be75a078180e3f02e59866f193b0a99eee8e39c874f
The organization recently purchased a new threat intelligence search application called TryDetectThis2.0. You can use this application to gather information about the indicators above.
Questions
What is the name of the file identified with the flagged SHA256 hash?
Answer: syshelpers.exe
What is the file type associated with the flagged SHA256 hash?
Answer: Win32 EXE
What are the execution parents of the flagged hash? List the names chronologically, using a comma as a separator. Note down the hashes for later use.
Answer: 361GJX7J,installer.exe
What is the name of the file being dropped? Note down the hash value for later use.
Answer: Aclient.exe
Research the second hash in question 3 and list the four malicious dropped files in the order they appear (from up to down), separated by commas.
Answer: searchhost.exe,syshelpers.exe,nat.vbs,runsys.vbs
Analyse the files related to the flagged IP. What is the malware family that links these files?
Answer: asyncrat
What is the title of the original report where these flagged indicators are mentioned? Use Google to find the report.
Answer: From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery
Which tool did the attackers use to steal cookies from the Google Chrome browser?
Answer: ChromeKatz
Which phishing technique did the attackers use? Use the report to answer the question.
Answer: ClickFix
What is the name of the platform that was used to redirect a user to malicious servers?
Answer: Discord
Conclusion
This room demonstrates how security analysts investigate suspicious indicators and correlate them with known threat intelligence. By analyzing hashes, reviewing dropped files, and pivoting across related indicators, it becomes possible to identify malware families and connect activity to known attack campaigns.
Exercises like this help develop practical threat intelligence skills such as indicator analysis, campaign correlation, and malware investigation. These skills are essential for security analysts who need to quickly identify and respond to evolving threats in real-world environments.
