Splunk 2 TryHackMe Writeup (Part 2) — BOTS v2 SOC Investigation (300 & 400 Series)

Advanced Threat Investigation Using Splunk (BOTS v2 Dataset)

In this second part of my investigation of the TryHackMe Splunk 2 room, I continue analyzing the Boss of the SOC (BOTS) v2 dataset, in which this room is based on, focusing on the 300 and 400 series scenarios.

These challenges simulate more advanced attack techniques, including ransomware infections, malware execution, command-and-control (C2) communication, and APT activity. They require deeper correlation across multiple log sources and a stronger understanding of attacker behavior.

If you haven’t read Part 1 (100 & 200 series), I recommend starting there to follow the full investigation workflow and context.

300 Series

Question:

Mallory’s critical PowerPoint presentation on her MacBook gets encrypted by ransomware on August 18. What is the name of this file after it was encrypted?

Process:
I created a query to identify events related to the user Mallory, focusing on PowerPoint files.

Splunk query:
index="botsv2" Mallory (*.ppt OR *.pptx)

Reviewing the results, one event showed a .pptx file with an additional .crypt extension, indicating encryption. The file was located in the mallory.kraeusen directory and transmitted via SMB, suggesting possible data exfiltration.

Although the event timestamp was from August 19, all indicators confirmed this was the correct file.

Insight: The addition of extensions like .crypt is a common ransomware indicator. In real SOC environments, tracking file renames across endpoints is crucial for early detection of encryption activity.

Answer: Frothly_marketing_campaign_Q317.pptx.crypt

Question:

There is a Game of Thrones media file that was encrypted as well. What season and episode is it?

Process:
I first identified Mallory’s host by searching for her username and reviewing the host field.

After identifying the workstation, I filtered for encrypted files using the .crypt extension and searched for keywords like “Game of Thrones” and “GOT.”

Splunk query:
index="botsv2" host="MACLORY-AIR13" *.crypt GOT

This returned the relevant file.

Insight: Attackers often encrypt non-critical or media files alongside important ones, which helps analysts confirm the scope and timeline of ransomware activity.

Answer: S07E02

Question:

Kevin Lagerfield used a USB drive to move malware onto kutekitten, Mallory’s personal MacBook. Provide the vendor name of the USB drive.

Process:
I searched for USB-related activity on Mallory’s device.

Splunk query:
index="botsv2" kutekitten usb model

The results revealed a vendor ID, which I researched externally to identify the manufacturer.

Insight: USB device tracking is a key technique in detecting insider threats and initial infection vectors, especially in environments without strict device control policies.

Answer: Alcor Micro Corp.

Question:

What programming language is at least part of the malware written in?

Process:
From the previous question result, I used the time of the event the malicious USB was connected to filter subsequent events.

Then I looked for events from Mallory’s MacBook that included the path of newly created files or the path of the images used to start a process.

Splunk query:

index="botsv2" kutekitten columns.path=*
| sort _time asc

The earliest relevant event revealed the programming language used.

Insight: Identifying the programming language helps analysts understand malware capabilities and potential obfuscation techniques, improving detection and response strategies.

Answer: Perl

Question:

When was this malware first seen in the wild?

Process: I continued investigating the events in the kutekitten MacBook which succeeded the insertion of the malicious USB drive and the first malware execution by giving specific time frames in the date picker.

I identified the malware file hash in one of the results which showed the creation of a file in Downloads, and checked it using a threat intelligence platform like VirusTotal.

From the file’s reputation data, I obtained the first-seen date.

Insight: Correlating file hashes with threat intelligence platforms like VirusTotal is a critical step in validating malware and understanding its prevalence.

Answer: 2017–01–17

Question:

What is the first C2 domain (alphabetically)?

Process:
From the same malware analysis report, I navigated to the Behavior → Network Communication section and reviewed DNS resolutions.

Insight: Dynamic DNS services are frequently used by attackers to maintain resilient command-and-control infrastructure and evade static blocking.

Answer: eidk.duckdns.org

Question:

What is the second C2 domain (alphabetically)?

Process:
I reviewed the next domain listed in the same section.

Answer: eidk.hopto.org

400 Series

Question:

What is the name of the malicious ZIP attachment?

Process:
I searched for SMTP events containing .zip attachments.

Splunk query:
index="botsv2" sourcetype="stream:smtp" *.zip

Filtering by the attach_filename field revealed the correct file.

Insight: Password-protected attachments are a common phishing technique used to bypass email security controls and evade automated scanning.

Answer: invoice.zip

Question:

What is the password for the ZIP file?

Process:
I filtered emails containing the attachment and examined the content_body field.

Splunk query:
index="botsv2" sourcetype="stream:smtp" "attach_filename{}"="invoice.zip"

The password was found within the email body.

Insight: Attackers often include passwords in the email body to ensure successful execution while still bypassing detection mechanisms.

Answer: 912345678

Question:

What SSL Issuer is used by the attacker?

Process:
Using the attacker IP identified earlier (which was scanning the brewertalk.com for vulnerabilities), I analyzed TCP events.

Splunk query:
index="botsv2" sourcetype="stream:tcp" 45.77.65.211

Then I reviewed the ssl_issuer field across events.

Insight: Even when attackers use encryption, SSL certificate metadata can provide valuable attribution clues during traffic analysis.

Answer: C = US

Question:

What unusual file was downloaded via FTP?

Process:
I identified FTP activity linked to winsys32.dll.

Splunk query 1:

index="botsv2" winsys32.dll

After that I performed a second query looking for ftp log events and specified RETR as the method used, which is the one in ftp for downloading data.

Splunk query 2:

index="botsv2" sourcetype="stream:ftp" method=RETR

The first of the returned events already showed me a suspicious file in Korean alphabet and uncommon extension.

The file contained Unicode characters, which I decoded using CyberChef in order to be able to submit it to the THM platform.

Insight: Files with foreign language naming conventions or uncommon extensions can indicate targeted attacks or data originating from non-native environments.

Answer: 나는_데이비드를_사랑한다.hwp

Question:

Who was identified in the malware metadata?

Process:
I analyzed the file using the Hybrid Analysis link (https://www.hybrid-analysis.com/sample/d8834aaa5ad6d8ee5ae71e042aca5cab960e73a6827e45339620359633608cf1/598155a67ca3e1449f281ac4=) and reviewed the metadata under File Details.

Insight: Metadata leakage is a frequent operational security mistake by attackers, often exposing internal usernames or developer identities.

Answer: Ryan Kovar

Question:

What type of points are mentioned in the document?

Process:
Using the ANY.RUN analysis link (https://app.any.run/tasks/15d17cd6-0eb6-4f52-968d-0f897fd6c3b3), I reviewed behavioral screenshots and extracted the document content.

Insight: Sandbox environments like ANY.RUN allow analysts to safely observe malicious document behavior and extract hidden content.

Answer: CyberEastEgg

Question:

What webpage is most contacted by scheduled tasks?

Process:
I began by investigating scheduled task activity.

Splunk query:

index="botsv2" schtasks
| sort _time asc

Then I identified a suspicious PowerShell command with encoded content.

After decoding it using CyberChef, I extracted the C2 communication details.

![1-baDbrFn0Jts2VM9yW2PWw.png](../assets/images/posts/botsv2-300-400/1-baDbrFn0Jts2VM9yW2PWw.png)

Insight: Scheduled tasks are a common persistence mechanism. Detecting encoded PowerShell commands is a strong indicator of post-exploitation activity.

Answer: process.php

Key Takeaways

Effective SOC investigations rely on correlating multiple log sources (SMTP, DNS, Sysmon, FTP, and endpoint logs).
Raw log analysis often reveals critical details that are not visible in parsed fields.
Combining SIEM tools with external platforms like VirusTotal and Hybrid Analysis significantly enhances investigation depth.
Recognizing common attacker techniques such as: Ransomware file extensions, Phishing attachments, Dynamic DNS usage and PowerShell obfuscation is essential for real-world SOC roles.

Conclusion

This second part of the investigation highlights more advanced SOC analysis techniques, including malware triage, ransomware investigation, threat intelligence correlation, and persistence detection.

By combining Splunk log analysis with external threat intelligence tools, I was able to reconstruct attacker behavior, identify C2 infrastructure, and uncover persistence mechanisms — key skills for any SOC analyst.

About Me

I’m an aspiring SOC Analyst actively seeking an entry-level role, focused on developing practical, hands-on experience in:

SIEM analysis with Splunk
Threat detection and incident investigation
Log correlation across multiple data sources

I regularly practice and document real-world scenarios from platforms like TryHackMe to strengthen my blue team skills.

If you’re a recruiter or security professional, feel free to connect with me or reach out — I’m always open to opportunities and feedback.