root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to TryHackMe writeups
root@sparrow:~/writeups$ cat invite-only.md
// Blue Team & SOC

Invite Only

19 Aug 2024 · 11 min read
Blue Team & SOCwriteupstryhackmeEasy
In Invite Only you play a SOC analyst at the Managed Server Provider TrySecureMe. An L1 analyst escalates two suspicious indicators —an IP address and a SHA256 hash— and your mission is to pivot on them using the in-house threat intelligence tool TryDetectThis2.0, reconstruct the attack chain, and extract actionable intelligence. The case blends file analysis, malware-family identification, and OSINT research into a single investigation.
PlatformTryHackMe
CategoryBlue Team & SOC — Threat Intelligence
DifficultyEasy
RoomInvite Only

Pivot map

[IP + SHA256] --> TryDetectThis2.0
      |
      v
syshelpers.exe (Win32 EXE)
      |
      v  parents (chronological)
361GJX7J --> installer.exe
      |                    |
      v drops              v drops
Aclient.exe          searchhost.exe, syshelpers.exe, nat.vbs, runsys.vbs
      |
      v  correlate across all IOCs
AsyncRAT (malware family)
      |
      v  OSINT
Check Point report: "From Trust to Threat..."
      |
      v  TTPs confirmed
ClickFix (delivery) + hijacked Discord invites (redirection) + ChromeKatz (cookie theft)

Task 1 — File identification

The first step in any hash-driven investigation is resolving the indicator to a concrete artifact. Feeding the flagged SHA256 into TryDetectThis2.0 maps it to an executable named syshelpers.exe. This is the first suspicious artifact in the chain.

Q: What is the name of the file identified with the flagged SHA256 hash?
A: syshelpers.exe

Task 2 — File type

Metadata for the same hash reveals it is a Win32 EXE, i.e. a Windows executable. Confirming the file type matters: it steers the rest of the analysis (runtime behavior, parent/child processes) and rules out decoys such as documents or scripts.

Q: What is the file type associated with the flagged SHA256 hash?
A: Win32 EXE

Task 3 — Execution parents

Analyzing the execution lineage (which process spawned which) lets us trace the infection back to its origin. The flagged binary was executed by two parent processes, in chronological order: first 361GJX7J, then installer.exe. Note the parent hashes too, so you can keep pivoting.

Q: What are the execution parents of the flagged hash? List the names chronologically, using a comma as a separator.
A: 361GJX7J,installer.exe

Task 4 — Dropped file

Following the trail of installer.exe, we see it drops another malicious file named Aclient.exe. Dropped files typically act as a payload or a persistence mechanism within a campaign. Record its hash — it will be useful in later steps.

Q: What is the name of the file being dropped? Note down the hash value for later use.
A: Aclient.exe

Task 5 — Malicious dropped files

Investigating the second parent hash from Task 3 shows it is responsible for dropping several malicious files: two executables (searchhost.exe, syshelpers.exe) and two VBScript files (nat.vbs, runsys.vbs). This variety reflects the attacker's multi-layered approach to execution and persistence.

Q: Research the second hash in question 3 and list the four malicious dropped files in the order they appear (from top to bottom), separated by commas.
A: searchhost.exe,syshelpers.exe,nat.vbs,runsys.vbs

Task 6 — Malware family

Correlating every file and behavior tied to the flagged IP, the evidence converges on the AsyncRAT family. AsyncRAT is a remote access trojan (RAT) widely used for persistence, remote control, and data theft.

Q: Analyse the files related to the flagged IP. What is the malware family that links these files?
A: asyncrat

Beyond the room: AsyncRAT isn't a bespoke tool built for this campaign — it's a legitimate, open-source .NET remote administration tool published on GitHub (by the developer "NYAN-x-CAT") since 2019. Its public source code is exactly what makes it attractive to criminals: anyone can recompile it with a custom build, tweak strings and imports to dodge signature-based detection, and bolt on plugins, all without writing a RAT from scratch. That is why AsyncRAT keeps surfacing across unrelated campaigns years after its original release.

Task 7 — Original report

The OSINT phase is about searching public sources for these indicators to attribute the campaign. The IOCs were originally documented in the report "From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery", which describes how attackers abused hijacked Discord invites to deliver malware in multiple stages.

Q: What is the title of the original report where these flagged indicators are mentioned?
A: From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

The report reveals the attackers used ChromeKatz, a tool purpose-built to extract browser cookies. With session cookies in hand, the adversary can perform session hijacking and access the victim's accounts without needing credentials.

Q: Which tool did the attackers use to steal cookies from the Google Chrome browser?
A: ChromeKatz

Beyond the room: The detail worth knowing is why a tool like ChromeKatz is needed at all: since Chrome 127 (2024), Google ties cookie-decryption keys to the browser's own binary via "App-Bound Encryption" (ABE), so stealing the encryption key alone is no longer enough — decryption has to go through a privileged Chrome service. Tools in the ChromeKatz family sidestep this by reading the already-decrypted cookies straight out of the browser process's memory at runtime, instead of attacking the encryption itself — a cat-and-mouse pattern seen across most 2025-era infostealer families after ABE shipped.

Task 9 — Phishing technique

The identified phishing technique is ClickFix, a social-engineering method that tricks the user into performing malicious actions or clicks (typically pasting and running a command presented as the "fix" for a fake error). It makes it easier to funnel unsuspecting victims toward the payloads.

Q: Which phishing technique did the attackers use?
A: ClickFix

Beyond the room: ClickFix's trick is entirely social, not technical: a fake CAPTCHA or "verification" page tells the visitor their browser needs a manual fix, then walks them through pressing Win+R, pasting with Ctrl+V, and hitting Enter. The clipboard content was silently written by the page's own JavaScript beforehand; what the victim sees on screen (a friendly "verification passed" message) has nothing to do with the PowerShell or mshta command that actually runs. Because the user types nothing and personally executes the "fix", the technique bypasses the instinct to distrust unsolicited downloads or attachments.

Task 10 — Platform used for redirection

The attackers abused Discord as their redirection platform. Legitimate-looking Discord invites were hijacked and repurposed to steer users into the attacker's infrastructure.

Q: What is the name of the platform that was used to redirect a user to malicious servers?
A: Discord

Beyond the room: The mechanism behind the Discord abuse is a quirk of the invite system itself: custom ("vanity") invite links that expire or get deleted become available again for anyone to claim, including attackers. By registering a released invite code, criminals can make an old, previously trusted link — one a victim may have bookmarked or received months earlier — silently point to a completely different, malicious server, with no visible change in the URL. It is link-hijacking that exploits trust in a URL the user has already vetted once, not a breach of Discord's own infrastructure.

IOC and findings summary

TypeIndicator / findingRole in the chain
Executablesyshelpers.exe (Win32 EXE)Initial artifact tied to the flagged hash
Parent processes361GJX7J → installer.exeExecution lineage of the infection
Dropped fileAclient.exePayload / persistence dropped by installer.exe
Dropped filessearchhost.exe, syshelpers.exe, nat.vbs, runsys.vbsMulti-layered execution and persistence
Malware familyAsyncRATRAT: remote control, persistence, data theft
ToolChromeKatzCookie theft → session hijacking
TechniqueClickFix (phishing)Social engineering for delivery
PlatformDiscord (hijacked invites)Redirection to malicious infrastructure

Key takeaways

  • The value of a SOC investigation lies in pivoting across IOCs: from a single hash and IP you can rebuild an entire attack chain (parents, dropped files, family).
  • Process lineage and dropped files are the backbone for tracing an infection from its origin to the payload.
  • Combining internal telemetry (TryDetectThis2.0) with OSINT lets you attribute the campaign to a public report and to the AsyncRAT family.
  • Modern multi-stage delivery abuses legitimate platforms (Discord invites) and social engineering (ClickFix) to avoid suspicion.
  • Cookie theft with tools like ChromeKatz shows that active sessions are as valuable as credentials — and that browser hardening (like Chrome's App-Bound Encryption) only raises the bar, it doesn't remove the risk.