Invite Only — THM Writeup | The Hack Sparrow

In Invite Only you play a SOC analyst at the Managed Server Provider TrySecureMe. An L1 analyst escalates two suspicious indicators —an IP address and a SHA256 hash— and your mission is to pivot on them using the in-house threat intelligence tool TryDetectThis2.0, reconstruct the attack chain, and extract actionable intelligence. The case blends file analysis, malware-family identification, and OSINT research into a single investigation.

Platform	TryHackMe
Category	Blue Team & SOC — Threat Intelligence
Difficulty	Easy
Room	Invite Only

Pivot map

[IP + SHA256] --> TryDetectThis2.0
      |
      v
syshelpers.exe (Win32 EXE)
      |
      v  parents (chronological)
361GJX7J --> installer.exe
      |                    |
      v drops              v drops
Aclient.exe          searchhost.exe, syshelpers.exe, nat.vbs, runsys.vbs
      |
      v  correlate across all IOCs
AsyncRAT (malware family)
      |
      v  OSINT
Check Point report: "From Trust to Threat..."
      |
      v  TTPs confirmed
ClickFix (delivery) + hijacked Discord invites (redirection) + ChromeKatz (cookie theft)

En Invite Only asumes el rol de analista SOC en el proveedor de servidores gestionados TrySecureMe. Un analista L1 escala dos indicadores sospechosos —una IP y un hash SHA256— y tu misión es pivotar sobre ellos con la herramienta interna de threat intelligence TryDetectThis2.0, reconstruir la cadena de ataque y extraer inteligencia accionable. El caso combina análisis de ficheros, identificación de familia de malware e investigación OSINT en una sola pieza.

Plataforma	TryHackMe
Categoría	Blue Team & SOC — Threat Intelligence
Dificultad	Easy
Room	Invite Only

Mapa de pivote

[IP + SHA256] --> TryDetectThis2.0
      |
      v
syshelpers.exe (Win32 EXE)
      |
      v  padres (orden cronológico)
361GJX7J --> installer.exe
      |                    |
      v suelta             v suelta
Aclient.exe          searchhost.exe, syshelpers.exe, nat.vbs, runsys.vbs
      |
      v  correlación de todos los IOCs
AsyncRAT (familia de malware)
      |
      v  OSINT
Informe Check Point: "From Trust to Threat..."
      |
      v  TTPs confirmadas
ClickFix (entrega) + invitaciones de Discord secuestradas (redirección) + ChromeKatz (robo de cookies)

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account