Welcome to this walkthrough of the Summit Room on TryHackMe.

 In this room we chase a simulated adversary up the Pyramid of Pain until they finally back down? This is a room to test the knowledge gained during the Cyber Defense Frameworks module.

This room is part of the SOC Level 1 Path.

Summit Room on TryHackMe

Room URL: https://tryhackme.com/r/room/summit

I am making these walkthroughs to keep myself motivated to learn cyber security, and ensure that I remember the knowledge gained by these challenges on HTB and THM.

Join me on learning cyber security. I will try and explain concepts as I go, to differentiate myself from other walkthroughs.

Now, let’s move on!

Sample1.exe and first email

Malware Sandbox

Manage hashes window

We can add the following MD5 hash:

cbda8ae000aa9cbe7c8b982bae006c2a

We get the following message:

Nice work! You prevented sample1.exe from executing by detecting its unique hash value. Check your inbox for the next steps.

A new mail has arrived, together with the flag:

Besides the previous flag, the mail mentions the following:

Hey again,

Good work. That detection you added blocked my malware from executing. Since file hashes and digests are unique to each file, they are, by far, the highest confidence indicators out there. You can be sure it’s my malware sample the next time you see that hash.

However, by design, that is also one of the significant downfalls of simply relying on hashes for detection mechanisms. Since they are so susceptible to change, I only need to alter a single bit of the file, and the detection rule you added will fail.

In fact, all I did this time was recompile the malware, and I generated a new file hash and executed it without issue. See if you can come up with a new way to detect sample2.exe !

Sphinx mentions that blocking file hashes is not the best method to defend ourselves, since hashes are so easily changed by simply changing a single bit in the file.

Let’s try and running Sample2.exe in the Malware Sandbox:

Sample2.exe results

We get different results now. We also see some information under Network Activity. As we can see the binary makes a suspicious request to the url with the ip: 154.35.10.113:4444. We should probably block that!

We can do this in the Firewall Rule Manager, again found in the menu!

Press the “Create Firewall Rule” button and you will see the following screen:

A new mail has arrived:

Huh.

It seems like you stopped me again. You must have found the IP address to which my malware sample connected. Clever!

This method isn’t bulletproof, though, as it’s trivial for a motivated adversary to get around it using a new public IP address. I just signed up for a cloud service provider and now have access to many more public IPs!

This time, you’ll need to detect sample3.exe another way. I already have my server running from a new IP address and have plenty more backups to failover in case they get blocked!

Good luck. 😈

As discussed by Sphinx, an attacker can easily use a new IP address, which will completely render our defenses useless.

Let’s look at sample3.exe by running it through the Malware Sandbox:

Sample3.exe results

Again, a lot of interesting results. The thing that stands out under HTTP Requests, Connections, and DNS requests is the suspicious URL emudyn.bresonicz.info

Luckily, we have access to the DNS Rule Manager in the menu.

Go there now, and press the “Create DNS Rule” button:

Enter your own Rule Name, Set the Category to “Malware”, enter the domain name emudyn.bresonicz.info, and set the Action to Deny.

DNS Rule Manager

You should see the rule added to the active rules:

Active rules overview

You should also have received a new email with the third flag:

Start by scanning the file:

Sample4.exe results

This is a type of artifact Sphinx mentioned. Copy the Key value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection

Now we have to use the Sigma Rule Builder section, again found in the menu.

Press Create Sigma Rule. On the next screen select Sysmon Event Logs, followed by Registry Modifications.

Hey.

I’m not sure what you managed to do this time, but you seriously threw a wrench into my malware sample! I spent ages trying to reconfigure my attack tools and methodologies to get around your detection – SUPER ANNOYING!

Having my team develop new techniques used in my adversary tools was a time-consuming effort and a significant cost. It’s good that we have a substantial budget for this engagement, but many threat actors would have given up and found a new victim by now.

I finally have sample5.exe for you to detect. Different approach this time. In this sample, all of the “heavy lifting” and instruction occurs on my back-end server, so I can easily change the types of protocols I use and the artifacts I leave on the host. You’ll have to find something unique or abnormal about the behaviour of my tool to detect it.

I attached the logs of the outgoing network connections from the last 12 hours on the victim machine. That may help you correlate something.

I don’t know what to do if you can stop me at this level.

So, we need to look at the logs of the outgoing network connections!

Let’s open the binary in the Attachment Viewer.

Attachment Viewer

A few things stand out. Every half an hour there is an outgoing connection to 51.102.10.19, with a size of 97 byes. In addition, there are 2 connections made to port 80 that look different from the other connections on port 443. As you might know, port 80 is made over HTTP, while port 443 is the more secure HTTPS. But that could just be regular web server requests. So let’s focus on the frequent connections of 97 bytes made every 30 minutes.

It’s time to go to the Sigma Rule Builder again. This time select Sysmon Event Logs, followed by Network Connections.

A final challenge from Sphinx:

Hello again,

You managed to detect sample5.exe ! I’m very impressed. But also very annoyed! Because now, I need to go back to the drawing board and create a brand new tool to do what I need to do. If I can’t find another one quickly, this will be another significant investment. Also, I will need to train myself all over again on how to use it!

I can keep this up one or two times, but there’s no way I can continue after this. The reward no longer outweighs the cost, and I would instead find an easier target with detection capabilities much lower on the pyramid.

For my last trick, I have sample6.exe. This time, you will need more than artifacts or tool detection to help you. You’ll need to focus on something extremely hard for me to change subconsciously – my techniques and procedures.

I’ve attached the recorded command logs from all my previous samples to understand better what actions I tend to perform on my victims to extract info once I have remote access. Good luck!

So, according to Sphinx we need to focus on his techniques and procedures.

You might remember from the Pyramid of Doom room that the final stage of the pyramid is the TTP stage. TTPs stands for Tactics, Techniques & Procedures. This includes the whole MITRE ATT&CK Matrix, which means all the steps taken by an adversary to achieve his goal, starting from phishing attempts to persistence and data exfiltration.

We have received a commands.log file:

Commands.log file

The log file seems to show a bunch of commands that are run and written to a exfiltration log file called exfiltr8.log.

This sounds like the Automated Exfiltration technique: https://attack.mitre.org/techniques/T1020/

It time for the Sigma Rule Builder again, which should allow us to block the creation of the exfiltration file.

Choose the following options: Sysmon Event Logs > File Creation and Modification:

A final sigma rule created!

Then write %temp% as File Path, exfiltr8.log as filename, and Exfiltration (TA0010) as ATT&CK ID.

Validate the rule, and you should get a new mail with the final flag!

And we defeated Sphinx:

Well, that’s it. I have officially given up.

Throughout the engagement, you managed to chase me to the very top of the Pyramid of Pain, and I have to say, it’s not fun up here!

You detected my samples file hashes, IPs, domains, host artifacts, tools, and now my own behavioural techniques! To continue, I have no choice but to completely retrain myself and conduct extensive research to figure out how you’re catching me. And with that, I don’t think you’ll ever see me again. Enjoy the final flag; you’ve earned it!

---

Congratulations on completing Summit!!!

We completed Summit!!!

This was a great room! The past few rooms on the Cyber Defense Frameworks were pretty theoretical, and I found that this room really put the theory into practice.
This made it stick in my head, and I really enjoyed the CTF like challenge, even though I am more used to red-team type CTFs.

---

Like my articles?

You are welcome to give my article a clap or two 🙂
I would be even more grateful if you support me by buying me a cup of coffee:

Buy me a coffee

I learned a lot through HackTheBox’s Academy. If you want to sign up, you can get extra cubes, and support me in the process, if you use the following link:

https://referral.hackthebox.com/mzwwXlg