Friday Overtime |TryHackMe-CTF — Write-Up

description: Step into the shoes of a Cyber Threat Intelligence Analyst and put your investigation skills to the test.

link for the room challenge :https://tryhackme.com/room/fridayovertime

Disclaimer

Please note: The artefacts used in this scenario were retrieved from a real-world cyber-attack. Hence, it is advised that interaction with the artefacts be done only inside the attached VM, as it is an isolated environment.

Hello Busy Weekend. . .

It’s a Friday evening at PandaProbe Intelligence when a notification appears on your CTI platform. While most are already looking forward to the weekend, you realise you must pull overtime because SwiftSpend Finance has opened a new ticket, raising concerns about potential malware threats. The finance company, known for its meticulous security measures, stumbled upon something suspicious and wanted immediate expert analysis.

As the only remaining CTI Analyst on shift at PandaProbe Intelligence, you quickly took charge of the situation, realising the gravity of a potential breach at a financial institution. The ticket contained multiple file attachments, presumed to be malware samples.

With a deep breath, a focused mind, and the longing desire to go home, you began the process of:

1. Downloading the malware samples provided in the ticket, ensuring they were contained in a secure environment.
2. Running the samples through preliminary automated malware analysis tools to get a quick overview.
3. Deep diving into a manual analysis, understanding the malware’s behaviour, and identifying its communication patterns.
4. Correlating findings with global threat intelligence databases to identify known signatures or behaviours.
5. Compiling a comprehensive report with mitigation and recovery steps, ensuring SwiftSpend Finance could swiftly address potential threats.

Connecting to the machine:

step 1- you will hit the green start machine button to deploy your machine

step 2- enter the credentials that was given in the log in page as shown below

now you have it .. lets start with our first question.

Q1- Who shared the malware samples?

at the bottum of the email the sender name is clearly mentioned as shown below :

ANS: Oliver Bennett

Q2- What is the SHA1 hash of the file “pRsm.dll” inside samples.zip?

to get the hash we will have to doenload the attached file and then unzip it using commandline as shown below

press on samples.zip to download the file as shown below

commands :

1- cd Downloads

2- unzip samples.zip

3- sha1sum pRsm.dll

ANS: 9d1ecbbe8637fed0d89fca1af35ea821277ad2e8

Q3- Which malware framework utilizes these DLLs as add-on modules?

i cross refrenced the hash we got on virus total first and then made a quick google search with the dll name to make sure of our findings and it turned out to be mgbot as shown below

the google search lead me to this CTI platform :

ANS: mgbot

Q4- Which MITRE ATT&CK Technique is linked to using pRsm.dll in this malware framework?

with in the same article’s MITRE ATT&CK section, pRsm.dll is tied with a technique for audio capture as shown below :

ANS: T1123

Q5- What is the CyberChef defanged URL of the malicious download location first seen on 2020–11–02?

within the same artical on we live security CTI platform the malicious url is stated as shown below :

using cyberchef to defang the url

ANS: hxxp[://]update[.]browser[.]qq[.]com/qmbs/QQ/QQUrlMgr_QQ88_4296.exe

Q6- What is the CyberChef defanged IP address of the C&C server first detected on 2020–09–14 using these modules?

with in the same artical in network section we can see the ip address with the date mentioned in the question as shown below :

now we will defang it using the recipe defang ip address in cyberchef :

ANS: 122[.]10[.]90[.]12

Q7- What is the md5 hash of the spyagent family spyware hosted on the same IP targeting Android devices in Jun 2025?

going to virus total and searching with the ip found in the last question

and then going to the relation tab to find the Communicating Files

we see the last entry is android type which is the one we are looking for and beside it our desired hash for the question

ANS: 951F41930489A8BFE963FCED5D8DFD79

Honestly this one was easier than I expected going in. The first part took me a little while to find my footing, but once I found the article on We Live Security everything clicked and it was pretty straightforward from there.. See you in the next one! 👋