The Last Trial | TryHackMe | Walkthrough

https://tryhackme.com/room/thelasttrial

What was the website from which the user downloaded the malicious application’s installer?

developai.thm

1. Mounting an APFS disk image on Linux using .

apfs-fuse -v 4 /home/ubuntu/Lucas_Disk.img /home/ubuntu/mac_mount/

• → tool that lets Linux read Apple’s APFS (Apple File System) • → select volume number 4 inside the APFS container (APFS can hold multiple volumes)

2. You will notice two folders: private-dir and root. Our folder of interest is root, as it contains the forensic artefacts we need.

3. Use this command check which web browsers are present on the system by listing files and directories and filtering for names that match Chrome, Safari, or Firefox.

ls -alh | grep -Ei "chrome|safari|firefox"

• → lists all files and directories in the current location with details (permissions, size, date). • → pipes the output of into the next command. • → searches the output for any lines containing “chrome,” “safari,” or “firefox.” • enables extended regular expressions (so we can use the OR operator). • makes the search case-insensitive.

4 The clue is “Lucas, always interested in researching to enhance his development skills, stumbled upon a free trial of an development tool while browsing online. Who knew this would be Lucas’s last experiment with the deceptive software trials?” Then we use sqlite3to open and query it. Filter results for entries containing “AI” to find relevant browsing history.

sqlite3 Safari/History.db
SELECT * FROM history_items WHERE url LIKE '%AI%';

What is the name of the malicious application’s installer?

DevelopAIInstaller.pkg

if we’checked lucas Downloads folder. there was no malicious installer present, indicating that it was likely deleted.

Apple Property List (.plist) files generally come in two formats: plaintext plist and binary plist (bplist). • Plaintext plist → you can view directly with commands like . • Binary plist → requires external tools to properly read the contents. In this case, you used plistutil to parse the file.

plistutil -i Safari/Downloads.plist

When was the malicious application installed in the system? Answer Format Example: 2025–01–15 12:30:45

2025-07-04 10:09:03

Although we can obtain the download timestamp from , the question asks for the application execution (installation) timestamp. On macOS, the most authoritative source for this information is installer receipts. Let’s change the directory to and list the files. You will find two files related to . Each installed software package has both a .bom (Bill of Materials) file and a .plist file. On macOS, the modification time of receipt files typically corresponds to the application’s installation time.

Downloads.plistshows when something was downloaded, but to prove when the app was actually installed/executed, you check the installer receipts in /var/db/receipts/. The timestamps on those .bomand .plistfiles give you the installation time.

Which TCC permission did the application request first?

kTCCServiceSystemPolicyDesktopFolder

TCC (Transparency, Consent, and Control) is Apple’s security framework that manages how applications request and are granted access to sensitive system resources such as location, contacts, photos, microphone, camera, and full disk access. It ensures that users explicitly approve or deny these permissions, and the records are stored in the TCC.db database.

On macOS, TCC permissions are recorded in multiple databases: one system-wide database and separate databases for each user. In this case, we will examine Lucas’s TCC database.

sqlite3 /home/ubuntu/mac_mount/root/Users/lucasrivera/Library/Application\ Support/com.apple.TCC/TCC.db

select * from access where client like '%AI%';

What is the full C2 URL to which the application exfiltrated data?

http://c7.macos-updatesupport.info:8080

There are several places on macOS where this information can be found, such as Apple Unified Logs. However, I’ll begin with a simpler investigative step by examining the binary’s strings. In some cases, C2 (Command and Control) addresses are hardcoded directly into the malware.

Let’s move to the Applications directory and recursively search for HTTP and HTTPS strings.

grep -Eir 'http|https' 2>/dev/null

• -E→ use extended regular expressions. • -i→ case‑insensitive search. • -r→ search recursively through subdirectories. • 'http|https'→ look for strings containing either “http” or “https”. • 2>/dev/null→ suppress error messages by redirecting them to .

/home/ubuntu/mac_mount/root/Applications/DevelopAI.app#

Which persistence mechanism did the application use?

LaunchAgents

On macOS, malware often tries to stay persistent (so it runs again after reboot). The common persistence methods are: • LaunchAgents • LaunchDaemons • Login Items • Cron/At jobs (rare nowadays) For apps installed via a file, like DevelopAI, the usual persistence method is LaunchAgents. These LaunchAgents are stored in three main places: • System Library • Local Library • User Library To find them, you can run:

find /home/ubuntu/mac_mount/root -type d -name "LaunchAgents"

we discover a script called DevelopAI.sh.

Inside this script, the malware secretly steals private keys, credentials, and documents, hides them in a compressed folder, and then uploads them to a remote server. It disguises this activity as an “AI analysis” process.