THM SOC Simulator: Investigating a Phishing Attack

By Mahmoud Abdelmaged (0x2Glitch)

Hello everyone, After completing 33% of the SOC Level 1 Path on TryHackMe, I decided to start applying what I have learned so far.

During the first five sections, I learned the fundamentals of SOC operations, alert triage, phishing analysis, and investigation techniques. Now, I want to put these skills into practice by analyzing an alert, investigating the available evidence, and determining what actually happened from a SOC analyst’s perspective.

Alert Overview

I reviewed all the alerts before starting the investigation and noticed that they all had the same severity level.

Since there was no difference in severity, I did not need to apply alert prioritization. Instead, I focused on investigating the alerts based on their timeline and relationship to each other.

After reviewing the alerts, I decided to focus on Michael, as he is the CEO of the company, making his account a high-value target for attackers.

The Alert

This was the alert I received during the investigation. It reported a suspicious attachment found in an email sent to Michael, the CEO.

The email used an urgent payment-related subject and included a ZIP attachment named ImportantInvoice-Febary.zip, which immediately made it worth investigating further.

Investigation Approach

To investigate this alert, I started by analyzing the email and its attachment, then used the available logs and SIEM data to identify any related suspicious activity.

I followed the evidence step by step to build a timeline and determine whether the alert was a True Positive or False Positive.

SIEM Investigation

I searched the SIEM for the sender to check whether the email was sent to other users. The results showed that Michael, the CEO, was the only recipient.

This suggested that the email was targeted phishing (spear phishing) rather than a broad phishing campaign.

I then extracted the relevant Indicators of Compromise (IoCs) from the logs and used them to continue the investigation.

Attachment Analysis

After collecting the initial indicators from the email and SIEM logs, the next step was to analyze the attachment.

I opened and examined the attachment using the Analyst VM to determine its contents and identify any additional indicators that could help continue the investigation.

Collected Indicators

After analyzing the email and its attachment, I collected the following indicators:

Email Indicators

• Timestamp: 08/15/2026 13:12:50.616
• Subject: FINAL NOTICE: Overdue Payment - Account Suspension Imminent
• Sender: john@hatmakereurope.xyz
• Recipient: michael.ascot@tryhatme.com
• Attachment: ImportantInvoice-Febrary.zip
• Technique: Social Engineering / Phishing

Archive Hashes (ImportantInvoice-Febrary.zip)

• SHA-256: 145BB70ABD0CC625F4A7ADD8CFB08982C39C4573470C8B87DB41D755BD2F9EA0
• SHA-1: AB600FBDD35D0E163582AD8D262B42CF8766CCF0
• MD5: 332FFB18AA5C12126E4BEFD02388A6BE

LNK File — invoice.pdf.lnk

The archive contained a suspicious file named invoice.pdf.lnk. The file appeared to be a PDF based on its name, but its actual extension was **.lnk**, which is a Windows shortcut file.

I also calculated its hashes:

• MD5: ed1dc2d678743fcbedf0d743e27d0362
• SHA-1: 1515b10b441acf4e789cc37eaf979bb576157d83
• SHA-256: 50e5bf8361df2442546f21e08b1561273f4ccc610258f622ac1a4b8ebf0a0386

At this point, I have collected the main indicators from the email and attachment. The next step is to pivot back to the SIEM and search for any activity related to these indicators.

Malicious Execution Chain

The investigation took a significant turn when I reviewed the process creation events after the suspicious LNK file was extracted.

At 13:33:08.616, Explorer.EXE accessed the extracted invoice.pdf.lnk file. One second later, at 13:33:09.616, Explorer.EXE spawned powershell.exe.

The PowerShell command line revealed highly suspicious activity. It used System.Net.WebClient to download powercat.ps1 from GitHub and then connected to 2.tcp.ngrok.io on port 19282.

This confirmed that the LNK file was not simply extracted or accessed. It led to the execution of a PowerShell command that established communication with an external service.

After this, several discovery commands were executed, including whoami.exe, systeminfo.exe, and net.exe user. These commands indicate that the attacker was gathering information about the compromised system and its users.

Later, Robocopy.exe was executed from PowerShell to copy files from the user's Downloads directory to another location, which is consistent with data collection and potential exfiltration.

At this point, the evidence strongly indicates that the phishing attachment resulted in malicious execution on the victim’s machine.

Escalation

Based on the evidence collected during the investigation, I classified this alert as a True Positive and decided to escalate the incident for further investigation and response.

The investigation confirmed that the phishing attachment led to the execution of a malicious LNK file, followed by PowerShell activity, external C2 communication, and multiple discovery commands.

I would escalate the incident to the SOC L2 / Incident Response team to contain the affected host, investigate the scope of the compromise, and determine whether any data was exfiltrated.

Escalation Reasons:

• Malicious LNK execution
• PowerShell execution
• C2 communication through ngrok
• System and user discovery
• Potential data collection/exfiltration

Verdict: True Positive — Confirmed Phishing Attack with Host Compromise.