czabatta/thm-tempestTryHackMe SOC Level 1 — Follina CVE-2022-30190, Nim C2, Chisel, PrintSpoofer, backdoor accounts
SOC Level 1 Pathway | Incident Response Investigation
Full incident response investigation of a compromised Windows machine. The attacker gained initial access via a malicious Word document exploiting CVE-2022-30190 (Follina), established persistence, tunneled through the network using Chisel, escalated privileges via PrintSpoofer, and created backdoor accounts with a persistent malicious service.
Timeframe: June 20–21, 2022
Tools: EvtxEcmd, Timeline Explorer, Wireshark, Brim, Sysmon
Victim Host: TEMPEST | User: benimaru
| # | Stage | TTP |
|---|---|---|
| 1 | Initial Access | Malicious .doc via Chrome — CVE-2022-30190 (Follina) |
| 2 | Payload Delivery | PowerShell stager dropped to Startup folder |
| 3 | Execution & Persistence | certutil downloaded first.exe — executes on every login |
| 4 | C2 Communications | Nim-based binary beaconing to resolvecyber.xyz:80 via HTTP/Base64 |
| 5 | Discovery | Internal recon via decoded C2 traffic — found credentials and open ports |
| 6 | Tunneling & Lateral Movement | Chisel reverse socks proxy + WinRM via harvested credentials |
| 7 | Privilege Escalation | PrintSpoofer exploiting SeImpersonatePrivilege → SYSTEM |
| 8 | Persistence (SYSTEM) | Backdoor accounts shion/shuna + TempestUpdate2 malicious service |
See Tempest_Attack_Chain.pdf for the full analysis including artifact hashes and IOC table.
TryHackMe SOC Level 1 Pathway — Tempest | Analyst: czabatta
| Type | Value |
|---|
| File | free_magicules.doc |
| IP | 167.71.199.191 |
| URL | hxxp://phishteam[.]xyz/02dcf07/index.html |
| URL | hxxp://phishteam[.]xyz/02dcf07/first.exe |
| Domain:Port | resolvecyber[.]xyz:80 |
| SHA256 | CE278CA242AA2023A4FE04067B0A32FBD3CA1599746C160949868FFC7FC3D7D8 (first.exe) |
| SHA256 | 8A99353662CCAE117D2BB22EFD8C43D7169060450BE413AF763E8AD7522D2451 (ch.exe — Chisel) |
| SHA256 | 8524FBC0D73E711E69D60C64F1F1B7BEF35C986705880643DD4D5E17779E586D (spf.exe — PrintSpoofer) |
| Accounts | shion, shuna |
| Service | TempestUpdate2 |
| Event ID | 4720 (account creation), 4732 (added to admins) |
| ID | Technique |
|---|
| T1566.001 | Phishing: Spearphishing Attachment |
| T1203 | Exploitation for Client Execution (CVE-2022-30190) |
| T1059.001 | Command & Scripting: PowerShell |
| T1547.001 | Boot Autostart: Startup Folder |
| T1105 | Ingress Tool Transfer |
| T1071.001 | C2: Web Protocols |
| T1090 | Proxy: Reverse Socks Proxy (Chisel) |
| T1078 | Valid Accounts |
| T1134 | Access Token Manipulation (PrintSpoofer) |
| T1136.001 | Create Account: Local Account |
| T1098 | Account Manipulation |
| T1543.003 | Create/Modify System Process: Windows Service |
