Blizzard

Walkthrough summary

Blizzard TryHackMe walkthrough with 15 answered prompts and lab methodology notes.

Sample prompts covered

• When did the attacker access this machine from another internal machine? (format: MM/DD/YYYY HH:MM:SS)
  Open the walkthrough page to inspect the full answer and command flow.
• What is the full file path of the binary used by the attacker to exfiltrate data?
  Open the walkthrough page to inspect the full answer and command flow.
• What email is used by the attacker to exfiltrate sensitive data?
  Open the walkthrough page to inspect the full answer and command flow.
• Where did the attacker store a persistent implant in the registry? Provide the registry value name.
  Open the walkthrough page to inspect the full answer and command flow.
• Aside from the registry implant, another persistent implant is stored within the machine. When did the attacker implant the alternative backdoor? (format: MM/DD/YYYY HH:MM:SS)
  Open the walkthrough page to inspect the full answer and command flow.