Conti

Walkthrough summary

Conti TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• Can you identify the location of the ransomware?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the Sysmon event ID for the related file creation event?
  Open the walkthrough page to inspect the full answer and command flow.
• Can you find the MD5 hash of the ransomware?
  Open the walkthrough page to inspect the full answer and command flow.
• What file was saved to multiple folder locations?
  Open the walkthrough page to inspect the full answer and command flow.
• What was the command the attacker used to add a new user to the compromised system?
  Open the walkthrough page to inspect the full answer and command flow.