ItsyBitsy

Walkthrough summary

ItsyBitsy TryHackMe walkthrough with 7 answered prompts and lab methodology notes.

Sample prompts covered

• How many events were returned for the month of March 2022?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the IP associated with the suspected user in the logs?
  Open the walkthrough page to inspect the full answer and command flow.
• The user’s machine used a legit windows binary to download a file from the C2 server. What is the name of the binary?
  Open the walkthrough page to inspect the full answer and command flow.
• The infected machine connected with a famous filesharing site in this period, which also acts as a C2 server used by the malware authors to communicate. What is the name of the filesharing site?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the full URL of the C2 to which the infected host is connected?
  Open the walkthrough page to inspect the full answer and command flow.