Windows Applications Forensics

Walkthrough summary

Windows Applications Forensics TryHackMe walkthrough with 16 answered prompts and lab methodology notes.

Sample prompts covered

• Who created the malicious scheduled tasks?
  Open the walkthrough page to inspect the full answer and command flow.
• Based on the ones discovered from the logs, what URL is accessed by this malicious scheduled task? (format: defanged URL)
  Open the walkthrough page to inspect the full answer and command flow.
• Based on the logs, what is the name of the malicious service?
  Open the walkthrough page to inspect the full answer and command flow.
• Aside from the scheduled tasks from Windows Event Logs, what does the second malicious scheduled task execute?
  Open the walkthrough page to inspect the full answer and command flow.
• Based on Q1, what time does the second malicious task execute daily? (format: HH:MM, e.g. 18:30)
  Open the walkthrough page to inspect the full answer and command flow.