Shadow TraceShadow Trace

What This Room Covers

A complete static malware analysis challenge: analyzing windows-update.exe using DFIR tools on the VM, extracting IOCs, identifying capabilities from imports, and correlating EDR alerts to trace the infection chain.

Key Concepts Learned

The scenario: a manager calls during night shift: a suspicious file was found on a user's machine. The task is to analyze it immediately, identify what it does, extract IOCs, and correlate related alerts.

Static analysis workflow using pestudio pestudio is a Windows GUI tool for PE (Portable Executable) analysis:

1. Open pestudio → drag the suspicious file in
2. Check architecture, file hash, compile timestamp
3. Review strings: look for URLs, IP addresses, file paths, registry keys
4. Review imports: what DLLs does it load? What capabilities does that reveal?
5. Check indicators tab: pestudio flags suspicious strings and imports automatically

The file windows-update.exe: what analysis revealed

• Architecture: 64-bit PE
• SHA-256: B2A88DE3E3BCFAE4A4B38FA36E884C586B5CB2C2C283E71FBA59EFDB9EA64BFC
• Embedded URL: http://tryhatme.com/update/security-update.exe (download cradle: downloads next-stage payload)
• C2 domain: responses.tryhatme.com
• Library for socket communication: WS2_32.dll (Windows Socket API: confirms network capability)

Typosquatting: the domain deception tryhatme.com vs tryhackme.com: one character different. This is typosquatting, used to make the malware's C2 domain look like a legitimate, trusted site to users and analysts doing quick checks. Recognizing typosquatted domains requires careful character-by-character comparison.

IOC extraction from static analysis From this one file, four IOCs were extracted:

• File hash (SHA-256)
• Embedded download URL
• C2 domain
• Referenced DLL indicating network capability

These can be immediately added to SIEM detection rules and threat intel platforms.

Alert correlation: Part 2 of the room Two EDR alerts were analyzed:

• powershell.exe connecting to https://tryhatme.com/dev/main.exe: PowerShell download cradle, LoL technique
• chrome.exe connecting to https://reallysecureupdate.tryhatme.com/update.exe: browser-based download, file saved as test.txt

The chrome.exe alert shows the download=test.txt parameter: the file was saved with a disguised name, a common technique to evade file extension-based detection.

Task Answers

Key Concepts for SOC Work

WS2_32.dll in imports = network capability confirmed. Any PE that imports the Windows Socket library can establish network connections: this is always worth flagging during static analysis and cross-referencing with network logs to see if the binary actually communicated.

Typosquatting detection requires careful domain inspection. Automated tools help but human review of unfamiliar domains character-by-character is still necessary. responses.tryhatme.com looks completely legitimate at a glance. The habit of checking domain registration age and comparing carefully against known legitimate domains is what catches these.

This room directly applies to my threat intel reports. The IOC extraction workflow: hash → VirusTotal → strings analysis → domain investigation: is exactly the process used when building APT36 IOC tables. Shadow Trace made that abstract process concrete with a hands-on example.