Hunter Blue Team Challenge

What is the computer IP?

What was the DHCP LeaseObtainedTime?

What is the computer SID?

What is the Operating System(OS) version?

What was the computer timezone?

How many times did this user log on to the computer?

When was the last login time for the discovered account? Format: one-space between date and time

There was a “Network Scanner” running on this computer, what was it? And when was the last time the suspect used it? Format: program.exe,YYYY-MM-DD HH:MM:SS UTC

When did the port scan end? (Example: Sat Jan 23 hh:mm:ss 2016)

How many ports were scanned?

What ports were found "open"?(comma-separated, ascending)

What was the version of the network scanner running on this computer?

The employee engaged in a Skype conversation with someone. What is the skype username of the other party?

What is the name of the application both parties agreed to use to exfiltrate data and provide remote access for the external attacker in their Skype conversation?

What is the Gmail email address of the suspect employee?

It looks like the suspect user deleted an important diagram after his conversation with the external attacker. What is the file name of the deleted diagram?

The user Documents' directory contained a PDF file discussing data exfiltration techniques. What is the name of the file?

What was the name of the Disk Encryption application Installed on the victim system? (two words space separated)

What are the serial numbers of the two identified USB storage?

One of the installed applications is a file shredder. What is the name of the application? (two words space separated)

How many prefetch files were discovered on the system?

How many times was the file shredder application executed?

Using prefetch, determine when was the last time ZENMAP.EXE-56B17C4C.pf was executed?

A JAR file for an offensive traffic manipulation tool was executed. What is the absolute path of the file?

The suspect employee tried to exfiltrate data by sending it as an email attachment. What is the name of the suspected attachment?

Shellbags shows that the employee created a folder to include all the data he will exfiltrate. What is the full path of that folder?

The user deleted two JPG files from the system and moved them to $Recycle-Bin. What is the file name that has the resolution of 1920x1200?

Provide the name of the directory where information about jump lists items (created automatically by the system) is stored?

Using JUMP LIST analysis, provide the full path of the application with the AppID of "aa28770954eaeaaa" used to bypass network security monitoring controls.