Pwned-DC blue team ctf

On 21st November, there was unplanned power off for PC01 machine. How long was PC01 powered on till this shutdown?

Who was the last logged-in user on PC01?

What is the IP address of PC01?

Which port was assigned to man service on PC01?

What is the "Business.xlsx" LogFile Sequence Number?

What is the GUID of the C drive on PC01 machine?

What link did the user visit on 2021-11-22 at 19:45:55 UTC?

How many bytes were received by firefox?

What is the folder name where note.txt resides?

Which volatility 2 profile should be used to analyze the memory image?

Analyzing the memory what is the physical address of the SOFTWARE registry hive?

What is the master key of the user "0xMohammed"?

Using the provided word list, what is the password of the user "0xMohammed"?

What is the name of the first malware detected by Windows Defender?

Provide the date and time when the attacker clicked send (submitted) the malicious email?

What is the IP address and port on which the attacker received the reverse shell? IP:PORT

Analyzing the reverse shell. What is the first argument given to InternetErrorDlg API?

What is the MITRE ID of the technique used by the attacker to achieve persistence?

What is the attacker's C2 domain name?

what is the name of the tool used by the attacker to collect AD information?

What is the PID of the malicious process?

What is the family of ransomware?

What is the command invoked by the attacker to download the ransomware?

Provide the number of ransomware process' privileges that are enabled by default?

What is the pool tag of the ransomware process?

What is the address where the ransomware stored the 567-byte key under the malicious process' memory?

What is the 8-byte word hidden in the ransomware process's memory?

What is the virtual address of the device where the ransomware file where opened?

What is the physical address where the ransomware file is stored in memory?

What is the ransomware file's internal name?

Analyzing the ransomware file. what is the API used to get the geographical location?