Hints should be revelead in order.
If the issue is about how to solve the question, please use our Discord server.
| SHA1SUM | 88a22f6ad6d140c9151e6983b894c6eb6c64735d |
| Published | Oct. 5, 2020 |
| Author | Ali Hadi |
| Size | 595 MB |
| Tags | AccessData Windows Forensics Slack Web Browsers Registry Timeline Analysis |
| Instructions | Unzip the challenge (pass: cyberdefenders.org), examine the image, and answer the provided questions. |
Your progress
Your score
0/3150
Category
Windows Disk Image Forensics
Case Overview: The SOC team got an alert regarding some illegal port scanning activity coming from an employee's system. The employee was not authorized to do any port scanning or any offensive hacking activity within the network. The employee claimed that he had no idea about that, and it is probably a malware acting on his behalf. The IR team managed to respond immediately and take a full forensic image of the user's system to perform some investigations.
There is a theory that the user intentionally installed illegal applications to do port scanning and maybe other things. He was probably planning for something bigger, far beyond a port scanning!
It all began when the user asked for a salary raise that was rejected. After that, his behavior was abnormal and different. The suspect is believed to have weak technical skills, and there might be an outsider helping him!
Your objective is to analyze the image and to either confirm or deny this theory.
Supportive Tools:
| # | Question | Weight | Solved | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| #1 |
What is the computer name of the suspect machine? |
25 | 268 | ||||||||||||
|
|
|||||||||||||||
| #2 |
What is the computer IP? |
25 | 250 | ||||||||||||
|
|
|||||||||||||||
| #3 |
What was the DHCP LeaseObtainedTime? |
25 | 201 | ||||||||||||
|
|
|||||||||||||||
| #4 |
What is the computer SID? |
50 | 223 | ||||||||||||
|
|
|||||||||||||||
| #5 |
What is the Operating System(OS) version? |
50 | 239 | ||||||||||||
|
|
|||||||||||||||
| #6 |
What was the computer timezone? |
50 | 203 | ||||||||||||
|
|
|||||||||||||||
| #7 |
How many times did this user log on to the computer? |
50 | 234 | ||||||||||||
|
|
|||||||||||||||
| #8 |
When was the last login time for the discovered account? Format: one-space between date and time |
50 | 195 | ||||||||||||
|
|
|||||||||||||||
| #9 |
There was a “Network Scanner” running on this computer, what was it? And when was the last time the suspect used it? Format: program.exe,YYYY-MM-DD HH:MM:SS UTC |
75 | 167 | ||||||||||||
|
|
|||||||||||||||
| #10 |
When did the port scan end? (Example: Sat Jan 23 hh:mm:ss 2016) |
75 | 174 | ||||||||||||
|
|
|||||||||||||||
| #11 |
How many ports were scanned? |
75 | 206 | ||||||||||||
|
|
|||||||||||||||
| #12 |
What ports were found "open"?(comma-separated, ascending) |
75 | 200 | ||||||||||||
|
|
|||||||||||||||
| #13 |
What was the version of the network scanner running on this computer? |
100 | 219 | ||||||||||||
|
|
|||||||||||||||
| #14 |
The employee engaged in a Skype conversation with someone. What is the skype username of the other party? |
75 | 202 | ||||||||||||
|
|
|||||||||||||||
| #15 |
What is the name of the application both parties agreed to use to exfiltrate data and provide remote access for the external attacker in their Skype conversation? |
100 | 172 | ||||||||||||
|
|
|||||||||||||||
| #16 |
What is the Gmail email address of the suspect employee? |
100 | 208 | ||||||||||||
|
|
|||||||||||||||
| #17 |
It looks like the suspect user deleted an important diagram after his conversation with the external attacker. What is the file name of the deleted diagram? |
100 | 180 | ||||||||||||
|
|
|||||||||||||||
| #18 |
The user Documents' directory contained a PDF file discussing data exfiltration techniques. What is the name of the file? |
100 | 198 | ||||||||||||
|
|
|||||||||||||||
| #19 |
What was the name of the Disk Encryption application Installed on the victim system? (two words space separated) |
150 | 129 | ||||||||||||
|
|
|||||||||||||||
| #20 |
What are the serial numbers of the two identified USB storage? |
150 | 191 | ||||||||||||
|
|
|||||||||||||||
| #21 |
One of the installed applications is a file shredder. What is the name of the application? (two words space separated) |
150 | 167 | ||||||||||||
|
|
|||||||||||||||
| #22 |
How many prefetch files were discovered on the system? |
150 | 165 | ||||||||||||
|
|
|||||||||||||||
| #23 |
How many times was the file shredder application executed? |
150 | 181 | ||||||||||||
|
|
|||||||||||||||
| #24 |
Using prefetch, determine when was the last time ZENMAP.EXE-56B17C4C.pf was executed? |
150 | 158 | ||||||||||||
|
|
|||||||||||||||
| #25 |
A JAR file for an offensive traffic manipulation tool was executed. What is the absolute path of the file? |
150 | 166 | ||||||||||||
|
|
|||||||||||||||
| #26 |
The suspect employee tried to exfiltrate data by sending it as an email attachment. What is the name of the suspected attachment? |
150 | 181 | ||||||||||||
|
|
|||||||||||||||
| #27 |
Shellbags shows that the employee created a folder to include all the data he will exfiltrate. What is the full path of that folder? |
150 | 169 | ||||||||||||
|
|
|||||||||||||||
| #28 |
The user deleted two JPG files from the system and moved them to $Recycle-Bin. What is the file name that has the resolution of 1920x1200? |
200 | 163 | ||||||||||||
|
|
|||||||||||||||
| #29 |
Provide the name of the directory where information about jump lists items (created automatically by the system) is stored? |
200 | 168 | ||||||||||||
|
|
|||||||||||||||
| #30 |
Using JUMP LIST analysis, provide the full path of the application with the AppID of "aa28770954eaeaaa" used to bypass network security monitoring controls. |
200 | 169 | ||||||||||||