Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Unattended

Use your Windows forensics knowledge to investigate an incident.

Task 1: Introduction

Welcome to the team, kid. I have something for you to get your feet wet.

Our client has a newly hired employee who saw a suspicious-looking janitor exiting his office as he was about to return from lunch.

I want you to investigate if there was user activity while the user was away between 12:05 PM to 12:45 PM on the 19th of November 2022. If there are, figure out what files were accessed and exfiltrated externally.

You'll be accessing a live system, but use the disk image already exported to the C:\Users\THM-RFedora\Desktop\kape-results\C directory for your investigation. The link to the tools that you'll need is in C:\Users\THM-RFedora\Desktop\tools 

Finally, I want to remind you that you signed an NDA, so avoid viewing any files classified as top secret. I don't want us to get into trouble.

Connecting to the machine

Start the lab machine in split-screen view by clicking on the green "Start Lab Machine" button on the upper right section of this task. If the VM is not visible, use the blue "Show Split View" button at the top-right of the page. Alternatively, you can connect to the VM using the credentials below via "Remote Desktop".

Username THM-RFedora
Password Passw0rd!
IP MACHINE_IP
Note: Once the VM is fully running, please run Registry Explorer immediately, as this tool may take a few minutes to fully start up when executing the program for the first time.

Answer the questions below

  1. Connect to the machine and continue to the next task

Task 2: Windows Forensics review

Pre-requisites

This room is based on the Windows Forensics 1 and Windows Forensics 2 rooms. A cheat sheet is attached below, which you can also download by clicking on the blue Download Task Files button on the right.

To better understand how to perform forensics quickly and efficiently, consider checking out the KAPE room.

Good luck!

Answer the questions below

  1. Let's do this!

Task 3: Snooping around

Initial investigations reveal that someone accessed the user's computer during the previously specified timeframe.

Whoever this someone is, it is evident they already know what to search for. Hmm. Curious.

Answer the questions below

  1. What file type was searched for using the search bar in Windows Explorer?

  2. What top-secret keyword was searched for using the search bar in Windows Explorer?

Task 4: Can't simply open it

Not surprisingly, they quickly found what they are looking for in a matter of minutes.

Ha! They seem to have hit a snag! They needed something first before they could continue.

Note:  When using the Autopsy Tool, you can speed up the load times by only selecting "Recent Activity" when configuring the Ingest settings.



Answer the questions below

  1. What is the name of the downloaded file to the Downloads folder?

  2. When was the file from the previous question downloaded? (YYYY-MM-DD HH:MM:SS UTC)

  3. Thanks to the previously downloaded file, a PNG file was opened. When was this file opened? (YYYY-MM-DD HH:MM:SS)

Task 5: Sending it outside

Uh oh. They've hit the jackpot and are now preparing to exfiltrate data outside the network.

There is no way to do it via USB. So what's their other option?

Answer the questions below

  1. A text file was created in the Desktop folder. How many times was this file opened?

  2. When was the text file from the previous question last modified? (MM/DD/YYYY HH:MM)

  3. The contents of the file were exfiltrated to pastebin.com. What is the generated URL of the exfiltrated data?

  4. What is the string that was copied to the pastebin URL?

Task 6: Conclusion

At this point, we already have a good idea of what happened. The malicious threat actor was able to successfully find and exfiltrate data. While we could not determine who this person is, it is clear that they knew what they wanted and how to get it.

I wonder what's so important that they risked accessing the machine in-person... I guess we'll never know.

Anyways, you did good, kid. I guess it was too easy for you, huh?

Answer the questions below

  1. Let's see if you can handle the next one.
Back to all walkthroughs
Room Icon

Unattended

Use your Windows forensics knowledge to investigate an incident.

medium

60 min

17,439

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off

Welcome to the team, kid. I have something for you to get your feet wet.

Our client has a newly hired employee who saw a suspicious-looking janitor exiting his office as he was about to return from lunch.

I want you to investigate if there was user activity while the user was away between 12:05 PM to 12:45 PM on the 19th of November 2022. If there are, figure out what files were accessed and exfiltrated externally.

You'll be accessing a live system, but use the disk image already exported to the C:\Users\THM-RFedora\Desktop\kape-results\C directory for your investigation. The link to the tools that you'll need is in C:\Users\THM-RFedora\Desktop\tools 

Finally, I want to remind you that you signed an , so avoid viewing any files classified as top secret. I don't want us to get into trouble.

Connecting to the machine

Start the lab machine in split-screen view by clicking on the green "Start Lab Machine" button on the upper right section of this task. If the is not visible, use the blue "Show Split View" button at the top-right of the page. Alternatively, you can connect to the VM using the credentials below via "Remote Desktop".

THM key
Username -RFedora
Password Passw0rd!
IP MACHINE_IP
Note: Once the VM is fully running, please run immediately, as this tool may take a few minutes to fully start up when executing the program for the first time.
Answer the questions below
Connect to the machine and continue to the next task

Pre-requisites

This room is based on the Windows Forensics 1 and Windows Forensics 2 rooms. A cheat sheet is attached below, which you can also download by clicking on the blue Download Task Files button on the right.

To better understand how to perform forensics quickly and efficiently, consider checking out the  room.

Good luck!

Answer the questions below
Let's do this!

Initial investigations reveal that someone accessed the user's computer during the previously specified timeframe.

Whoever this someone is, it is evident they already know what to search for. Hmm. Curious.

Answer the questions below
What file type was searched for using the search bar in Windows Explorer?

What top-secret keyword was searched for using the search bar in Windows Explorer?

Not surprisingly, they quickly found what they are looking for in a matter of minutes.

Ha! They seem to have hit a snag! They needed something first before they could continue.

Note:  When using the Autopsy Tool, you can speed up the load times by only selecting "Recent Activity" when configuring the Ingest settings.

Configuring the Ingest setting in Autopsy


Answer the questions below
What is the name of the downloaded file to the Downloads folder?

When was the file from the previous question downloaded? (YYYY-MM-DD HH:MM:SS UTC)

Thanks to the previously downloaded file, a PNG file was opened. When was this file opened? (YYYY-MM-DD HH:MM:SS)

Uh oh. They've hit the jackpot and are now preparing to exfiltrate data outside the network.

There is no way to do it via USB. So what's their other option?

Answer the questions below
A text file was created in the Desktop folder. How many times was this file opened?

When was the text file from the previous question last modified? (MM/DD/YYYY HH:MM)

The contents of the file were exfiltrated to pastebin.com. What is the generated URL of the exfiltrated data?

What is the string that was copied to the pastebin URL?

At this point, we already have a good idea of what happened. The malicious threat actor was able to successfully find and exfiltrate data. While we could not determine who this person is, it is clear that they knew what they wanted and how to get it.

I wonder what's so important that they risked accessing the machine in-person... I guess we'll never know.

Anyways, you did good, kid. I guess it was too easy for you, huh?

Answer the questions below
Let's see if you can handle the next one.