Secret Recipe

Prompts and answers

• How many Files are available in the Artifacts folder on the Desktop?
  6
• What is the Computer Name of the Machine found in the registry?
  JAMES
• When was the Administrator account created on this machine? (Format: yyyy-mm-dd hh:mm:ss)
  2021-03-17 14:58:48
• What is the RID associated with the Administrator account?
  500
• How many User accounts were observed on this machine?
  7
• There seems to be a suspicious account created as a backdoor with RID 1013. What is the Account Name?
  bdoor
• What is the VPN connection this host connected to?
  ProtonVPN
• When was the first VPN connection observed? (Format: YYYY-MM-DD HH:MM:SS)
  2022-10-12 19:52:36
• There were three shared folders observed on his machine. What is the path of the third share?
  C:\RESTRICTED FILES
• What is the Last DHCP IP assigned to this host?
  172.31.2.197
• The suspect seems to have accessed a file containing the secret coffee recipe. What is the name of the file?
  secret-recipe.pdf
• The suspect ran multiple commands in the run windows. What command was run to enumerate the network interfaces?
  pnputil /enum-interfaces
• In the file explorer, the user searched for a network utility to transfer files. What is the name of that tool?
  netcat
• What is the recent text file opened by the suspect?
  secret-code.txt
• How many times was Powershell executed on this host?
  3
• The suspect also executed a network monitoring tool. What is the name of the tool?
  wireshark
• Registry Hives also notes the amount of time a process is in focus. Examine the Hives. For how many seconds was ProtonVPN executed?
  343
• Everything.exe is a utility used to search for files in a Windows machine. What is the full path from which everything.exe was executed?
  C:\Users\Administrator\Downloads\tools\Everything\Everything.exe