00 - What we have

Obsidian Vault

zz01 - What was the name of the executable that was uploaded as a C2 Agent

zz02 -What was the session id for in the initial access

zz03 -The attacker attempted to set a bitlocker password on the C drive what was the password

zz04 -What name was used by the attacker

zz05 -What IP address did the C2 connect back to

zz06 -What category did Windows Defender give to the C2 binary file

zz07 -What was the filename of the powershell script the attackers used to manipulate time

zz08 -What time did the initial access connection start

zz09 -What is the SHA1 and SHA2 sum of the malicious binary

zz10 -How many times did the powershell script change the time on the machine

zz11 - What is the SID of the victim user

00 - What we have

02 - Interesting

05 - Registry hives

15 - Events log

30 - TeamViewer Log

35 - Browser History

50 - Chainsaw Hunt

55 - Powershell Console History

65 - Defender logs

00 - What we have

Registary hives -> DONE
Event Logs (.evtx) -> Gathered
prefetch -> Done
MFT -> gathered
Logs -> DONE
User Profile - Done
Browser History
SYSMON

Interactive Graph

Table Of Contents