[문제]
https://tryhackme.com/r/room/windowsforensics1
Windows Forensics 1
Introduction to Windows Registry Forensics
tryhackme.com
[문제 풀이]
Task 1) Introduction to Computer Forensics for Windows
What is the most used Desktop Operationg System right now?
답) Microsoft Windows
Task 2) Windows Registry and Forensics
What is the short form for HKEY_LOCAL_MACHINE?
답) HKLM
Task3) Accessing registry hives offline
What is the path for the five main registry hives, DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM?
답) C:\Windows\System32\Config
What is the path for the AmCache hive?
답) C:\Windows\AppCompat\Programs\Amcache.hve
Task 6) System Information and System Accounts
What is the Current Build Number of the machine whose data is being investigated?
답: 19044
Which ControlSet contains the last known good configuration?
답: 1
What is the Computer Name of the computer?
답: THM-4N6
What is the value of the TimeZoneKeyName?
답: Pakistan Standard Time
What is the DHCP IP address
답: 192.168.100.58
What is the RID of the Guest User account?
답: 501
Task 7) Usage or knowledge of files/folders
When was EZtools opened?
답: 2021-15-01 13:00:34
At what time was My Computer last interacted with?
답: 2021-12-01 13:06:47
What is the Absolute Path of the file opened using notepad.exe?
답: C:\Program Files\Amazon\Ec2ConfigService\Settings
When was this file opened?
답: 2021-11-30 10:56:19
Task 8) Evidence of Execution
How many times was the File Explorer launched?
답: 26
What is another name for ShimCache?
답: AppCompatCache
Which of the artifacts also saves SHA1 hashes of the executed programs?
답: AmCache
Which of the artifacts saves the full path of the executed programs?
답: BAM/DAM
Task 9) External Devices/USB device forensics
What is the serial number of the device from the manufacturer 'Kingston'?
답: 1C6f654E59A3B0C179D366AE&0
What is the name of this device?
답: Kingston Data Traveler 2.0 USB Device
What is the friendly name of the device from the manufacturer 'Kingston'?
답: USB
Task 10) Hands-on Challenge
- 먼저 RegistryExplorer을 run as administrator로 해서 실행한다.
- 그다음 C:\Windows\System32\Config 디렉터리에서 SAM, SOFTWARE, SYSTEM을 로드해야 한다.
- SOFTWARE랑 SYSTEM을 로드를 하라고 하면 "Dirty hive detected" 팝업이 뜨면 "no"를 선택하고 "replay transaction logs against this hive" 팝업이 뜨면 "yes"를 선택한다.
- 그다음 1~3번 문제를 풀기 위해 SAM에서 Users 경로를 확인했습니다.
How many user create accounts are present on the system?
답: 3
What is the username of the account that has never been logged in?
답: thm-user2
What's the password hint for the user THM-4n6?
답: count
* 아래 문제들은 다음에 이어서...
When was the file 'Changelog.txt' accessed?
What is the complete path from where the python 3.8.2 installer was run?
When was the USB device with the friendly name 'USB' last connected?