KShackZone_s_Phishing_Breach_Investigation

Author

pmsiam0

KShackZone’s incident response team was recently called in to investigate a suspected breach involving one of the client’s internal Windows servers. Initial findings revealed a network rich with multiple user accounts—yet cluttered with limited files and vague traces of activity.

As a forensic investigator, you’ve been granted access to one non-privileged user account. But something feels off.

The client mentioned that an admin had previously accessed this very account for an unknown reason. Rumors suggest the admin had a troubled past history and may have made emotional decisions that could make mistake which is inadvertently compromised the system. More curiously, task automation routines were reportedly left behind—poorly concealed and possibly abused. Traceformat appear shuffled, users overlap in IPs, and subtle trails point to someone on the inside.Some shell entries behave abnormally. One particularly strange CLSID key hides data that doesn’t belong there. Could this be a tool for persistence or just another red herring? All signs suggest that the attacker isn’t an outsider—but hiding among the users.Interestingly, it's known that the admin had a daily routine of reviewing tasks and logs diligently—until one day, that habit broke.

Your Mission: Assist KShackZone and their lead investigator pmsiam0 in unearthing the attacker, uncovering their techniques, and recovering buried flags. But beware—this puzzle isn’t straightforward. You'll need to dig deep, think twice, and investigate thoroughly. Good luck, analyst. The cyberworld is counting on you.

https://drive.google.com/file/d/15lhuqojRUCmZu5dwSOA66RwDNpWhLWGG/view