Constellation

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

The SOC team has recently been alerted to the potential existence of an insider threat. The suspect employee's workstation has been secured and examined. During the memory analysis, the Senior DFIR Analyst succeeded in extracting several intriguing URLs from the memory. These are now provided to you for further analysis to uncover any evidence, such as indications of data exfiltration or contact with malicious entities. Should you discover any information regarding the attacking group or individuals involved, you will collaborate closely with the threat intelligence team. Additionally, you will assist the Forensics team in creating a timeline. Warning : This Sherlock will require an element of OSINT and some answers can be found outside of the provided artifacts to complete fully.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this challenge we're tasked to do further analysis of artifacts which extracted by the IR team. Based from the artifacts, we're told to do information gathering regarding all individuals involved in this incident and collaborate with the Threat Intelligence team.
2. We've recieved 2 artifacts:

PDF CONTENT

IOC CONTENT

1ST QUESTION --> ANS: REDACTED

1. Based from the scenario and the IOC's link, we can speculate that the communication between the suspect and the actor group are done by discord.

2. Hence the PDF file timestamp can be used to identify the initial communication between the suspect and the attacker group.

3. To find the timestamp I used this online threat intelligence tool named unfurl.

4. Copy the discord link from the IOC file and paste it to the tool.

5. The correct initial timestamp is at the first index.

2ND QUESTION --> ANS: REDACTED

1. It's clear, that the attack group sent the NDA_Instructions.pdf through discord.

3RD QUESTION --> ANS: REDACTED

1. Again, still using the same online tool, we can identified the initial timestamp of when the attack group sent the pdf file to the suspect.
2. Simply check for File ID branch.

4TH QUESTION --> ANS: REDACTED

1. Now, reviewing the other link inside the IOC file, seems the attack group query how to zip a folder using tar in linux with google. Again, based from this condition and previous IOC, we can speculate that the attack group want the suspect to exfiltrates all the internal information to a folder then zip it using tar in linux.

5TH QUESTION --> ANS: REDACTED

1. However, if we reviewed it carefully, it seems the attack group queried another thing --> how to archive a folder using tar i.

6TH QUESTION --> ANS: REDACTED

1. Next, to identify the timestamp of when this Google search made, we just need to paste it to the same tool we used before.

7TH QUESTION --> ANS: REDACTED

1. Based from the PDF content, we can see clearly the attack group said their own group name.

8TH QUESTION --> ANS: REDACTED

1. Again, still from the PDF file. The attack group said the suspected name.

9TH QUESTION --> ANS: REDACTED

1. To identify the creation date timestamp, in Linux we can use exiftools.

2. Noticed there are several informations that could be useful for us. To identify the real name of the agen / handler from the attack group.

3. Based from the result above, we can conclude that the creation timestamp in UTC is --> 2054:01:17 22:45:22.

10TH QUESTION --> ANS: REDACTED

1. Remembering previously we identified a gmail also the the attack group name, let's search it on the internet.

2. Interesing! Found a linkedin profile.

3. Based from the profile description, it seems indeed we found the correct profile.

11TH QUESTION --> ANS: REDACTED

1. Noticed, the agent disclosed his location --> city, province, and country. Great!

2. Based from the profile, the agent seems lived in Bahawalpur.

3. Great! We've investigated the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Identify the initial timestamp of conversation made in Discord using Discord File Link.
2. Using unfurl (Threat Intelligence tool) to identify initial timestamp of Google Query link and the initial timestamp of when a file sent in Discord.