Jingle Bell

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Torrin is suspected to be an insider threat in Forela. He is believed to have leaked some data and removed certain applications from their workstation. They managed to bypass some controls and installed unauthorised software. Despite the forensic team's efforts, no evidence of data leakage was found. As a senior incident responder, you have been tasked with investigating the incident to determine the conversation between the two parties involved.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. As a senior incident responder, we're tasked to investigate an incident in Forela. It is believed that Torrin leaked some data and removed certain applications from Forela workstation.
2. We're given these files:

1ST QUESTION --> ANS: REDACTED

1. Upon reviewing the DB file given, we can identify the tool used by Torrin to leak Forela's data by reviewing the notification table.
2. Noticed an application seems to be our interest among all 23 rows.
3. It's slack application.

NOTES:

Slack is a cloud-based communication platform primarily used for workplace collaboration. It allows teams tocommunicate
in real-time through channels organized by topic, as well as through direct messaging. Users can share files, integrate
with other tools and services, and search through conversations and files easily.

1. Further checking, we identified a conversation between PrimeTech Innovations company, especially the Dev team.

2. It asked Torrin whether he managed to find the files related to Forela Oil Extraction Plan in Angola.

3. It's clear then, that Torrin using slack to leak Forela's secret.

2ND QUESTION --> ANS: REDACTED

1. Based from our previous finding, it's clear that Torrin tried to leak Forela's data to PrimeTech Innovations company.

3RD QUESTION --> ANS: REDACTED

1. Again, based from our previous finding, Torrin communicated with user Cyberjunkie-PrimeTechDev.

4TH QUESTION --> ANS: REDACTED

1. Still from the same row's data, we can see the channel's name based from the hashtag usage.

5TH QUESTION --> ANS: REDACTED

1. Reviewing row 18th, Torrin seems Cyberjunkie spilled the password archive server and he confirmed the password again.

6TH QUESTION --> ANS: REDACTED

1. Reviewing the next row, Cyberjunkie sent Torrin the google drive link.

7TH QUESTION --> ANS: REDACTED

1. To identify the timestamp of when Torrin sends the google drive link to Cyberjunkie, simply convert the Unix timestamp to UTC using this online converter.

UNIX TIMESTAMP

8TH QUESTION --> ANS: REDACTED

1. Reviewing the 22nd row, we can identified the bank account number along with the money to be transferred.

2. We've finished investigatd the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using sqlitebrowser to reviewing sqlite3.db file.
2. Slack Application Forensic (.DB) file.