Noted

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Simon, a developer working at Forela, notified the CERT team about a note that appeared on his desktop. The note claimed that his system had been compromised and that sensitive data from Simon's workstation had been collected. The perpetrators performed data extortion on his workstation and are now threatening to release the data on the dark web unless their demands are met. Simon's workstation contained multiple sensitive files, including planned software projects, internal development plans, and application codebases. The threat intelligence team believes that the threat actor made some mistakes, but they have not found any way to contact the threat actors. The company's stakeholders are insisting that this incident be resolved and all sensitive data be recovered. They demand that under no circumstances should the data be leaked. As our junior security analyst, you have been assigned a specific type of DFIR (Digital Forensics and Incident Response) investigation in this case. The CERT lead, after triaging the workstation, has provided you with only the Notepad++ artifacts, suspecting that the attacker created the extortion note and conducted other activities with hands-on keyboard access. Your duty is to determine how the attack occurred and find a way to contact the threat actors, as they accidentally locked out their own contact information.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this challenge, we're given 5 files.

1ST QUESTION --> ANS: REDACTED

1. To identify the full path of the script used by Simon for AWS operations, we just need to review the config file --> config.xml.
2. Inside the history tag, we can see the full path of it.

2ND QUESTION --> ANS: REDACTED

1. To identify which source file is duplicated by the attacker, we can check the session.xml file.

2. Reviewing the code, we can identify that .java is the only source file available there.

3. To make sure that it is indeed our interest file, we can review the source file by following the criteria listed from the chall's description --> This code gathered sensitive data and prepared it for exfiltration.

4. Upon reviewing the code, we can identify 2 core functions called namely collectFiles and createZipArchive which used for preparation for data exfil.

5. It's clear now that the .java source is the duplicated source.

3RD QUESTION --> ANS: REDACTED

1. Again, reviewing the .java source we can identified that the attacker stored all the data to a zip file named Forela-Dev-Data.zip.

4TH QUESTION --> ANS:

REDACTED 11. asdasda

5TH QUESTION --> ANS: REDACTED

1. Judging from the .txt file, it seems the wallet is stored inside the pastebin.

2. The password for the locked pastebin is stored at the source file.

Got the wallet address

6TH QUESTION --> ANS: REDACTED

1. The email address is shown below the eth wallet.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS:REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Analyzing Notepad++ artifacts.