tag: Windows

This is one of the HackTheBox’s Sherlock - Reaper. It’s also one of the more terrible and sloppy write-up of mine, I don’t recommend you reading this unless there really is no other choice. Scenario Our SIEM alerted us to a suspicious logon event which needs to be looked at immediately. The alert details were that the IP Address and the Source Workstation name were a mismatch. You are provided a network capture and event logs from the surrounding time around the incident timeframe. Corelate the given evidence and report back to your SOC Manager. ...

TLDR Stop using both the usb and memory card at once. Else, it will be next to impossible to recover anything back, since the data cells got overwritten, instead of just being “unlisted”. On Window (Linux), you can just install Recuva (extundelete or fatcat) for free and point the app to your usb or memory card, you’re welcome. However, I would still prefer a more sure-fire way to preserve my data, hence the blog. ...

Introduction Normally, installing a FlareVM won’t mutate your network connection. However, for some reason, I wasn’t able to access network inside the VM. This could have caused by one or a couple of reasons: Non-fatal errors occured during installation (I was supposed to look at the screen during all process, but it took 6h to finish…) The recovery function of Windows got forced shut down to fulfill installation prerequisites, so it can not intervene and autofix the network issues A driver “Other” was spotted to be missing after FlareVM completely finish its installation VirtualBox network setting walkthrough You may like to switch to either NAT or Bridged Adapter. In the Adapter type, choose something along the line of “Intel… Desktop”, or if you don’t know what to choose, just leave the default option. ...