Main
Index
BelkaCTF #7 — Windows DFIR
│
├─ 01 — Whoami - Baby
├─ 02 — Locker - Warmup
├─ 03 — Sample
├─ 04 — Infection
├─ 05 — C2
└─
Intro
This series of writeups covers a CTF that I participated in live. I joined BelkaCTF #7 as usual, expecting to have some fun and not much more. Instead, it turned out to be one of the most interesting, challenging, and genuinely fun experiences I have had in cybersecurity.
I went into the live CTF completely blind, with no DFIR experience, so I used every trick I had.
The biggest one was the Belkasoft X suite. It was intuitive enough that I figured out most of it without having to read any guides, and it was extremely powerful. Data that I would have spent hours unearthing manually was often just sitting there on the main page.
However, Belkasoft X is not freely available, so I will not be using it for these writeups. Instead, I will stick to free tools for reproducibility - and, admittedly, as an extra challenge for myself. I will explain which tools I chose, why I chose them and how to set them up as they become relevant.
If you want to see how you could use the Belkasoft X suite for this CTF you can see the official writeups.
The setup for the CTF is very simple and is explained well on Belkasoft's website:
— Damn these blue screens to hell! — The Chief sucked on his cigar so hard I thought his lungs would surrender first. — Half the country's on pause!
— Airports, hospitals, power plants… all crashed into that lovely blue abyss, — I nodded, lazily jamming a USB stick into my laptop. — Except one terminal.
— Which one?
— The dispatcher's workstation at the airport. Didn't BSOD like the rest — instead, it runs some weird locker, blasting propaganda: "Hit the streets on this date, show 'em who's boss..."
The Chief let out a dry chuckle:
— So, detective, what's your take?
— My take? This ain't some script kiddie brag. Someone's playing crowd control through hijacked Windows boxes.
He exhaled smoke slowly, eyes gleaming:
— Then it's time we find out who woke up the streets from behind a ransom screen.
— Already on autopilot, Chief. Just don’t mess with my coffee mug.