Skip to content

Latest commit

 

History

History
163 lines (81 loc) · 4.19 KB

Task 30 [Day 24] Mobile analysis You Are on the Naughty List, McGreedy.md

File metadata and controls

163 lines (81 loc) · 4.19 KB

Task 30 [Day 24] Mobile analysis You Are on the Naughty List, McGreedy


Learning Objectives After completing this task, you will learn about:

  • Procedures for collecting digital evidence
  • The challenges with modern smartphones
  • Using Autopsy Digital Forensics with an actual Android image

Power up the machine and open Autopsy from the desktop.

In Autopsy open the case McGreedy.aut

Screenshot 2024-01-15 at 5 13 24 PM

After it loads the case:

Open up Images sort it by Thumbnail

Screenshot 2024-01-15 at 5 16 51 PM

QUESTIONS

1.One of the photos contains a flag. What is it?

ANSWER

THM{DIGITAL_FORENSICS}

  1. What name does Tracy use to save Detective Frost-eau’s phone number?

ANSWER

Detective Carrot-Nose

Open up Images:

Screenshot 2024-01-15 at 5 25 54 PM
  1. One SMS exchanged with Van Sprinkles contains a password. What is it?

ANSWER

chee7AQu

open up messages:

Screenshot 2024-01-15 at 5 21 19 PM


Task 31 [Day 24] The Confrontation Jolly Judgment Day

Submit Information chat bot evidence:

Screenshot 2024-01-15 at 5 32 27 PM

Then purple snow:

Screenshot 2024-01-15 at 5 33 16 PM

Submit Forum Post:

Screenshot 2024-01-15 at 5 34 19 PM

Select JingleHax

Screenshot 2024-01-15 at 5 35 42 PM

Submit evidence Dropped Usb:

Screenshot 2024-01-15 at 5 37 41 PM

Select mcgreedysecretc2.thm

Screenshot 2024-01-15 at 5 38 40 PM

Submit Malware Sample

Screenshot 2024-01-15 at 5 40 05 PM

Select stash.mcgreedy.thm

Screenshot 2024-01-15 at 5 40 55 PM

Submit C2 server credentials:

Screenshot 2024-01-15 at 5 42 38 PM

Select mcgreedy

Screenshot 2024-01-15 at 5 44 16 PM

Submit Forensic image MCgreedy's Phone:

Screenshot 2024-01-15 at 5 45 15 PM

Select van Sprinkles

Screenshot 2024-01-15 at 5 46 12 PM

Finally the flag:

Screenshot 2024-01-15 at 5 47 07 PM

flag

THM{YouMeddlingKids}


Task 33 [Day 24] Feedback We wish you a Merry Survey

just fill the survey form

flag

THM{SurveyComplete_and_HolidaysSaved}