MEM Challenge

Credit

We have faced this challenge in the qualification round of the Black Hat MEA CTF 2022. This challenge was made by BlackHat MEA Team. Credit goes to the respective creators.

Challenge Scenario

“My work PC has suddenly crashed. I can no longer retrieve my secret file, also I don’t remember the password. It is a hard password and securely generated, but I saved it locally. Can you help me recover the content?”

Downloading the Memory Dump / Running on the Cloud Lab

Attention: the sample you are about to download may include malicious files and malware samples. To protect your system, please analyze it on a completely isolated virtual machine if it is not running on cloud

You can download the memory dump directly from here.

Submit Your Answer

Flag Format: XXXXXX

Our Walk-through 

Used Tools

• Volatility2
• John The Ripper
• HxD (Hex Editor)
• Registry Explorer

Conclusion

In this blog, we briefly notified you about a memory forensic challenge.

Cya till the Next One ~ Hoxed