is an encrypted archive file that serves as a cornerstone of the North Wind challenge within the SANS Holiday Hack Challenge 2023 (KringleCon). It is a forensics-focused puzzle that requires participants to extract and analyze artifacts from a compromised workstation. Overview of the Challenge
: Inside the archive, investigators usually find:
To properly "write up" or solve this artifact, the following workflow is typically used: OboeGladly.7z
: Evidence of what files were targeted for theft.
: For decoding any Base64 or obfuscated strings found inside the archive. is an encrypted archive file that serves as
Determining the that was exfiltrated from the server.
In the "North Wind" scenario, players must investigate a suspected security breach. The .7z file is an encrypted container that holds the key to understanding the attacker's actions. The primary goal is to find the password for this archive and analyze its contents to complete the mission objectives. : For decoding any Base64 or obfuscated strings
: The password for OboeGladly.7z is not provided directly. It is typically found by investigating other files on the provided workstation, specifically by searching through PowerShell history or browser downloads .