October 15, 2026
Baggage HacktheBox/Sherlocks
Scenario : This Sherlock provides players with an opportunity to analyze Shellbag artifacts. Shellbags can be used to find evidence of…
By Youssef Mahrous
3 min read
Scenario : This Sherlock provides players with an opportunity to analyze Shellbag artifacts. Shellbags can be used to find evidence of folder access by a specific user, access to network shares, and navigation of archive file contents. This information can be leveraged during investigations to identify potential data access, data staging, and data exfiltration attempts.
Task 1 : What was the name of the archive file downloaded by the compromised account?
ShellBags artifacts provide evidence of folder navigation and interaction with archive contents. The presence of 1.zip and its associated ZIP contents entry indicates that the compromised user interacted with the archive and browsed its contents.
This artifact helped identify the downloaded archive as 1.zip.
Answer:
1.zip1.zipTask 2 : What was the name of the utility brought in by the attacker to search for sensitive data?
The ShellBags artifacts revealed the archive Everything-1.4.1.1028.x64.zip inside a temporary directory. The file metadata shows that it was created at 07:15:24 UTC and last accessed at 07:26:24 UTC on September 3, 2025. This finding suggests that the attacker brought the Everything utility onto the system, potentially to locate sensitive files during the investigation.
Answer:
Everything 1.4.1.1028Everything 1.4.1.1028Task 3 : The attacker navigated the filesystem and found sensitive files used by the victim in their day-to-day work. When was the VPN folder accessed by the attacker?
Using ShellBags Explorer, I located the OT Station 3 internal VPN directory under the user's Documents folder.
The artifact details show the following timestamps:
- First Interacted:
2025-09-03 07:31:05.130 UTC - Last Interacted:
2025-09-03 07:31:05.130 UTC
The Last Interacted timestamp indicates when the attacker last interacted with the VPN directory, according to the ShellBags artifact.
Answer:
2025-09-03 07:31:052025-09-03 07:31:05Task 4 : What was the name of the directory containing the victim's passwords?
The ShellBags artifact revealed a directory named OnePassword MasterPass under the user's Documents folder.
The artifact details show that the directory was first interacted with at 2025-09-03 07:28:49.014 UTC.
This finding identifies the directory associated with the victim's passwords and helps document the attacker's filesystem navigation.
Answer:
OnePassword MasterPassOnePassword MasterPassTask 5 : The attacker also accessed a network share to pillage network data. What is the UNC path?
Using ShellBags Explorer, I identified a network share accessed through the server Prod-ns-2.
The directory Construction 2027 was located inside the shared folder prodshare. This artifact provides evidence of interaction with a network share that may contain sensitive project data.
The UNC path identifies the server and shared directory involved in the investigation.
Answer:
\\Prod-ns-2\prodshare\\Prod-ns-2\prodshareTask 6 : When is the dam construction planned?
The ShellBags artifacts revealed a network share named Construction 2027 under \\Prod-ns-2\prodshare.
The directory name indicates that the dam construction project is planned for 2027. This finding suggests that the attacker accessed a network share containing potentially sensitive project information.
Answer:
20272027Task 7 : What was the name of the archive file present on the network share?
The ShellBags artifacts revealed the archive file Dam Construction Engineer Plans.zip inside a temporary directory under the user's local AppData folder.
The file's presence in the ShellBags records indicates that the user interacted with the archive. Comparing this finding with the network share evidence helps establish a connection between the archive and the dam construction project.
Answer:
Dam Construction Engineer Plans.zipDam Construction Engineer Plans.zipTask 8 : When was the archive file from the network share accessed?
To determine when the archive was accessed from the network share, I examined the ShellBags artifacts in ShellBags Explorer. The archive Dam Construction Engineer Plans.zip was located at \\Prod-ns-2\prodshare\Construction 2027\. Its Last Interacted timestamp was 2025-09-03 07:34:04.048 UTC, indicating when the user last interacted with this archive through Windows Explorer.
Answer:
2025-09-03 07:34:042025-09-03 07:34:04Task 9 : The attacker created a staging folder to prepare for collection and exfiltration. What is the full path of the staging folder?
Answer:
C:\users\Steve\Pictures\aC:\users\Steve\Pictures\aTask 10 : The attacker compressed the staging folder to prepare the data for exfiltration. When was the exfiltration archive file accessed?
The investigation identified a.zip as the archive created from the staging folder C:\Users\steve\Pictures\a. The accepted timestamp for the archive access was 2025-09-03 07:34:30 UTC, indicating the recorded time associated with the archive during the attacker's data-staging activity.
Answer:
2025-09-03 07:34:302025-09-03 07:34:30