Noted

Scenario

As our junior security analyst, you are assigned to a specific type of digital forensics and incident response (DFIR) investigation in this case. The CERT lead has triaged the workstation and provided you with only Notepad++ artifacts, suspecting that the attacker created the extortion note and carried out other extortion activities with hands-on keyboard access. Your duty is to determine how the attack occurred and find a way to contact the threat actors, as they accidentally locked out their own contact information.

Executive Summary

An attacker with hands-on access to a software engineer’s workstation used the machine’s own development tooling instead of bringing malware. They placed a Java source file on the desktop, compiled it locally, and used it to sweep sensitive data into a single archive staged for exfiltration. Afterwards they wrote a data extortion note in Notepad++ and left it unsaved, so the editor’s backup buffers preserved it. The note keeps the payment and contact details out of the file itself and points to external paste sites instead, one of them password-protected. Opening that paste gave the full demand in cryptocurrency and a Tor mail address for contact.

Artifacts

• session.xml: %APPDATA%\Notepad++\session.xml → read as text. Lists every open tab, its path, backup file name and last-modified timestamp
• config.xml: %APPDATA%\Notepad++\config.xml → read as text. Holds the recent-files list
• backup\: %APPDATA%\Notepad++\backup\ → read as text. Buffers for unsaved tabs, including full file contents

Timestamp note: session.xml stores the last-modified time as two signed 32-bit integers (originalFileLastModifTimestamp low and high). Convert the low value to unsigned before building the FILETIME, or the date comes out wrong.

Collection

Start with config.xml. The recent-files list records documents Simon opened whether or not they were later closed, and one .pl file in a Dev_Ops folder is clearly the AWS migration script. session.xml only covers tabs open at the time of the incident, so the recent-files list is where a script he used earlier shows up.

grep -i '<File ' config.xml

session.xml lists each tab with its filename attribute and a backupFilePath for unsaved content. A Java file on the desktop stands out against Simon’s usual files. Its buffer in the backup folder holds a class named Sensitive_data_extort that gathers data and prepares an archive, which matches the behaviour in the question.

grep -i 'filename=' session.xml

cat backup/*

Tip: The filename attribute gives the path on disk and the backup buffer gives the code. Read both to tie the path to the behaviour.

The <File> entry for the Q2 tab in session.xml carries originalFileLastModifTimestamp (low) and originalFileLastModifTimestampHigh. They are signed 32-bit integers, here low -1354503710 and high 31047188. Mask the low value to unsigned, join the two into a 64-bit FILETIME, and add it to 1601-01-01 in 100 ns units.

python3 -I -c "
import datetime as d
lo=-1354503710&0xffffffff; hi=31047188
print(d.datetime(1601,1,1)+d.timedelta(microseconds=((hi<<32)|lo)//10))"

Gotcha: Feeding the negative low value in as-is corrupts the 64-bit FILETIME and the date lands in the wrong place. Mask it with 0xffffffff first, and truncate the fractional seconds to match the answer format.

Exfiltration

From Q2 the source is in the backup buffer, so read it for the output location. The archive name is the zipFilePath value set in the code before the files are added.

grep -i 'zipFilePath' backup/*

Impact

The extortion note sits in a backup buffer, but it holds no wallet. It only links to three paste sites (pastebin.com, pastebin.ai, pastecode.io), and the payment details are inside those pastes. Fetching live attacker URLs is off the table, so the passive route is the Wayback Machine. It had a single snapshot, for the pastebin.com link xmTkajd5, and that snapshot is a password-locked page with no readable content. The password comes from the attacker’s notes. With the paste unlocked, the note demands $50,000 in ETH, and the wallet address is the one given there. This value came from the unlocked paste, not from the Notepad++ artifacts, and the format mask (a long run of characters ending in a) fits an Ethereum address.

curl -s 'https://archive.org/wayback/available?url=pastebin.com/xmTkajd5'

Hint: The Notepad++ artifacts will never contain the wallet. Don’t burn time grepping the backup folder for it; the answer lives behind the paste link and its password.

Same source as Q5. The contact address is in the unlocked note under its “Person of contact” line, not in the Notepad++ buffer, which is the point of the scenario: the attackers locked themselves out of their own contact details. It is a Tor mail address on a .onion domain.

Tip: Format the answer exactly as the paste gives it, [email protected], with nothing added.

Attack Summary

IOCs

MITRE ATT&CK

Defender Takeaways

Editor state is evidence. Notepad++ keeps unsaved tabs in backup\ and tab metadata in session.xml, so a note or script the attacker never saved to disk is still recoverable. Include %APPDATA%\Notepad++ in triage collections.

Compilers on workstations remove the need for attacker tooling. A developer machine with a JDK lets an attacker build their collector in place, which defeats hash and signature based detection. Alert on javac or java launched from a Desktop or Downloads path, and on unusual parent processes for the toolchain.

Large archives written by a freshly compiled program are a staging signal. A new .java file followed by a zip of source and data folders is a strong sequence to hunt for. Monitor for archive creation in user directories paired with outbound transfers.

Extortion notes that link to external pastes need quick takedown and archiving. The payment details here lived off-host behind a password, so capturing the paste content early decides whether responders can ever contact or trace the actor. Preserve the note’s links as indicators the moment they are found.

Conclusion

The attacker staged and extorted using only what a developer workstation already provides, leaving a compiled collector, an archive and a note. The sharpest lesson is that the editor’s own session and backup files kept the whole story, while the payment and contact details were deliberately kept off the host.