You are a Senior Cybersecurity Analyst.
Your Security Operations Center (SOC) has received an alert from your antivirus software indicating that protection was disabled on one of the endpoints in your organization.
This victim machine has been isolated from the network.

Your manager is requesting your assistance in analyzing an Incident Response (IR) package from the current investigation.
The package contains a Windows memory image, Windows event logs, and Windows registry hive files.

Please find out when the antivirus software protection was disabled, and identify the corresponding Event ID.

Flag format: PUCTF26{DisableTime_EventID_HostName_SystemTime}

• Antivirus protection disabled exactly at (UTC): (e.g., 2026-01-01T01:01:01)
• Event ID: 4 digits (e.g., 1234)
• Hostname: (e.g., HOST-123)
• RAM dump file creation time (SystemTime) in UTC: (e.g., 2026-01-01T01:01:01)

Mega mirror 1: https://mega.nz/file/loETkaaZ#f0dxBOSX1GAa41ktPgxmaKPIM20k6JNC0Hs_SRSPUKI

Mega mirror 2: https://mega.nz/file/i1ACXIxY#lG2IV-IINwYY4bvqcY9e2Sh0QU2QoJoQ6ShJ-J_cThg

Google drive mirror: https://drive.google.com/file/d/1bOFmteOmAQkjrGZSAtRUw4xwb1WRctY2/view?usp=sharing

7z password: infected

SHA256 Hash: 45fbe29bb5dc27ec8d32281e79a2203d2cdb888e8c06e09b2c77b8982c933847

Author: Nightsedge

Flag Format: PUCTF26{[a-zA-Z0-9_:-]+_[a-zA-Z0-9_:-]+_[a-zA-Z0-9_:-]+_[a-zA-Z0-9_:-]+}

Write Up

Author: Potato

Summary

The objective is to recover 4 fields:

1. Antivirus disabled time (UTC)
2. Event ID
3. Hostname
4. RAM dump creation time (UTC)

Then format them as:

PUCTF26{DisableTime_EventID_HostName_SystemTime}

Artifact inventory

Before parsing anything, I first surveyed what was inside the IR package.

What I could confirm with high confidence from the package structure used in this challenge series:

1. Memory dump file: hkctf-night01_memdump.mem
2. Event logs folder: evtx_logs containing many Windows EVTX channels (including Defender Operational)
3. Registry hive folder: Registry_dump containing standard offline hives (including software, system, SAM, and SECURITY)

I am intentionally not asserting exact EVTX count or memory-file byte size here because those values were not re-queried in this final pass.

Identify the Defender disable event

The challenge text tells us AV protection was disabled. The fastest source for that is:

evtx_logs/Microsoft-Windows-Windows Defender%4Operational.evtx

I started with this log on purpose: the prompt is specifically about antivirus protection being disabled, and Defender state/tamper transitions are recorded in Defender's own Operational channel. That is a more direct signal than starting from broad channels like Security or System.

I parsed this EVTX and filtered for Defender state/tamper events, especially Event ID:

• 5001: Microsoft Defender's Real-Time Protection has been disabled
• 5007: a change has occurred in the Microsoft Defender Antivirus configuration

Payload used:

import Evtx.Evtx as evtx
import xml.etree.ElementTree as ET

path = r"C:\Users\Issac\Downloads\2026_nuttyshell_ctf_IR_package\IR_package\evtx_logs\Microsoft-Windows-Windows Defender%4Operational.evtx"
ns = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}

with evtx.Evtx(path) as log:
    for record in log.records():
        root = ET.fromstring(record.xml())
        eid = int(root.find('.//e:EventID', ns).text)
        if eid == 5001:
            t = root.find('.//e:TimeCreated', ns).get('SystemTime')
            print(t, eid)

Output:

2026-02-26T15:58:36.709755000Z 5001

For the flag format, we use second precision:

DisableTime = 2026-02-26T15:58:36
EventID     = 5001

Check for competing candidate events

To avoid ambiguity, I also counted relevant Defender event IDs in the same log.

Payload used:

import Evtx.Evtx as evtx
import xml.etree.ElementTree as ET

path = r"C:\Users\Issac\Downloads\2026_nuttyshell_ctf_IR_package\IR_package\evtx_logs\Microsoft-Windows-Windows Defender%4Operational.evtx"
ns = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}
counts = {5001: 0, 5007: 0, 5010: 0}

with evtx.Evtx(path) as log:
    for record in log.records():
        root = ET.fromstring(record.xml())
        eid = int(root.find('.//e:EventID', ns).text)
        if eid in counts:
            counts[eid] += 1

print(counts)

Observed result from this investigation path:

{5001: 1, 5007: 45, 5010: 0}

So there is exactly one 5001 event in the Defender Operational log, which makes the disable timestamp unambiguous.

Confirm hostname

I did not rely only on the dump filename. I verified the hostname from a second source: the <Computer> field in the Defender event XML.

Payload used:

import Evtx.Evtx as evtx
import xml.etree.ElementTree as ET

path = r"C:\Users\Issac\Downloads\2026_nuttyshell_ctf_IR_package\IR_package\evtx_logs\Microsoft-Windows-Windows Defender%4Operational.evtx"
ns = {'e': 'http://schemas.microsoft.com/win/2004/08/events/event'}

with evtx.Evtx(path) as log:
    for record in log.records():
        root = ET.fromstring(record.xml())
        eid = int(root.find('.//e:EventID', ns).text)
        if eid == 5001:
            print(root.find('.//e:Computer', ns).text)
            break

Hostname:

hkctf-night01

Get memory dump creation time (SystemTime)

The fourth field is the RAM dump file creation timestamp in UTC.

Payload used (PowerShell):

$f = Get-Item "C:\Users\Issac\Downloads\2026_nuttyshell_ctf_IR_package\IR_package\hkctf-night01_memdump.mem"
$f.CreationTimeUtc.ToString("yyyy-MM-ddTHH:mm:ss")

Output:

2026-02-26T16:12:32

So:

SystemTime = 2026-02-26T16:12:32

Timestamp handling note:

1. This value comes from file metadata (CreationTimeUtc) after extracting the 7z package.
2. The interpretation assumes extraction preserved original timestamps.
3. 7-Zip normally preserves archived file times by default, but if another extraction method is used, this should be revalidated.

If you want to be stricter, cross-check with memory-image internal timing metadata (for example via a Volatility info plugin) and compare with filesystem metadata.

Build the final payload

Assemble fields in required order:

DisableTime_EventID_HostName_SystemTime
2026-02-26T15:58:36_5001_hkctf-night01_2026-02-26T16:12:32

Flag

PUCTF26{2026-02-26T15:58:36_5001_hkctf-night01_2026-02-26T16:12:32}

Reflection

This mini challenge is straightforward, but it highlights important IR habits: inventory artifacts first, pick the most specific log channel for the hypothesis, and validate key fields from at least two sources. The timestamp piece is also a good reminder that extracted file metadata carries assumptions. That matters more in later mini challenges where cross-artifact correlation becomes the core difficulty.