WinSec – SkillsWA2025

In the SkillsUSA SLSC CyberSecurity competition for Washington, this Windows image was used for one of the challenges in the Endpoint Hardening category. This image can be used for general-purpose defensive cybersecurity training and forensics!

Download Image Here

Note that online scoring won’t work and you’ll get a team ID error, but local scoring should still work!

WARNING! This image contains simulated malware which might trigger network intrusion protection!

Forensic Questions

Forensic questions need to be scored manually:

QuestionAnswerHint
On your Windows VM (Windows Workstation challenge), what is the name of the vulnerable update service?MacroSoftUpdaterLook through services.msc for unusual services.
What is the path to the registry key that the vulnerable service loads for settings?  We believe this was tampered with.Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MacroSoftUpdateServiceThis can be found by either exporting the entire HKLM registry key to a text file and then searching for “MacroSoft”, or using SysInternals Process Monitor to check what registry keys the service is using.
On the Windows VM (Windows Workstation challenge), a few minutes after login, a glitching video appears.  If you select the video and type the Konami Code, a secret message appears.

(Konami Code = up up down down left right left right b a)

Where in the registry is this secret message defined?		Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecretValueThis can be found by either exporting the entire HKLM registry key to a text file and then searching for the message that appears, or using SysInternals Process Monitor to check what registry keys are accessed by the process between launch and typing the code.

Scored Items

The following items are automatically scored on the VM:

TypeItem
PenaltyRemoved authorized administrators from Administrators group
PenaltyRemoved authorized users or administrators from the computer
ScoredRemoved unauthorized users from the computer
ScoredRemoved unauthorized admins from the Administrators group
ScoredRemoved unauthorized users from the rdpusers group
ScoredAdded authorized RDP user ‘pward’ to rdpusers group
ScoredRemoved insecure share ‘inetpub’
ScoredRemoved unnecessary DHCP server role
PenaltyRemoved or broke IIS
ScoredRemoved ASP.NET backdoor C:\inetpub\wwwroot\radish.aspx
ScoredConfigured authorized rdpusers security policy SeRemoteInteractiveLogonRight=rdpusers
ScoredConfigured Ctrl+Alt+Delete for login
ScoredConfigured maximum password age
ScoredConfigured password hashing
ScoredConfigured password complexity requirements
ScoredConfigured password minimum length
ScoredConfigured account lockout threshold
ScoredConfigured logon failure auditing
ScoredDisabled guest login
ScoredRemoved pirated media (C:\inetpub\wwwroot\seed\1951126.torrent)
ScoredRemoved malware component C:\Program Files\Windows Defender\en-US\McSwim.exe
ScoredRemoved malware component scheduled task JustKeepSwimming
ScoredRemoved hacking tool John The Ripper C:\john-1.9.0
ScoredRemoved hacking tool Wireshark
ScoredRemoved pirating tool qBittorrent
ScoredRemoved or zeroed malware component registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AzurePortalSetup
ScoredRemoved or zeroed malware component registry key HKLM\SYSTEM\CurrentControlSet\Control\SecretValue
ScoredRemoved malware component launch file C:\Windows\Media\Calligraphy\calligraphy.bat
ScoredRemoved malware component stealth file C:\Windows\BrowserCore\invisible.vbs
ScoredRemoved malware component launch file C:\Windows\PLA\retro.bat
ScoredRemoved malware component exe C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.exe
ScoredRemoved malware media file C:\Program Files (x86)\Windows NT\TableTextServices\en-US\M5lltY1VjpU.mpv