CaseVegas

Scenario

In this CyberDefenders challenge you are a SOC analyst, and you have been instructed to find a suspect who was employed in a major hotel chain and was responsible for the theft of US$ 3.5 million from his employers.

When you were given the instruction, you were busy with another investigation and immediately abandoned that to start this new investigation. You were also meant to be home hours ago to take your loved one to a nice restaurant for a well-deserved dinner and relaxation time.

During the investigation, your attempt to find the suspect was recorded in the included video. Analyze the video and other files and try to extract answers for some of the case questions.

Instructions:

Unzip the challenge (pass: cyberdefenders.org)
Use a media player like VLC so you can increase video playing speed to save your time.
We recommend going through all questions once before answering questions. This way, you can watch the video evidence file once and extract answers.

Tools used

Google maps
DuckDuckGo
Google Street View

Questions

Q1 File->Vehicle-number.png: At which minute of the video was the vehicle observed?

35 minutes

Q2 File->Vehicle-number.png: What is the zip code of the place where the vehicle was observed in the video.?

Address OASIS Hotel on the left in the screen

Q3 File->Chapel: This chapel has a live webcam. What is the name of the chapel?

At 27:33 in the vid, the name can be read. Officially it is called The Little Chapel of Hearts, but the answer to the question that worked was Elvis Wedding Chapel.

Q4 File->Chapel: What strip hotel does the chapel have a view of?

The Strat

Q5 What date did the Mandalay Bay shooting take place?

01/10/2017

Q6 On 30/09/2017 at 14:47, Stephen Paddock was seen on CCTV footage. Where was he?

In the Footage of Stephen Paddock before October 1 shooting at 59:24, we can see him in an elevator:

CCTV footage

Q7 File->Vehicle.png: This vehicle may be related to our investigation. What place did it go to?

In the video given by the challenge at 30:52 minutes, the car turns right behind the Tux & Gown.

Q8 Find MGM financial report in the form of a PDF document (not website) which contains the words: ‘Consolidated net revenues increased 13% compared to the prior-year Quarter to $3.2 billion’ Submit the URL as an answer.

Don’t try with DuckDuckGo. Use Google.

Q9 File->Number: What is the complete number?

From 33:12 onward, look behind the “Wedding Chapel sign”:

The Number