# Incident Response Report: PCAP Network Intrusion Analysis (Carnage)

**Target Environment:** TryHackMe — Carnage  
**Data Source:** `carnage.pcap`  
**Classification:** TLP:CLEAR / Portfolio Case Study  
**Lead Investigator:** Abraham John (AJ) — Systems Architect & Cybersecurity Specialist  
**Report Date:** August 2026  

---

## 1. Executive Summary
A network-level incident response investigation was conducted on packet capture data (`carnage.pcap`) following a suspected workstation compromise. The multi-stage intrusion began with a malicious phishing email lure delivering a password-protected ZIP archive containing a macro-enabled Excel document (`chart-1530076591.xls`). Execution initiated TLS callbacks to staging infrastructure (`finejewels.com.au`, `thietbiagt.com`, `new.americold.com`), followed by periodic HTTP POST check-ins to a first-stage Command and Control (C2) server (`maldivehost.net`), and culminated in the deployment of Cobalt Strike beaconing channels (`survmeter.live`, `securitybusinpuff.com`). Perimeter containment and IP/domain IOC blocks were enacted to remediate the compromised endpoint.

---

## 2. Scope & Investigation Methodology
- **Capture File:** `carnage.pcap`
- **Analysis Tools:** Wireshark, NetworkMiner, Brim, VirusTotal Community Intelligence
- **Protocols Analyzed:** DNS, HTTP, TLS/SSL, TCP Streams, SMTP

---

## 3. Key Findings & Technical Walkthrough
1. **Initial Access / Delivery:** The victim host downloaded a malicious ZIP archive from `attirenepal.com` containing `chart-1530076591.xls`.
2. **First-Stage C2 Channel:** Automated periodic HTTP POST beacons established contact with `maldivehost.net`.
3. **Cobalt Strike Deployment:** Host transitioned to active Cobalt Strike beaconing over TLS with external IPs resolving to `survmeter.live` and `securitybusinpuff.com`.
4. **IP Discovery & Spam Propagation:** The malware performed public IP discovery via `api.ipify.org` and initiated outbound SMTP traffic on port 8080.

---

## 4. Indicators of Compromise (IoCs)
- `attirenepal.com` (Delivery Staging)
- `maldivehost.net` (First-Stage C2)
- `survmeter.live` (Cobalt Strike C2)
- `securitybusinpuff.com` (Cobalt Strike C2)
- `185.125.204.174:8080` (Outbound Spam Relay)

---

## 5. Containment & Remediation
1. Block all identified C2 domains and IPs at firewall and recursive DNS resolvers.
2. Isolate compromised workstation from internal network.
3. Enforce macro execution restrictions across all Microsoft Office environments.