2026-08-09 - TRAFFIC ANALYSIS EXERCISE: FIRST TO LAST

NOTE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILE:

• Zip archive of the pcap:  2026-08-09-traffic-analysis-exercise.pcap.zip   12,8 MB (12,792,967 bytes)

BACKGROUND

You’re covering a shift for an analyst at your organization’s Security Operations Center (SOC). You see the following alerts:

• 02:13 UTC - ET MALWARE FormBook CnC Checkin (GET) – 172.64.155[.]76:80
• 02:14 UTC - ET MALWARE FormBook CnC Checkin (GET) – 146.59.71[.]167:80
• 02:14 UTC - ET MALWARE FormBook CnC Checkin (GET) – 38.182.168[.]246:80
• 02:15 UTC - ET MALWARE FormBook CnC Checkin (GET) – 45.130.41[.]161:80
• 02:15 UTC - ET MALWARE FormBook CnC Checkin (GET) – 172.67.162[.]153:80
• 02:16 UTC - ET MALWARE FormBook CnC Checkin (GET) – 121.54.163[.]148:80

This is followed by further alerts for FormBook CnC Checkin for the next few minutes.

You retrieve a packet capture (pcap) of traffic during the time of the alert, and you intend to identify that infected host.

The characteristics of your environment are:

• LAN segment range:  172.16.8[.]0/24   (172.16.8[.]0 through 172.16.8[.]255)
• Domain:  firsttolast[.]tech
• AD environment name:  FIRSTTOLAST
• Active Directory (AD) domain controller:  172.16.8[.]2 - FIRSTTOLAST-DC
• LAN segment gateway:  172.16.8[.]1
• LAN segment broadcast address:  172.16.8[.]255

Armed with pcap, you intend to find that infected host.

Shown above: The pcap for this traffic analysis exercise opened in Wireshark.

YOUR TASK

For this exercise, answer the following questions for your incident report:

• What is the IP address of the infected Windows client?
• What is the MAC address of the infected Windows client?
• What is the host name of the infected Windows client?
• What is the user account name from the infected Windows client?
• What is the full name of the user from the user account?

ANSWERS

• Click here for the answers.

Click here to return to the main page.