ContAInment TryHackMe Walkthrough

📅 Published April 18, 2026 ·ctfforensicsincident-responseai-security

TryHackMe: ContAInment — Full Walkthrough

Introduction

In this TryHackMe room, we investigate a ransomware-style incident affecting the workstation of Oliver Deer at West Tech. The goal is to trace the attacker’s entry point, inspect their activity, recover the hidden data, and complete the containment process.

The room combines endpoint investigation, email forensics, archive recovery, and a little automation with the local AI assistant.

Initial Setup

After connecting to the target machine through SSH, we first explored the usual user directories to understand the workstation layout.

ssh o.deer@10.66.157.154

We checked places like:

A ransom note was present on the desktop, which confirmed that the system had been compromised.

Desktop ransom note

Using the AI Assistant

This room provides an AI assistant running locally on the same system. It helps with analysis tasks such as:

We accessed it here:

http://10.66.157.154:7860/?__theme=light

AI assistant interface

Finding the Phishing Email

Inside the Mail directory, we found multiple .eml files. These were email communication logs, and they were clearly important for identifying the attacker’s initial access.

Mail directory with EML files

To quickly identify the suspicious email, we asked the AI assistant to search the folder for phishing content:

Can you search the files in this directory /home/o.deer/Mail for phish

The AI identified the most likely malicious email as:

INVOICE - URGENT REVIEW REQUIRED

AI identifies phishing email

We then matched that subject to the actual file in the Mail directory:

2025-06-17_invoice_required_review.eml

Opening the file showed that the phish delivered a malicious script called invoice_payload.scr.

Phishing email content

Malicious attachment reference

Locating the Malicious Payload

Since downloaded files are usually stored in a download-related directory, we searched for the payload name across the filesystem:

find . -name invoice_payload.scr

Finding the payload

This confirmed the malicious file’s location and helped us understand the attack chain.

PCAP Analysis and the Encryption Key Hint

A hint later revealed that the attacker had accidentally exfiltrated working notes, and the fragments were hidden in a PCAP file. Those fragments contained the key needed to recover encrypted files.

We moved to the Documents directory and found a pcap_dump folder with dated subdirectories.

Since the phishing email was dated 2025-06-17, we examined that same date folder.

PCAP directory structure

Inside the directory, we saw multiple PCAP files. Most were small, but one stood out due to its larger size:

PCAP files list

Instead of manually reconstructing the traffic, we used the AI tool’s PCAP helper:

can you reassemble session_4444_dump.pcap at directory /home/o.deer/Documents/pcap_dumps/2025-06-17

The AI successfully reassembled the file and stored the result here:

/home/o.deer/qwen-output/reassembled_data_dump.txt

PCAP reassembly result

Reading the reconstructed output revealed a useful term:

westtechvictim1

Extracted PCAP notes

This looked like a likely password or decryption clue, so we tested it against the encrypted archive.

Unlocking the Archive

Back in the home directory, we attempted to unlock the encrypted ZIP using the recovered string:

unzip -P "westtechvictim1" westtech_*.zip

Unlocking ZIP archive

This worked and gave access to the project directory.

We then moved into the extracted workspace:

cd ~/home/o.deer/westtech_projects/

Project directory

The directory contained several useful files:

Understanding the Flag Challenge

The file thm_flags.txt contained a large set of base64-encoded strings.

Encoded flag list

To understand the goal, we opened thm_flags_guide.txt.

Flag guide 1

Flag guide 2

The guide explained that:

thm{n1,n2,n3,n4,n5}

Final Prompt for the AI Tool

We asked the assistant to process the file automatically:

Process the file thm_flags.txt located at directory /home/o.deer/westtech_projects/ containing 500 base64-encoded entries by decoding each string individually, converting it into the format thm{n1,n2,n3,n4,n5}, extracting the five numbers (each between 10–99), and then using the available liberty_prime tool (which works on a single flag at a time) to evaluate each decoded entry; iterate through all entries, ignore malformed ones, and identify the only flag that contains exactly 3 prime numbers, returning just that final valid flag.

The correct flag was hidden by the room’s instructions in the output screenshot.

Final flag output

Conclusion

This room was a good example of how an incident response investigation can combine multiple skills:

A manual approach was possible, but the AI helper saved a lot of time while still keeping the investigation grounded in evidence.