Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	MSSQL SMB
Tags	MSSQL Execute MsSql Shell Command Service Deletion SMB Share Connect File Operation By CMD Service Start Download and Execute Successful SMB Login System File Modification Service Stop Service Creation Download File User Added to Group SMB Brute Force SMB Null Session Login SMB IDS - Attempted User Privilege Gain User Created CMD Successful MSSQL Login
Associated Attack Servers	v.beahh.com

Basic Information

IP Address	115.79.221.53
Domain	-
ISP	Viettel Group
Country	Viet Nam
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2020-06-27
Last seen in Akamai Guardicore Segmentation	2023-12-26

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)	SMB Brute Force Successful SMB Login
c:\windows\system32\services.exe installed and started %systemroot%\acszgcbf.exe as a service named MnxK under service group None	Service Start Service Creation
C:\Windows\temp\svchost.exe was downloaded	Download File
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change	IDS - Attempted User Privilege Gain
IDS detected Attempted User Privilege Gain : sp_password - password change	IDS - Attempted User Privilege Gain
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution	IDS - Attempted User Privilege Gain
The file C:\Windows\ACSZGCBF.exe was downloaded and executed	Download and Execute
A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times	SMB Brute Force Successful SMB Login
c:\windows\system32\services.exe installed and started %systemroot%\jdqkgttg.exe as a service named Meap under service group None	Service Start Service Creation
The file C:\Windows\JdQkGttG.exe was downloaded and executed	Download and Execute
Service Meap was stopped	Service Stop
c:\windows\system32\services.exe installed and started %systemroot%\kjywkaqo.exe as a service named GFdP under service group None	Service Start Service Creation
System file C:\Windows\AppCompat\Programs\Amcache.hve was modified	System File Modification
The file C:\Windows\kjYwKAqo.exe was downloaded and executed	Download and Execute
A user logged in using MSSQL with the following credentials: sa / ****** - Authentication policy: White List	Successful MSSQL Login
A user logged in using MSSQL with the following credentials: sa / ****** - Authentication policy: Previously Approved User	Successful MSSQL Login
MSSQL executed 1 shell commands	Execute MsSql Shell Command
Service GFdP was stopped	Service Stop
c:\windows\system32\services.exe installed and started %systemroot%\lvmbxecd.exe as a service named DfLc under service group None	Service Start Service Creation
User k8h3d was created with the password *********** added to groups: Administrators and logged in using SMB	Successful SMB Login User Added to Group User Created
The file C:\Windows\Lvmbxecd.exe was downloaded and executed	Download and Execute
A user logged in using SMB with the following username: k8h3d - Authentication policy: Correct Password (Part of a Brute Force Attempt)	SMB Brute Force Successful SMB Login
c:\windows\system32\services.exe installed and started %systemroot%\acpxfrvf.exe as a service named kkxg under service group None	Service Start Service Creation
The file C:\Windows\aCPXFrvF.exe was downloaded and executed	Download and Execute
A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 4 times	SMB Brute Force Successful SMB Login
c:\windows\system32\services.exe installed and started %systemroot%\wsnvnbny.exe as a service named Qquv under service group None	Service Start Service Creation
C:\Windows\Temp\tmp.vbs was downloaded	Download File
The file C:\Windows\WSNVnbNY.exe was downloaded and executed	Download and Execute
Connection was closed due to timeout
Service Qquv was stopped	Service Stop

Associated Files

C:\WINDOWS\ueuSkDWp.exe	SHA256: 2fea32ab23ab642a9a3d54aeac03517e9bcac11faf4ea20faaac536e581330c7	975000 bytes
C:\WINDOWS\ueuSkDWp.exe	SHA256: 3440576f1f76c70387e97ce853a92bcf6a3014570615ccd23da4c996357454a0	2795000 bytes
C:\WINDOWS\Temp\svchost.exe	SHA256: 369c2982ea7947053116498f61d1e45e697378bc9a131106bde51b9c76d6b5b7	650000 bytes
C:\AAWjAHIc.exe	SHA256: 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71	56320 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files