Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	Download File HTTP Cookie Hijacking SMB Null Session Login Download and Execute CMD Service Start Service Configuration SMB System File Modification Outgoing Connection IDS - A Network Trojan was detected Persistency - Image Hijack Service Creation Access Suspicious Domain File Operation By CMD
Associated Attack Servers	-

Basic Information

IP Address	177.191.121.172
Domain	-
ISP	Algar Telecom
Country	Brazil
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2021-02-20
Last seen in Akamai Guardicore Segmentation	2021-02-20

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010	IDS - A Network Trojan was detected
c:\windows\system32\services.exe installed and started cmd as a service named Apnk under service group None	Service Start Service Creation
Process c:\windows\system32\regsvr32.exe generated outgoing network traffic to: 139.5.177.32:8032 and 217.195.153.116:80	Outgoing Connection
The file c:\windows\temp\conhoy.exe was downloaded and executed 3 times	Download and Execute
Process c:\windows\temp\conhoy.exe generated outgoing network traffic to: 103.124.105.246:80, 104.233.207.172:8172 and 137.175.56.104:80	Outgoing Connection
Process c:\windows\temp\conhoy.exe attempted to access suspicious domains: hosteons.com	Access Suspicious Domain Outgoing Connection
System file c:\windows\temp\conhoy.exe was modified 4 times	System File Modification
C:\windows\Temp\wmia.bat was downloaded	Download File
C:\WINDOWS\Temp\ntuser.dat was downloaded	Download File
The file C:\WINDOWS\Temp\u.exe was downloaded and executed	Download and Execute
C:\WINDOWS\inf\aspnet\lsma12.exe was downloaded	Download File
System file C:\windows\Temp\wmia.bat was modified 4 times	System File Modification
Process c:\windows\temp\u.exe generated outgoing network traffic to: 104.37.187.182:80, 104.37.187.182:8888 and 172.83.155.170:80	Outgoing Connection
Process c:\windows\temp\u.exe attempted to access suspicious domains: grantmindline.com	Access Suspicious Domain Outgoing Connection
c:\windows\debug\item.dat was downloaded	Download File
System file c:\windows\debug\item.dat was modified 4 times	System File Modification
The file C:\WINDOWS\system\msinfo.exe was downloaded and executed	Download and Execute
The file C:\WINDOWS\system32\wpcap.dll was downloaded and loaded by c:\windows\system\msinfo.exe	Download and Execute
The file C:\WINDOWS\system32\packet.dll was downloaded and loaded by c:\windows\system32\cacls.exe	Download and Execute
Connection was closed due to user inactivity
c:\windows\system32\reg.exe set the command line ntsd -d to run using Persistency - Image Hijack 3 times	Persistency - Image Hijack

Akamai Security Intelligence Group

Guardicore CENTRA

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow