Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	RDP
Tags	Post Reboot Rename Access Suspicious Domain Service Deletion Service Creation Download and Execute Successful RDP Login Service Configuration Service Start System Shutdown RDP Execute from Share Morto Service Stop Access Share Known Malware DNS Query
Associated Attack Servers	dos1.jifr.net flt1.jifr.net ms.jifr.co.be ms.jifr.co.cc ms.jifr.info ms.jifr.net 1.10.141.6

Basic Information

IP Address	24.4.116.118
Domain	-
ISP	-
Country	United States
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2023-08-26
Last seen in Akamai Guardicore Segmentation	2023-12-27

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using RDP with the following credentials: administrator / **** - Authentication policy: White List	Successful RDP Login
a.dll was loaded from the remote share \\tsclient\a by c:\windows\system32\rundll32.exe	Execute from Share
The file c:\windows\clb.dllbak was downloaded and loaded by c:\windows\regedit.exe	Download and Execute
c:\windows\system32\services.exe installed and started c:\windows\temp\ntshrui.dll as a service named Ias under service group netsvcs	Service Start Service Creation
Process netsvcs Service Group attempted to access suspicious domains: dos1.jifr.net, flt1.jifr.net, ms.jifr.co.be, ms.jifr.info and ms.jifr.net	Access Suspicious Domain DNS Query
Service Ias was stopped	Service Stop
c:\windows\regedit.exe installed c:\windows\system32\sens32.dll as a service named SENS under service group netsvcs	Service Creation
c:\windows\offline web pages\cache.txt was renamed to c:\windows\system32\sens32.dll by c:\windows\system32\svchost.exe ( pending reboot )	Post Reboot Rename
Process netsvcs Service Group attempted to access domains: ms.jifr.co.cc	DNS Query
Process netsvcs Service Group generated outgoing network traffic to: 74.125.71.104:80
c:\windows\system32\rundll32.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified	System Shutdown
c:\windows\system32\winlogon.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified	System Shutdown
Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\ntshrui.dll	SHA256: 9b4b383eec7f67aebfa77356c03984f33d1d6cdf2f3164845aa69eb0e09445a8	6672 bytes
c:\windows\clb.dllbak	SHA256: 9dadd53b0e5650f3634708934c68e8c966a6f955d36d162ae143d30e120f34a9	6672 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files