Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	RDP
Tags	Service Configuration RDP Access Share Service Deletion System Shutdown Service Stop Morto Download and Execute Access Suspicious Domain Execute from Share DNS Query Service Creation Post Reboot Rename Service Start Known Malware Successful RDP Login
Associated Attack Servers	flt1.jifr.net ms.jifr.co.be ms.jifr.co.cc ms.jifr.info ms.jifr.net 1.10.141.6

Basic Information

IP Address	36.85.36.46
Domain	-
ISP	-
Country	Indonesia
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2024-01-13
Last seen in Akamai Guardicore Segmentation	2024-01-13

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using RDP with the following credentials: administrator / **** - Authentication policy: White List	Successful RDP Login
a.dll was loaded from the remote share \\tsclient\a by c:\windows\system32\rundll32.exe	Execute from Share
c:\windows\system32\services.exe installed and started c:\windows\temp\ntshrui.dll as a service named Ias under service group netsvcs	Service Creation Service Start
The file C:\WINDOWS\Temp\ntshrui.dll was downloaded and loaded by c:\windows\system32\svchost.exe	Download and Execute
c:\windows\regedit.exe installed c:\windows\system32\sens32.dll as a service named SENS under service group netsvcs	Service Creation
Process netsvcs Service Group attempted to access suspicious domains: flt1.jifr.net, ms.jifr.co.be, ms.jifr.info and ms.jifr.net	DNS Query Access Suspicious Domain
Service Ias was stopped	Service Stop
c:\windows\offline web pages\cache.txt was renamed to c:\windows\system32\sens32.dll by c:\windows\system32\svchost.exe ( pending reboot )	Post Reboot Rename
Process netsvcs Service Group attempted to access domains: ms.jifr.co.cc	DNS Query
Process netsvcs Service Group generated outgoing network traffic to: 74.125.71.104:80
c:\windows\system32\rundll32.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified	System Shutdown
c:\windows\system32\winlogon.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified	System Shutdown
Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\ntshrui.dll

SHA256: ef4c120a1631265b3d6543da4f0743c8966f52dc7755a9a885a6b9f5a48a95de

6672 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files