Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 89.121.169.7Malicious

IP Address: 89.121.169.7Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

DNS Query File Operation By CMD Access Suspicious Domain CMD SMB Share Connect Scheduled Task Run Service Creation SMB Scheduled Task Creation SMB Null Session Login Service Deletion Service Stop Execute from Share Access Share Download and Execute Service Start Download File Successful SMB Login MSSQL

Associated Attack Servers

t.amynx.com w.zz3r0.com

Basic Information

IP Address

89.121.169.7

Domain

-

ISP

Telekom Romania

Country

Romania

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2019-04-14

Last seen in Akamai Guardicore Segmentation

2023-10-09

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Reached Max Attempts

Successful SMB Login

C:\ZmAgUnoK.exe was downloaded

Download File

c:\windows\system32\services.exe installed and started \\server-backup\c$\zmagunok.exe as a service named GZSU under service group None

Service Creation Service Start

zmagunok.exe was executed from the remote share \\server-backup\c$

Execute from Share

C:\windows\temp\svchost.exe was downloaded

Download File

A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Previously Approved User 9 times

Successful SMB Login

C:\qeeiQhIi.exe was downloaded

Download File

qeeiqhii.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\qeeiqhii.exe as a service named yGaq under service group None

Service Creation Service Start

C:\mEjreQkO.exe was downloaded

Download File

c:\windows\system32\services.exe installed and started \\server-backup\c$\mejreqko.exe as a service named Pbor under service group None

Service Creation Service Start

mejreqko.exe was executed from the remote share \\server-backup\c$

Execute from Share

C:\windows\temp\tmp.vbs was downloaded

Download File

Service yGaq was stopped

Service Stop

Service Pbor was stopped

Service Stop

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User 4 times

Successful SMB Login

Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.zz3r0.com 3 times

DNS Query Access Suspicious Domain

C:\eMfAGHtU.exe was downloaded

Download File

The command line c:\windows\uwzE.exe was scheduled to run by modifying C:\WINDOWS\Tasks\Autostart.job

emfaghtu.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\emfaghtu.exe as a service named ohkw under service group None

Service Creation Service Start

The file C:\WINDOWS\otzOzIcq.exe was downloaded and executed 3 times

Download and Execute

C:\WINDOWS\Temp\tmp.vbs was downloaded

Download File

Service ohkw was stopped

Service Stop

ydknomli.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\ydknomli.exe as a service named uhCX under service group None

Service Creation Service Start

Service uhCX was stopped

Service Stop

Connection was closed due to timeout

Associated Files

C:\WINDOWS\otzOzIcq.exe

SHA256: 03e422b2a6cf1fc7048812303b81b4d742cbccd0dd7678b61715b9e49a687cf5

8230452 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0d0b4b2ff887e2678d63a66935fa3f208dd277db7274bd7a28ca089a266ef3d3

1235000 bytes

C:\WINDOWS\lxoTFV.exe

SHA256: 0f633b9630ea9c0758f636a074086f479a4c46eb0bbb6862dfa0d9b5dcfe9466

2080000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0fb47572e89a69a5a20e0af60abf367ae992d7ec33a98349e00b2ceb928f8d37

390000 bytes

C:\windows\temp\msInstall.exe

SHA256: 24134534c1aeeaf89b361827c142056d65a1447ab129a0b985ed33af0c8d0262

8230452 bytes

C:\WINDOWS\otzOzIcq.exe

SHA256: 2d435933e8f6d4c31f6d0070c62022468055cee2154fdcf91b7f39fc675afaff

8230454 bytes

C:\WINDOWS\UMebZW.exe

SHA256: 308b96e0b46830fecc382c01ec1943b223a4177c22b3c0d0c9dc3ebf0db954e4

260000 bytes

C:\windows\temp\svchost.exe

SHA256: 30d7cf20999e378c99300dd9d4feb69982ed50e73af753f9983ee2dbea1f6322

3380000 bytes

C:\aaNQVLyI.exe

SHA256: 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71

56320 bytes