Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	File Operation By CMD Download and Execute Service Configuration Service Stop Service Creation MSRPC Service Start Service Deletion System Shutdown SMB CMD Successful SMB Login
Associated Attack Servers	113.240.233.41 165.22.101.121 202.61.125.93

Basic Information

IP Address	197.248.174.65
Domain	-
ISP	-
Country	Kenya
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-12-04
Last seen in Akamai Guardicore Segmentation	2024-06-07

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: administrator - Authentication policy: Reached Max Attempts	Successful SMB Login
c:\windows\system32\services.exe installed and started mshta.exe as a service named AC09 under service group None	Service Creation Service Start
A user logged in using SMB with the following username: administrator - Authentication policy: Previously Approved User 2 times	Successful SMB Login
Service msiserver was started	Service Start
The file C:\Windows\Installer\MSI32DA.tmp was downloaded and loaded by c:\windows\syswow64\msiexec.exe	Download and Execute
The file C:\Windows\Installer\MSI3424.tmp was downloaded and loaded by c:\windows\syswow64\msiexec.exe	Download and Execute
c:\windows\system32\services.exe installed and started mshta.exe as a service named AC04 under service group None	Service Creation Service Start
c:\windows\system32\msiexec.exe attempted shutdown of type Shut down the system and then restarted it, as well as any applications that have been registered for restart, Shut down the system and then restarted the system with reason: Unspecified	System Shutdown
c:\windows\system32\wininit.exe attempted shutdown of type Shut down the system and then restarted the system, Shut down the system to a point at which it is safe to turn off the power with reason: Unspecified	System Shutdown
Service UALSVC was stopped	Service Stop
Service PlugPlay was stopped	Service Stop
Service TrkWks was stopped	Service Stop
Service UmRdpService was stopped	Service Stop
Service CertPropSvc was stopped	Service Stop
Service DPS was stopped	Service Stop
Service SQLBrowser was stopped	Service Stop
Service Winmgmt was stopped	Service Stop
Service WinRM was stopped	Service Stop
Service FontCache was stopped	Service Stop
Service TermService was stopped	Service Stop
Service Dhcp was stopped	Service Stop
Service Schedule was stopped	Service Stop
Service IKEEXT was stopped	Service Stop
Service CryptSvc was stopped	Service Stop
Service EventLog was stopped	Service Stop
Service Wcmsvc was stopped	Service Stop
Service msiserver was stopped	Service Stop
Service MSSQL$SQLEXPRESS was stopped	Service Stop
Connection was closed due to user inactivity

Associated Files

C:\Windows\Installer\MSI1E5A.tmp

SHA256: 6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55

144896 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files