IP Address: 38.87.206.57Previously Malicious
IP Address: 38.87.206.57Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
MSSQL |
Tags |
DNS Query PowerShell System File Modification Executable File Modification File Operation By CMD IDS - Attempted User Privilege Gain Service Configuration Download and Execute MSSQL Download File MYSQL Port 445 Scan Persistency - Print Monitors Service Stop Outgoing Connection SMB Access Suspicious Domain CMD HTTP Execute MsSql Shell Command Successful MSSQL Login |
Associated Attack Servers |
down.ftp21.cc members.3322.org opendata.baidu.com wmi.362-com.com |
IP Address |
38.87.206.57 |
|
Domain |
- |
|
ISP |
- |
|
Country |
United States |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2022-12-05 |
Last seen in Akamai Guardicore Segmentation |
2023-01-04 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using MSSQL with the following credentials: sa / *********** - Authentication policy: Reached Max Attempts |
Successful MSSQL Login |
MSSQL executed 1 shell commands |
Execute MsSql Shell Command |
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_reg* - registry access |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution |
IDS - Attempted User Privilege Gain |
Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc |
DNS Query Access Suspicious Domain |
System file C:\Windows\AppCompat\Programs\Amcache.hve was modified 4 times |
System File Modification |
The file C:\Windows\Temp\MSSQLH.exe was downloaded and executed |
Download and Execute |
c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors |
Persistency - Print Monitors |
Service LanmanServer was stopped |
Service Stop |
Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: down.ftp21.cc and wmi.362-com.com |
DNS Query Access Suspicious Domain Outgoing Connection |
Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:23 |
Outgoing Connection |
Executable file C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\ODSOLE70.dll was modified |
Executable File Modification |
C:\WINDOWS\Temp\MpMgSvc.dll was downloaded |
Download File |
System file C:\WINDOWS\Temp\MpMgSvc.dll was modified 4 times |
System File Modification |
Process c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe attempted to access suspicious domains: down.ftp21.cc |
DNS Query Access Suspicious Domain Outgoing Connection |
Process c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe generated outgoing network traffic to: 222.99.11.155:80 |
Outgoing Connection |
System file C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\436bd23db5f3a6b8799945332afc0899\System.Configuration.ni.dll.aux was modified |
System File Modification |
PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe |
|
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: down.ftp21.cc |
DNS Query Access Suspicious Domain Outgoing Connection |
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 222.99.11.155:80 |
Outgoing Connection |
The file C:\Windows\Temp\MpMgSvc.exe was downloaded and executed |
Download and Execute |
The file C:\Windows\Temp\TQ_CLR.exe was downloaded and executed |
Download and Execute |
Process c:\windows\temp\mpmgsvc.exe attempted to access suspicious domains: members.3322.org |
DNS Query Access Suspicious Domain |
Process c:\windows\temp\mpmgsvc.exe attempted to access domains: opendata.baidu.com |
DNS Query |
Process c:\windows\temp\mpmgsvc.exe generated outgoing network traffic to: 35.189.0.10:445, 35.189.0.11:445, 35.189.0.12:445, 35.189.0.13:445, 35.189.0.14:445, 35.189.0.15:445, 35.189.0.16:445, 35.189.0.17:445, 35.189.0.18:445, 35.189.0.19:445, 35.189.0.20:445, 35.189.0.21:445, 35.189.0.22:445, 35.189.0.23:445, 35.189.0.24:445, 35.189.0.25:445, 35.189.0.26:445, 35.189.0.27:445, 35.189.0.28:445, 35.189.0.29:445, 35.189.0.2:445, 35.189.0.30:445, 35.189.0.31:445, 35.189.0.32:445, 35.189.0.33:445, 35.189.0.3:445, 35.189.0.4:445, 35.189.0.5:445, 35.189.0.6:445, 35.189.0.7:445, 35.189.0.8:445 and 35.189.0.9:445 |
|
Process c:\windows\temp\mpmgsvc.exe scanned port 445 on 32 IP Addresses |
Port 445 Scan |
Connection was closed due to user inactivity |
|