Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 38.87.206.57Previously Malicious

IP Address: 38.87.206.57Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL

Tags

DNS Query PowerShell System File Modification Executable File Modification File Operation By CMD IDS - Attempted User Privilege Gain Service Configuration Download and Execute MSSQL Download File MYSQL Port 445 Scan Persistency - Print Monitors Service Stop Outgoing Connection SMB Access Suspicious Domain CMD HTTP Execute MsSql Shell Command Successful MSSQL Login

Associated Attack Servers

down.ftp21.cc members.3322.org opendata.baidu.com wmi.362-com.com

211.57.200.17 222.99.11.155

Basic Information

IP Address

38.87.206.57

Domain

-

ISP

-

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-12-05

Last seen in Akamai Guardicore Segmentation

2023-01-04

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using MSSQL with the following credentials: sa / *********** - Authentication policy: Reached Max Attempts

Successful MSSQL Login

MSSQL executed 1 shell commands

Execute MsSql Shell Command

IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_reg* - registry access

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution

IDS - Attempted User Privilege Gain

Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Access Suspicious Domain

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified 4 times

System File Modification

The file C:\Windows\Temp\MSSQLH.exe was downloaded and executed

Download and Execute

c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors

Persistency - Print Monitors

Service LanmanServer was stopped

Service Stop

Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: down.ftp21.cc and wmi.362-com.com

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:23

Outgoing Connection

Executable file C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\ODSOLE70.dll was modified

Executable File Modification

C:\WINDOWS\Temp\MpMgSvc.dll was downloaded

Download File

System file C:\WINDOWS\Temp\MpMgSvc.dll was modified 4 times

System File Modification

Process c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe generated outgoing network traffic to: 222.99.11.155:80

Outgoing Connection

System file C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\436bd23db5f3a6b8799945332afc0899\System.Configuration.ni.dll.aux was modified

System File Modification

PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 222.99.11.155:80

Outgoing Connection

The file C:\Windows\Temp\MpMgSvc.exe was downloaded and executed

Download and Execute

The file C:\Windows\Temp\TQ_CLR.exe was downloaded and executed

Download and Execute

Process c:\windows\temp\mpmgsvc.exe attempted to access suspicious domains: members.3322.org

DNS Query Access Suspicious Domain

Process c:\windows\temp\mpmgsvc.exe attempted to access domains: opendata.baidu.com

DNS Query

Process c:\windows\temp\mpmgsvc.exe generated outgoing network traffic to: 35.189.0.10:445, 35.189.0.11:445, 35.189.0.12:445, 35.189.0.13:445, 35.189.0.14:445, 35.189.0.15:445, 35.189.0.16:445, 35.189.0.17:445, 35.189.0.18:445, 35.189.0.19:445, 35.189.0.20:445, 35.189.0.21:445, 35.189.0.22:445, 35.189.0.23:445, 35.189.0.24:445, 35.189.0.25:445, 35.189.0.26:445, 35.189.0.27:445, 35.189.0.28:445, 35.189.0.29:445, 35.189.0.2:445, 35.189.0.30:445, 35.189.0.31:445, 35.189.0.32:445, 35.189.0.33:445, 35.189.0.3:445, 35.189.0.4:445, 35.189.0.5:445, 35.189.0.6:445, 35.189.0.7:445, 35.189.0.8:445 and 35.189.0.9:445

Process c:\windows\temp\mpmgsvc.exe scanned port 445 on 32 IP Addresses

Port 445 Scan

Connection was closed due to user inactivity