Incident #1122 - XDR Test Manager

HIGH 'Masquerading - 221297964' along with 4 other issues

RESOLVED KNOWN ISSUE ID: #1122 | Created: 2026-01-10 06:22:25

Alerts

Hosts

Files

Network

Incident Overview

'Masquerading - 221297964' along with 4 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 5

Modified 2026-01-10 07:00

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (3)

TA0005 - Defense Evasion TA0004 - Privilege Escalation TA0040 - Impact

Techniques (4)

T1495 - Firmware Corruption T1036.005 - Masquerading: Match Legitimate Resource Name or Location T1486 - Data Encrypted for Impact T1657 - Financial Theft

Related Alerts 5

ID	Severity	Name	Host	Action	Time
21389	HIGH	Ransomware Activity - 426137677	dwshin	Prevented (Blocked)	01-10 06:57
21387	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-10 06:50
21333	HIGH	Masquerading - 2438700916	dwshin	Detected (Reported)	01-10 06:29
21332	HIGH	Malware Activity - 2737417481	dwshin	Detected (Reported)	01-10 06:29
21328	HIGH	Masquerading - 221297964	dwshin	Detected (Reported)	01-10 06:22

File Artifacts 22

File Name	Path	SHA256	Signature	Verdict	Actions
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
cmdkey.exe	-	`4125cd7966810cdfafb18157c276a88e6ac443c7c98d42593c70247045815028`	SIGNATURE_SIGNED	UNKNOWN	VT
explorer.exe	-	`11aef65ef73c2d8fdf6688fbbd16f60c1b58641c46405a1b0fb0f9c2c5b35402`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
bcdedit.exe	-	`b70fdd47fc8b23b90394a2c1037d3ae77fc2a2e6e8440dd7edda955c4317f469`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
EXCEL.EXE	-	`0791706bca883c6f96cf5e9781c8ec1b5232dc85badc3b8fc5a73cead88c7e29`	SIGNATURE_SIGNED	UNKNOWN	VT
wevtutil.exe	-	`3c4c4fe2fc5590a6af5e5f73b7277da8785695e6a131d255943a88e43cdd2a6a`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 5

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-10 07:00:05

Incident Modified

Status or details updated

01-10 07:00:05

Incident Resolved

resolved known issue

01-10 06:57:24

Ransomware Activity - 426137677

high - Prevented (Blocked)

01-10 06:50:04

Suspicious Process Creation

medium - Prevented (Blocked)

01-10 06:29:11

Masquerading - 2438700916

high - Detected (Reported)

01-10 06:29:11

Malware Activity - 2737417481

high - Detected (Reported)

01-10 06:22:25

Incident Created

#1122 - 'Masquerading - 221297964' along with 4 other issues

01-10 06:22:25

UltimateXdrGenerator.exe

Verdict: Unknown

01-10 06:22:25

reg.exe

Verdict: Unknown

01-10 06:22:25

conhost.exe

Verdict: Unknown

01-10 06:22:25

cmd.exe

Verdict: Unknown

01-10 06:22:25

cscript.exe

Verdict: Unknown

01-10 06:22:25

certutil.exe

Verdict: Unknown

01-10 06:22:25

rundll32.exe

Verdict: Unknown

01-10 06:22:25

calc.exe

Verdict: Unknown

01-10 06:22:25

powershell.exe

Verdict: Unknown

01-10 06:22:25

python.exe

Verdict: Unknown

01-10 06:22:16

Masquerading - 221297964

high - Detected (Reported)