Incident #1428 - XDR Test Manager

HIGH 'Ransomware Activity - 426137677' along with 6 other issues

RESOLVED SECURITY TESTING ID: #1428 | Created: 2026-01-12 14:43:13

Alerts

Hosts

Files

Network

Incident Overview

'Ransomware Activity - 426137677' along with 6 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 7

Modified 2026-01-12 15:20

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (5)

TA0040 - Impact TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0004 - Privilege Escalation

Techniques (7)

T1059 - Command and Scripting Interpreter T1218.005 - System Binary Proxy Execution: Mshta T1495 - Firmware Corruption T1657 - Financial Theft T1071.001 - Application Layer Protocol: Web Protocols T1486 - Data Encrypted for Impact T1218.007 - System Binary Proxy Execution: Msiexec

Related Alerts 7

ID	Severity	Name	Host	Action	Time
30411	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-12 15:18
30404	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-12 15:11
30403	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-12 15:11
30391	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 15:04
30380	HIGH	Ransomware Activity - 426137677	dwshin	Prevented (Blocked)	01-12 14:57
30377	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 14:50
30352	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-12 14:43

File Artifacts 17

File Name	Path	SHA256	Signature	Verdict	Actions
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
ftp.exe	-	`42f18d21d381f6eb0ad4eb9d057de87a98dc16f2a8eae3386dc2f08892ab23b3`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
ROUTE.EXE	-	`2987a6ae73dbd9f86ef2cd136a809bb200d2ea2f8beeecd545fc73ea1110c745`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
EXCEL.EXE	-	`0791706bca883c6f96cf5e9781c8ec1b5232dc85badc3b8fc5a73cead88c7e29`	SIGNATURE_SIGNED	UNKNOWN	VT
Notepad.exe	-	`3d5b56ec5cbe064e10b9525ef74359a4e6b83a9c3341f5fbaac629bce80b6817`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 7

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-12 15:20:05

Incident Modified

Status or details updated

01-12 15:20:05

Incident Resolved

resolved security testing

01-12 15:18:09

Network Connection - 1971152322

high - Prevented (Blocked)

01-12 15:11:08

Staged Malware Activity - 2394207323

high - Prevented (Blocked)

01-12 15:11:08

Script Activity - 3055004603

high - Prevented (Blocked)

01-12 15:04:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-12 14:57:11

Ransomware Activity - 426137677

high - Prevented (Blocked)

01-12 14:50:05

Suspicious Process Creation

medium - Prevented (Blocked)

01-12 14:43:13

Incident Created

#1428 - 'Ransomware Activity - 426137677' along with 6 other issues

01-12 14:43:13

UltimateXdrGenerator.exe

Verdict: Unknown

01-12 14:43:13

powershell.exe

Verdict: Unknown

01-12 14:43:13

conhost.exe

Verdict: Unknown

01-12 14:43:13

cmd.exe

Verdict: Unknown

01-12 14:43:13

cscript.exe

Verdict: Unknown

01-12 14:43:13

chcp.com

Verdict: Unknown

01-12 14:43:13

certutil.exe

Verdict: Unknown

01-12 14:43:13

bitsadmin.exe

Verdict: Unknown

01-12 14:43:13

mshta.exe

Verdict: Unknown

01-12 14:43:13

ftp.exe

Verdict: Unknown

01-12 14:43:04

Suspicious Process Creation

medium - Prevented (Blocked)