Incident #1443 - XDR Test Manager

HIGH 'File Drop - 3732557733' along with 64 other issues

RESOLVED SECURITY TESTING ID: #1443 | Created: 2026-01-13 00:25:07

Alerts

Hosts

Files

Network

Incident Overview

'File Drop - 3732557733' along with 64 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 65

Modified 2026-01-13 09:41

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (7)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0008 - Lateral Movement TA0003 - Persistence TA0004 - Privilege Escalation TA0006 - Credential Access

Techniques (14)

T1059 - Command and Scripting Interpreter T1098 - Account Manipulation T1218.005 - System Binary Proxy Execution: Mshta T1207 - Rogue Domain Controller T1552 - Unsecured Credentials T1552.001 - Unsecured Credentials: Credentials In Files T1218 - System Binary Proxy Execution T1071.001 - Application Layer Protocol: Web Protocols T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1218.007 - System Binary Proxy Execution: Msiexec T1550 - Use Alternate Authentication Material T1552.002 - Unsecured Credentials: Credentials in Registry T1102.002 - Web Service: Bidirectional Communication

Related Alerts 65

ID	Severity	Name	Host	Action	Time
31366	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-13 09:37
31364	HIGH	Staged Malware Activity - 4061872954	dwshin	Prevented (Blocked)	01-13 09:30
31362	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-13 09:16
31360	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 09:13
31359	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 09:09
31355	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-13 09:02
31354	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-13 08:48
31353	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-13 08:48
31351	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 08:34
31349	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 08:27
31348	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-13 08:20
31347	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-13 08:13
31346	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 08:13
31344	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 08:07
31343	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 08:06
31342	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 07:38
31339	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 07:31
31338	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-13 07:17
31337	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 07:10
31336	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 07:03
31334	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 07:01
31333	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-13 06:56
31331	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-13 06:49
31330	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 06:49
31329	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 06:35
31326	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-13 06:21
31325	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-13 06:21
31324	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-13 06:14
31323	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-13 06:00
31321	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 05:55
31320	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-13 05:39
31318	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 05:32
31316	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 05:18
31314	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 04:57
31313	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-13 04:50
31311	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 04:49
31309	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 04:43
31308	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-13 04:36
31306	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 04:29
31304	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-13 04:22
31303	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 04:08
31302	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-13 03:54
31301	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 03:47
31299	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 03:43
31298	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-13 03:33
31296	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-13 03:26
31294	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-13 03:19
31293	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 03:05
31292	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-13 02:51
31291	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-13 02:37
31289	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 02:37
31287	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 02:30
31286	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-13 02:23
31284	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 02:16
31283	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-13 02:02
31282	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-13 02:02
31281	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 02:02
31279	HIGH	File Drop - 3732557733	dwshin	Detected (Reported)	01-13 01:55
31280	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-13 01:55
31278	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-13 01:34
31275	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 01:31
31274	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-13 01:27
31270	HIGH	Staged Malware Activity - 4061872954	dwshin	Prevented (Blocked)	01-13 00:45
31267	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-13 00:31
31265	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-13 00:25

File Artifacts 44

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
forfiles.exe	-	`715b741d06464a7c5f3b67fec479806bf83543498e04e73b5a2e364bc07968b9`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
ROUTE.EXE	-	`2987a6ae73dbd9f86ef2cd136a809bb200d2ea2f8beeecd545fc73ea1110c745`	SIGNATURE_SIGNED	UNKNOWN	VT
wscript.exe	-	`5919e37adbf233d1aadf793959eeeb7d1eba073b23b3572016564b407f0ad93f`	SIGNATURE_SIGNED	UNKNOWN	VT
ipconfig.exe	-	`ac7966280133df541509eb0676e4b2f994bac65e960c79415ccf9f12e17dac5c`	SIGNATURE_SIGNED	UNKNOWN	VT
Notepad.exe	-	`3d5b56ec5cbe064e10b9525ef74359a4e6b83a9c3341f5fbaac629bce80b6817`	SIGNATURE_SIGNED	UNKNOWN	VT
WINWORD.EXE	-	`f3bd3d2a365048cdf444d97f8815aca6307ae8615b5508703f2be1b102837cc4`	SIGNATURE_SIGNED	UNKNOWN	VT
ai.exe	-	`c76ba120a582b0a69335c993380da7d9fc5a1599dbc107fe236bbba762e843b7`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT
PktMon.exe	-	`43f22720206a268a43dd02bfc6cc60b47185832247188d7772f2e97109aa8f56`	SIGNATURE_SIGNED	UNKNOWN	VT
timeout.exe	-	`106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1`	SIGNATURE_SIGNED	UNKNOWN	VT
NETSTAT.EXE	-	`09bca819ab371a2d4f62ca5114c1335c38fd196ae7956e2fc4d154bbe55c3f4c`	SIGNATURE_SIGNED	UNKNOWN	VT
bcdedit.exe	-	`b70fdd47fc8b23b90394a2c1037d3ae77fc2a2e6e8440dd7edda955c4317f469`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
cmstp.exe	-	`6069d2ac168e49a4283c57193e1bf158df4040e66ea634afac4339a1ee7ec557`	SIGNATURE_SIGNED	UNKNOWN	VT
vssadmin.exe	-	`ca35cb78f589520db0eaa2af0453dc472e6aa75709a6cb3053dc38f125024e50`	SIGNATURE_SIGNED	UNKNOWN	VT
msconfig.exe	-	`03ad90335327756748643d4e7e5e3cd8630417b5dd7ffb6f8977014ab894d5d0`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
TRACERT.EXE	-	`25a8379ff79786067a91202b0499fee07550b85082a3d49d89ea300be5b70e93`	SIGNATURE_SIGNED	UNKNOWN	VT
cmdkey.exe	-	`4125cd7966810cdfafb18157c276a88e6ac443c7c98d42593c70247045815028`	SIGNATURE_SIGNED	UNKNOWN	VT
systeminfo.exe	-	`a220a85750588f5b231ff8cb106ba5409eaabb85e3dd7278a98fca907e171ed2`	SIGNATURE_SIGNED	UNKNOWN	VT
HOSTNAME.EXE	-	`8ff283fb7a282a9b2b30235016669dfe795665bcbb254fd17ac31fa9308d89d9`	SIGNATURE_SIGNED	UNKNOWN	VT
explorer.exe	-	`11aef65ef73c2d8fdf6688fbbd16f60c1b58641c46405a1b0fb0f9c2c5b35402`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 65

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Bulk resolved via XdrTestManager IncidentLive

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-13 09:41:25

Incident Modified

Status or details updated

01-13 09:41:25

Incident Resolved

resolved security testing

01-13 09:37:03

Network Connection - 1971152322

high - Prevented (Blocked)

01-13 09:30:23

Staged Malware Activity - 4061872954

high - Prevented (Blocked)

01-13 09:16:14

Credential Gathering Protection - 510630382

high - Prevented (Blocked)

01-13 09:13:02

WildFire Malware

medium - Prevented (Blocked)

01-13 09:09:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 09:02:04

File Drop - 2775215878

high - Prevented (Blocked)

01-13 08:48:09

Script Activity - 3055004603

high - Prevented (Blocked)

01-13 08:48:09

Staged Malware Activity - 2394207323

high - Prevented (Blocked)

01-13 08:34:03

File Drop - 3732557733

high - Prevented (Blocked)

01-13 08:27:06

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 08:20:28

Protection Against Security Measures Bypass Techniques - 1940197314

high - Prevented (Blocked)

01-13 08:13:15

File Drop - 1815185192

high - Prevented (Blocked)

01-13 08:13:14

File Drop - 3732557733

high - Prevented (Blocked)

01-13 08:07:02

WildFire Malware

medium - Prevented (Blocked)

01-13 08:06:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 07:38:08

File Drop - 3732557733

high - Prevented (Blocked)

01-13 07:31:02

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 07:17:11

Protection Against Security Measures Bypass Techniques - 1952317967

high - Prevented (Blocked)

01-13 07:10:10

File Drop - 3732557733

high - Prevented (Blocked)

01-13 07:03:09

Suspicious Process Creation

medium - Prevented (Blocked)

01-13 07:01:02

WildFire Malware

medium - Prevented (Blocked)

01-13 06:56:03

File Drop - 2775215878

high - Prevented (Blocked)

01-13 06:49:07

File Drop - 1815185192

high - Prevented (Blocked)