Incident #1599 - XDR Test Manager

HIGH 'Ransomware Activity - 426137677' along with 4 other issues

RESOLVED SECURITY TESTING ID: #1599 | Created: 2026-01-15 00:42:25

Alerts

Hosts

Files

Network

Incident Overview

'Ransomware Activity - 426137677' along with 4 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 5

Modified 2026-01-15 01:18

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (4)

TA0005 - Defense Evasion TA0040 - Impact TA0004 - Privilege Escalation TA0002 - Execution

Techniques (6)

T1059 - Command and Scripting Interpreter T1495 - Firmware Corruption T1657 - Financial Theft T1140 - Deobfuscate/Decode Files or Information T1059.001 - Command and Scripting Interpreter: PowerShell T1486 - Data Encrypted for Impact

Related Alerts 5

ID	Severity	Name	Host	Action	Time
33506	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-15 01:17
33504	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-15 01:03
33494	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-15 00:49
33492	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-15 00:49
33481	HIGH	Ransomware Activity - 426137677	dwshin	Prevented (Blocked)	01-15 00:42

File Artifacts 15

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
TRACERT.EXE	-	`25a8379ff79786067a91202b0499fee07550b85082a3d49d89ea300be5b70e93`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
VaultCmd.exe	-	`26a872c8e10cb4264b595561f2a45266dd11412186696875a6ce3d549af9edf0`	SIGNATURE_SIGNED	UNKNOWN	VT
nltest.exe	-	`30a57ee3e29e7e7bbbd3504d1c285cea1115ec7d1d770e990d9fbf15bc7b5525`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
PATHPING.EXE	-	`6b2ef14f9a9fa38fdcf3f8d3f3b26e508f5ad53448d95abce56c0e9b48a18878`	SIGNATURE_SIGNED	UNKNOWN	VT
HOSTNAME.EXE	-	`8ff283fb7a282a9b2b30235016669dfe795665bcbb254fd17ac31fa9308d89d9`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 5

Process	Command Line	Parent Process	User
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Resolution Notes

Auto resolved by XdrTestManager (alerts: 5)

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-15 01:18:08

Incident Modified

Status or details updated

01-15 01:18:08

Incident Resolved

resolved security testing

01-15 01:17:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-15 01:03:12

Powershell Activity - 3083271452

high - Prevented (Blocked)

01-15 00:49:07

Suspicious Process Creation

medium - Prevented (Blocked)

01-15 00:49:02

WildFire Malware

medium - Prevented (Blocked)

01-15 00:42:25

Incident Created

#1599 - 'Ransomware Activity - 426137677' along with 4 other issues

01-15 00:42:25

MegaGenerator.exe

Verdict: Unknown

01-15 00:42:25

UltimateXdrGenerator.exe

Verdict: Unknown

01-15 00:42:25

regsvr32.exe

Verdict: Unknown

01-15 00:42:25

cmd.exe

Verdict: Unknown

01-15 00:42:25

conhost.exe

Verdict: Unknown

01-15 00:42:25

reg.exe

Verdict: Unknown

01-15 00:42:25

TRACERT.EXE

Verdict: Unknown

01-15 00:42:25

powershell.exe

Verdict: Unknown

01-15 00:42:25

rundll32.exe

Verdict: Unknown

01-15 00:42:25

VaultCmd.exe

Verdict: Unknown

01-15 00:42:12

Ransomware Activity - 426137677

high - Prevented (Blocked)