Incident #271 - XDR Test Manager

HIGH 'Evasion Technique - 527483761' along with 361 other issues

NEW ID: #271 | Created: 2026-01-03 14:11:24

XDR Console

362

Alerts

Hosts

Files

Network

Incident Overview

'Evasion Technique - 527483761' along with 361 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 362

Modified 2026-01-05 11:55

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (7)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0004 - Privilege Escalation TA0003 - Persistence TA0008 - Lateral Movement TA0006 - Credential Access

Techniques (17)

T1059 - Command and Scripting Interpreter T1098 - Account Manipulation T1218.005 - System Binary Proxy Execution: Mshta T1562.002 - Impair Defenses: Disable Windows Event Logging T1207 - Rogue Domain Controller T1552 - Unsecured Credentials T1218 - System Binary Proxy Execution T1071.001 - Application Layer Protocol: Web Protocols T1552.001 - Unsecured Credentials: Credentials In Files T1140 - Deobfuscate/Decode Files or Information T1036.005 - Masquerading: Match Legitimate Resource Name or Location T1059.001 - Command and Scripting Interpreter: PowerShell T1218.010 - System Binary Proxy Execution: Regsvr32 T1218.007 - System Binary Proxy Execution: Msiexec T1550 - Use Alternate Authentication Material T1552.002 - Unsecured Credentials: Credentials in Registry T1102.002 - Web Service: Bidirectional Communication

Related Alerts 362

ID	Severity	Name	Host	Action	Time
6542	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 11:55
6539	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 11:50
6531	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-05 11:41
6530	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 11:41
6520	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-05 11:34
6521	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 11:34
6510	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 11:27
6494	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-05 11:20
6492	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-05 11:20
6459	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 11:13
6439	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-05 11:06
6440	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 11:06
6441	HIGH	Bypass Attempt - 911079455	dwshin	Prevented (Blocked)	01-05 11:06
6418	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 10:44
6413	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-05 10:38
6407	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 10:31
6384	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-05 10:10
6385	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-05 10:10
6374	HIGH	Malware Activity - 1320008962	dwshin	Prevented (Blocked)	01-05 09:56
6369	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 09:49
6364	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 09:42
6362	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 09:38
6359	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-05 09:35
6349	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 09:28
6341	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 09:21
6327	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-05 09:07
6325	HIGH	File Drop - 4219385159	dwshin	Prevented (Blocked)	01-05 09:07
6326	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 09:07
6312	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-05 08:46
6300	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-05 08:32
6299	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 08:32
6286	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 08:25
6281	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-05 08:18
6280	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-05 08:18
6253	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 07:43
6249	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 07:36
6235	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 07:29
6234	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 07:26
6230	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 07:22
6225	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-05 07:15
6224	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 07:15
6209	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 06:54
6205	HIGH	Staged Malware Activity - 4061872954	dwshin	Prevented (Blocked)	01-05 06:47
6202	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 06:40
6195	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 06:33
6196	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-05 06:33
6181	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 06:20
6178	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 06:19
6159	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 05:58
6153	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 05:51
6143	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 05:30
6133	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 05:23
6128	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-05 05:16
6127	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-05 05:16
6124	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 05:14
6122	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 05:09
6112	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 05:02
6106	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-05 04:55
6099	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-05 04:48
6092	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-05 04:41
6073	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 04:20
6074	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-05 04:20
6062	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 04:08
6056	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-05 04:06
6049	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 03:59
6040	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 03:52
6019	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 03:24
6012	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 03:17
6009	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 03:10
6002	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 03:03
6000	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 03:02
5987	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-05 02:49
5988	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-05 02:49
5979	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-05 02:35
5974	HIGH	File Drop - 3732557733	dwshin	Detected (Reported)	01-05 02:33
5975	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-05 02:33
5946	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-05 02:07
5947	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-05 02:07
5935	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 01:56
5922	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-05 01:39
5898	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 01:25
5889	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-05 01:18
5890	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-05 01:18
5872	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-05 00:57
5865	HIGH	Volume Shadow Deletion Attempt - 1186929355	dwshin	Prevented (Blocked)	01-05 00:51
5862	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-05 00:50
5847	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-05 00:34
5833	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 00:29
5834	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-05 00:29
5818	HIGH	File Drop - 3732557733	dwshin	Detected (Reported)	01-05 00:17
5817	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-05 00:17
5815	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-05 00:15
5809	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-05 00:08
5810	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-05 00:08
5808	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-05 00:08
5788	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 23:44
5787	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 23:40
5771	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 23:26
5767	HIGH	File Drop - 4219385159	dwshin	Detected (Reported)	01-04 23:19
5766	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 23:19
5759	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 23:05
5753	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 22:58
5742	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 22:44
5738	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 22:38
5737	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 22:37
5733	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 22:30
5710	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 22:09
5711	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 22:09
5703	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-04 22:02
5702	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 22:02
5696	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 21:55
5688	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 21:41
5681	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 21:34
5682	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 21:34
5680	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 21:32
5669	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-04 21:27
5662	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 21:20
5663	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 21:20
5656	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 21:13
5646	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 20:59
5632	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 20:38
5625	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 20:31
5617	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 20:26
5612	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 20:24
5608	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 20:17
5600	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 20:10
5595	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 20:03
5591	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 19:56
5587	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 19:49
5585	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 19:42
5579	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 19:35
5564	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 19:21
5562	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 19:20
5557	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 19:14
5554	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 19:07
5547	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-04 19:00
5539	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 18:53
5527	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 18:32
5517	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 18:25
5511	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 18:18
5506	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 18:14
5501	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 18:04
5488	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 17:50
5485	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 17:43
5479	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 17:36
5460	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 17:22
5459	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 17:22
5452	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 17:15
5446	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 17:08
5442	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 17:01
5435	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 16:54
5418	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 16:33
5417	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 16:33
5403	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 16:19
5398	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 16:12
5399	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 16:12
5390	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 16:02
5382	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 15:51
5373	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 15:44
5349	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 15:16
5338	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 14:56
5336	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 14:55
5337	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 14:55
5331	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 14:48
5330	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 14:48
5322	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 14:41
5323	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 14:41
5324	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 14:41
5304	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 14:27
5303	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 14:27
5298	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 14:20
5291	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 14:13
5286	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 14:06
5273	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 13:52
5271	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 13:50
5268	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-04 13:45
5269	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 13:45
5262	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 13:38
5257	HIGH	Malware Activity - 1320008962	dwshin	Prevented (Blocked)	01-04 13:31
5246	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 13:24
5240	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 13:17
5234	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 13:10
5224	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 13:03
5226	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 13:03
5225	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 13:03
5219	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 12:56
5211	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 12:44
5208	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-04 12:42
5186	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 12:28
5185	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 12:28
5187	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 12:28
5181	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 12:21
5171	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 12:14
5172	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 12:14
5163	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 12:00
5157	HIGH	Bypass Attempt - 911079455	dwshin	Prevented (Blocked)	01-04 11:46
5153	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 11:38
5136	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 11:25
5121	HIGH	Masquerading - 221297964	dwshin	Prevented (Blocked)	01-04 11:11
5115	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 11:04
5116	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-04 11:04
5108	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 10:57
5109	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 10:57
5095	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 10:43
5092	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 10:36
5089	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 10:32
5077	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 10:29
5071	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-04 10:22
5056	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 10:08
5055	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 10:08
5034	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-04 09:33
5023	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 09:26
5016	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 09:19
5011	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 09:12
5002	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 09:05
4992	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 08:58
4981	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 08:44
4979	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 08:37
4975	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-04 08:30
4965	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 08:23
4963	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 08:20
4954	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 08:09
4946	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-04 08:02
4942	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 07:55
4931	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 07:41
4916	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 07:27
4911	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 07:20
4902	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 07:14
4896	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 07:06
4888	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 06:59
4875	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-04 06:45
4865	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 06:31
4853	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 06:24
4847	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 06:17
4842	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 06:10
4839	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 06:08
4827	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 05:56
4821	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 05:49
4820	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 05:49
4796	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 05:21
4788	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 05:07
4785	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 05:02
4783	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 05:00
4766	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 04:46
4762	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 04:39
4758	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 04:32
4748	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 04:25
4742	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-04 04:18
4736	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 04:11
4731	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 04:04
4732	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 04:04
4726	HIGH	File Drop - 4219385159	dwshin	Detected (Reported)	01-04 03:57
4725	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 03:57
4723	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 03:56
4718	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 03:50
4708	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 03:36
4685	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-04 03:15
4684	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-04 03:15
4678	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 03:08
4661	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 02:50
4659	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 02:47
4656	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 02:40
4655	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 02:40
4643	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-04 02:33
4642	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-04 02:33
4631	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 02:26
4630	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-04 02:26
4623	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 02:19
4612	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 02:05
4600	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-04 01:51
4599	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-04 01:51
4598	HIGH	Credential Gathering Protection - 510630382	dwshin	Detected (Reported)	01-04 01:51
4590	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 01:44
4591	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-04 01:44
4589	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 01:44
4579	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 01:30
4565	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-04 01:20
4564	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 01:20
4558	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 01:16
4548	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 01:02
4538	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-04 00:48
4531	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-04 00:41
4527	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-04 00:38
4525	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 00:34
4490	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-04 00:06
4483	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 23:59
4478	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 23:52
4473	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 23:45
4462	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 23:38
4458	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 23:32
4446	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-03 23:24
4439	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-03 23:17
4433	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-03 23:10
4426	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-03 23:03
4427	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-03 23:03
4421	HIGH	File Drop - 1815185192	dwshin	Detected (Reported)	01-03 22:56
4420	HIGH	File Drop - 3732557733	dwshin	Detected (Reported)	01-03 22:56
4419	HIGH	File Drop - 4219385159	dwshin	Prevented (Blocked)	01-03 22:56
4415	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 22:49
4412	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 22:42
4407	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 22:35
4395	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 22:26
4391	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-03 22:21
4384	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-03 22:14
4378	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 22:07
4374	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-03 22:00
4368	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 21:53
4362	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 21:46
4358	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-03 21:39
4353	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 21:32
4345	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-03 21:25
4342	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 21:20
4339	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 21:18
4327	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-03 21:04
4317	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-03 20:50
4312	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 20:43
4306	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-03 20:36
4307	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-03 20:36
4293	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 20:22
4289	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-03 20:15
4287	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 20:14
4270	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 19:54
4264	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-03 19:40
4260	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 19:33
4247	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 19:26
4241	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 19:19
4235	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-03 19:12
4229	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 19:08
4223	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 18:58
4214	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-03 18:51
4215	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-03 18:51
4209	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-03 18:44
4205	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 18:37
4189	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-03 18:23
4184	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-03 18:16
4179	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 18:09
4176	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-03 18:02
4175	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 18:02
4166	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-03 17:55
4167	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-03 17:55
4159	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 17:48
4152	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 17:41
4144	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 17:34
4113	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-03 16:59
4110	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 16:56
4103	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-03 16:52
4102	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-03 16:52
4093	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 16:38
4077	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-03 16:24
4074	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-03 16:17
4056	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 15:50
4046	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 15:35
4032	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-03 15:28
4031	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-03 15:28
4027	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-03 15:21
4018	HIGH	Credential Gathering Protection - 3380811775	dwshin	Detected (Reported)	01-03 15:14
4017	HIGH	Credential Gathering Protection - 510630382	dwshin	Prevented (Blocked)	01-03 15:14
3997	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 14:53
3994	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-03 14:46
3992	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-03 14:44
3965	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-03 14:18
3957	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-03 14:11

File Artifacts 58

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
forfiles.exe	-	`715b741d06464a7c5f3b67fec479806bf83543498e04e73b5a2e364bc07968b9`	SIGNATURE_SIGNED	UNKNOWN	VT
wscript.exe	-	`5919e37adbf233d1aadf793959eeeb7d1eba073b23b3572016564b407f0ad93f`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
EXCEL.EXE	-	`0791706bca883c6f96cf5e9781c8ec1b5232dc85badc3b8fc5a73cead88c7e29`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT
systeminfo.exe	-	`a220a85750588f5b231ff8cb106ba5409eaabb85e3dd7278a98fca907e171ed2`	SIGNATURE_SIGNED	UNKNOWN	VT
PresentationHost.exe	-	`0111d485351ef0deffd9403a0f8e123759a04a928fbd055b901de18164c4fa39`	SIGNATURE_SIGNED	UNKNOWN	VT
iexplore.exe	-	`531b2337aeb798032eab3f5e2d5530610987b27845a8b3201893a3d8d755fe3f`	SIGNATURE_SIGNED	UNKNOWN	VT
HOSTNAME.EXE	-	`8ff283fb7a282a9b2b30235016669dfe795665bcbb254fd17ac31fa9308d89d9`	SIGNATURE_SIGNED	UNKNOWN	VT
ipconfig.exe	-	`ac7966280133df541509eb0676e4b2f994bac65e960c79415ccf9f12e17dac5c`	SIGNATURE_SIGNED	UNKNOWN	VT
timeout.exe	-	`106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1`	SIGNATURE_SIGNED	UNKNOWN	VT
cmstp.exe	-	`6069d2ac168e49a4283c57193e1bf158df4040e66ea634afac4339a1ee7ec557`	SIGNATURE_SIGNED	UNKNOWN	VT
ROUTE.EXE	-	`2987a6ae73dbd9f86ef2cd136a809bb200d2ea2f8beeecd545fc73ea1110c745`	SIGNATURE_SIGNED	UNKNOWN	VT
WINWORD.EXE	-	`f3bd3d2a365048cdf444d97f8815aca6307ae8615b5508703f2be1b102837cc4`	SIGNATURE_SIGNED	UNKNOWN	VT
ai.exe	-	`c76ba120a582b0a69335c993380da7d9fc5a1599dbc107fe236bbba762e843b7`	SIGNATURE_SIGNED	UNKNOWN	VT
ARP.EXE	-	`a1c6fed72b64ce1acf5f5157ea38202ab8bfa2deef6677b5d1b95eb088de0fa7`	SIGNATURE_SIGNED	UNKNOWN	VT
Notepad.exe	-	`3d5b56ec5cbe064e10b9525ef74359a4e6b83a9c3341f5fbaac629bce80b6817`	SIGNATURE_SIGNED	UNKNOWN	VT
cmdkey.exe	-	`4125cd7966810cdfafb18157c276a88e6ac443c7c98d42593c70247045815028`	SIGNATURE_SIGNED	UNKNOWN	VT
pcalua.exe	-	`3948168248cde1743f9c7efbf55e3c103a67413db690fc918ed9858c104a89d4`	SIGNATURE_SIGNED	UNKNOWN	VT
msconfig.exe	-	`03ad90335327756748643d4e7e5e3cd8630417b5dd7ffb6f8977014ab894d5d0`	SIGNATURE_SIGNED	UNKNOWN	VT
NETSTAT.EXE	-	`09bca819ab371a2d4f62ca5114c1335c38fd196ae7956e2fc4d154bbe55c3f4c`	SIGNATURE_SIGNED	UNKNOWN	VT
sdclt.exe	-	`8ef091f6e8af0d473acabbdcebef92bd0a8f389f35ebe90111cc820732b8fea2`	SIGNATURE_SIGNED	UNKNOWN	VT
wevtutil.exe	-	`3c4c4fe2fc5590a6af5e5f73b7277da8785695e6a131d255943a88e43cdd2a6a`	SIGNATURE_SIGNED	UNKNOWN	VT
VaultCmd.exe	-	`26a872c8e10cb4264b595561f2a45266dd11412186696875a6ce3d549af9edf0`	SIGNATURE_SIGNED	UNKNOWN	VT
explorer.exe	-	`11aef65ef73c2d8fdf6688fbbd16f60c1b58641c46405a1b0fb0f9c2c5b35402`	SIGNATURE_SIGNED	UNKNOWN	VT
TRACERT.EXE	-	`25a8379ff79786067a91202b0499fee07550b85082a3d49d89ea300be5b70e93`	SIGNATURE_SIGNED	UNKNOWN	VT
wermgr.exe	-	`c142d90a7a76a449ac0ffad77b4e87d0d44cbf7fb6975f57dbab1eb616157a6e`	SIGNATURE_SIGNED	UNKNOWN	VT
PATHPING.EXE	-	`6b2ef14f9a9fa38fdcf3f8d3f3b26e508f5ad53448d95abce56c0e9b48a18878`	SIGNATURE_SIGNED	UNKNOWN	VT
svchost.exe	-	`53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26`	SIGNATURE_SIGNED	UNKNOWN	VT
curl.exe	-	`bec2b15c2fb3e24314c72c69b00e3253ba47e12d6058ab6df043cecfe7db3beb`	SIGNATURE_SIGNED	UNKNOWN	VT
nltest.exe	-	`30a57ee3e29e7e7bbbd3504d1c285cea1115ec7d1d770e990d9fbf15bc7b5525`	SIGNATURE_SIGNED	UNKNOWN	VT
PktMon.exe	-	`43f22720206a268a43dd02bfc6cc60b47185832247188d7772f2e97109aa8f56`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
vssadmin.exe	-	`ca35cb78f589520db0eaa2af0453dc472e6aa75709a6cb3053dc38f125024e50`	SIGNATURE_SIGNED	UNKNOWN	VT
VSSVC.exe	-	`592cc87b3fd1ecd647514b596a8f97b578996a025a502393b808bd2790dfa0c2`	SIGNATURE_SIGNED	UNKNOWN	VT
nbtstat.exe	-	`4b5abcd833a8550ba0e77b55b56d37f6c04ac8213e1344b179e380b1fb289fa6`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 362

Process	Command Line	Parent Process	User
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

362

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-05 11:55:16

Incident Modified

Status or details updated

01-05 11:55:09

Suspicious Process Creation

medium - Prevented (Blocked)

01-05 11:50:01

WildFire Malware

medium - Prevented (Blocked)

01-05 11:41:03

Powershell Activity - 3083271452

high - Prevented (Blocked)

01-05 11:41:02

Powershell Activity - 3990759154

high - Prevented (Blocked)

01-05 11:34:09

Powershell Activity - 3083271452

high - Prevented (Blocked)

01-05 11:34:08

Powershell Activity - 3990759154

high - Prevented (Blocked)

01-05 11:27:02

Evasion Technique - 527483761

high - Prevented (Blocked)

01-05 11:20:04

Protection Against Security Measures Bypass Techniques - 1952317967

high - Detected (Reported)

01-05 11:20:02

Protection Against Security Measures Bypass Techniques - 1952317967

high - Prevented (Blocked)

01-05 11:13:06

Suspicious Process Creation

medium - Prevented (Blocked)

01-05 11:06:08

File Drop - 1815185192

high - Prevented (Blocked)

01-05 11:06:08

File Drop - 3732557733

high - Prevented (Blocked)

01-05 11:06:07

Bypass Attempt - 911079455

high - Prevented (Blocked)

01-05 10:44:01

WildFire Malware

medium - Prevented (Blocked)

01-05 10:38:02

File Drop - 2775215878

high - Prevented (Blocked)

01-05 10:31:08

Suspicious Process Creation

medium - Prevented (Blocked)

01-05 10:10:09

Protection Against Security Measures Bypass Techniques - 1952317967

high - Detected (Reported)

01-05 10:10:07

Protection Against Security Measures Bypass Techniques - 1952317967

high - Prevented (Blocked)

01-05 09:56:27

Malware Activity - 1320008962

high - Prevented (Blocked)

01-05 09:49:05

Suspicious Process Creation

medium - Prevented (Blocked)

01-05 09:42:18

File Drop - 3732557733

high - Prevented (Blocked)

01-05 09:38:01

WildFire Malware

medium - Prevented (Blocked)

01-05 09:35:03

Network Connection - 1971152322

high - Prevented (Blocked)

01-05 09:28:02

Powershell Activity - 3990759154

high - Prevented (Blocked)