Incident #37 - XDR Test Manager

HIGH 'Malware Activity - 2737417481' along with 56 other issues

RESOLVED SECURITY TESTING ID: #37 | Created: 2026-01-01 09:07:32

Alerts

Hosts

Files

Network

Incident Overview

'Malware Activity - 2737417481' along with 56 other issues generated by XDR Agent detected on host dwshin involving user dwshin

Alert Count 57

Modified 2026-01-01 13:53

Assigned To Unassigned

Sources XDR Agent

Alert Categories

Malware

Affected Hosts & Users

Hosts (1)

Users (1)

dwshin

MITRE ATT&CK Mapping

Tactics (6)

TA0002 - Execution TA0005 - Defense Evasion TA0011 - Command and Control TA0003 - Persistence TA0004 - Privilege Escalation TA0006 - Credential Access

Techniques (16)

T1059 - Command and Scripting Interpreter T1562.004 - Impair Defenses: Disable or Modify System Firewall T1546.007 - Event Triggered Execution: Netsh Helper DLL T1218.005 - System Binary Proxy Execution: Mshta T1003.002 - OS Credential Dumping: Security Account Manager T1552.001 - Unsecured Credentials: Credentials In Files T1218 - System Binary Proxy Execution T1071.001 - Application Layer Protocol: Web Protocols T1140 - Deobfuscate/Decode Files or Information T1036.005 - Masquerading: Match Legitimate Resource Name or Location T1059.001 - Command and Scripting Interpreter: PowerShell T1218.010 - System Binary Proxy Execution: Regsvr32 T1059.006 - Command and Scripting Interpreter: Python T1218.007 - System Binary Proxy Execution: Msiexec T1552.002 - Unsecured Credentials: Credentials in Registry T1102.002 - Web Service: Bidirectional Communication

Related Alerts 57

ID	Severity	Name	Host	Action	Time
777	HIGH	Impair Defenses - 2363038651	dwshin	Prevented (Blocked)	01-01 13:49
773	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 13:47
762	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-01 13:36
761	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 13:33
756	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-01 13:26
755	HIGH	Bypass Attempt - 911079455	dwshin	Prevented (Blocked)	01-01 13:26
753	HIGH	Persistency - 1983659418	dwshin	Prevented (Blocked)	01-01 13:23
748	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Detected (Reported)	01-01 13:19
749	HIGH	Protection Against Security Measures Bypass Techniques - 1952317967	dwshin	Prevented (Blocked)	01-01 13:19
744	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-01 13:12
745	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-01 13:12
743	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-01 13:05
737	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 12:57
736	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-01 12:54
735	HIGH	SYNC - Credential Gathering - 1082701410	dwshin	Prevented (Blocked)	01-01 12:51
727	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 12:44
725	HIGH	SYNC - Credential Gathering - 1082701410	dwshin	Prevented (Blocked)	01-01 12:37
723	HIGH	File Drop - 3732557733	dwshin	Detected (Reported)	01-01 12:31
722	HIGH	File Drop - 1815185192	dwshin	Prevented (Blocked)	01-01 12:31
718	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-01 12:30
711	HIGH	Masquerading - 2438700916	dwshin	Prevented (Blocked)	01-01 12:23
710	HIGH	Malware Activity - 2737417481	dwshin	Prevented (Blocked)	01-01 12:23
708	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 12:18
704	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-01 12:16
700	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 12:09
699	HIGH	SYNC - Credential Gathering - 1082701410	dwshin	Prevented (Blocked)	01-01 12:05
698	HIGH	SYNC - Credential Gathering - 2237270456	dwshin	Prevented (Blocked)	01-01 12:02
693	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 11:55
691	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 11:55
689	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-01 11:48
686	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-01 11:48
682	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-01 11:34
681	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-01 11:34
676	HIGH	Staged Malware Activity - 2394207323	dwshin	Prevented (Blocked)	01-01 11:27
675	HIGH	Script Activity - 3055004603	dwshin	Prevented (Blocked)	01-01 11:27
673	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 11:20
668	HIGH	Masquerading - 2438700916	dwshin	Detected (Reported)	01-01 11:13
667	HIGH	Malware Activity - 2737417481	dwshin	Detected (Reported)	01-01 11:13
661	HIGH	Evasion Technique - 527483761	dwshin	Prevented (Blocked)	01-01 11:06
656	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 10:52
650	HIGH	File Drop - 1815185192	dwshin	Detected (Reported)	01-01 10:45
651	HIGH	File Drop - 3732557733	dwshin	Prevented (Blocked)	01-01 10:45
649	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-01 10:42
645	HIGH	Powershell Activity - 3083271452	dwshin	Prevented (Blocked)	01-01 10:38
644	HIGH	Powershell Activity - 3990759154	dwshin	Prevented (Blocked)	01-01 10:38
642	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-01 10:31
638	HIGH	Credential Gathering Protection - 122198212	dwshin	Prevented (Blocked)	01-01 10:24
632	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-01 10:10
621	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-01 09:56
614	HIGH	Bypass Attempt - 911079455	dwshin	Prevented (Blocked)	01-01 09:49
615	HIGH	File Drop - 2775215878	dwshin	Prevented (Blocked)	01-01 09:49
609	MEDIUM	Suspicious Process Creation	dwshin	Prevented (Blocked)	01-01 09:42
600	MEDIUM	WildFire Malware	dwshin	Prevented (Blocked)	01-01 09:36
599	HIGH	Network Connection - 1971152322	dwshin	Prevented (Blocked)	01-01 09:35
591	HIGH	Protection Against Security Measures Bypass Techniques - 1940197314	dwshin	Prevented (Blocked)	01-01 09:21
579	HIGH	Masquerading - 2438700916	dwshin	Prevented (Blocked)	01-01 09:07
578	HIGH	Malware Activity - 2737417481	dwshin	Prevented (Blocked)	01-01 09:07

File Artifacts 42

File Name	Path	SHA256	Signature	Verdict	Actions
MegaGenerator.exe	-	`117c0c81c476b45223bd5e35ddb52be50ec8462c71227445050e38f2a830aa52`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
cmd.exe	-	`64afc6db3aad1289533662e2d79e27dd55c7dcdb8cd918b08e145ad82ad5acb4`	SIGNATURE_SIGNED	UNKNOWN	VT
UltimateXdrGenerator.exe	-	`64affb2786b4cf64498dd4ddccee413981902611a07d1b38045ec03fa1397504`	SIGNATURE_UNAVAILABLE	UNKNOWN	VT
conhost.exe	-	`6651a3beb0df1e66363a950c37dc9305f185d161fb03761e172ccfa0a4ab4f89`	SIGNATURE_SIGNED	UNKNOWN	VT
powershell.exe	-	`0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46`	SIGNATURE_SIGNED	UNKNOWN	VT
chcp.com	-	`8d75e783f327f899a42927fc2927f0e3d1ec62c4ca1dc88de04dd67de9ae555d`	SIGNATURE_SIGNED	UNKNOWN	VT
cscript.exe	-	`6b896080492b2f559c49c4e3fb8eba89d883b53ef2c974bd8939281e123f8715`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`fda7026477256845afab371e354c4d512896665f1761939cb5887d0a9dec257a`	SIGNATURE_SIGNED	UNKNOWN	VT
certutil.exe	-	`5ee9dc956e9f67f33f2ca0776d7dce4bc0b6bf2cf5005bf2644f0b36accceaf4`	SIGNATURE_SIGNED	UNKNOWN	VT
python.exe	-	`511a52421372762b0c566a8173cdfa45d9829bcf0e21ca33cdddc4b945735da9`	SIGNATURE_SIGNED	UNKNOWN	VT
reg.exe	-	`ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0`	SIGNATURE_SIGNED	UNKNOWN	VT
regsvr32.exe	-	`f379c637eb2250f0cdae05918035a37f3fdf89d6b2ad897da235c5f603fe2a1e`	SIGNATURE_SIGNED	UNKNOWN	VT
schtasks.exe	-	`b96af3066f0b9de8a460f77baae006c5372a266be18c561daa7c7ae8635d399d`	SIGNATURE_SIGNED	UNKNOWN	VT
net.exe	-	`bb3e638c8b5b6ef80847e364aeef2796cad25d3539cf9b41d3820fa48943e777`	SIGNATURE_SIGNED	UNKNOWN	VT
HOSTNAME.EXE	-	`8ff283fb7a282a9b2b30235016669dfe795665bcbb254fd17ac31fa9308d89d9`	SIGNATURE_SIGNED	UNKNOWN	VT
mshta.exe	-	`1f1aabe87e5e93a8fff769bf3614dd559c51c80fc045e11868f3843d9a004d1e`	SIGNATURE_SIGNED	UNKNOWN	VT
whoami.exe	-	`23240ef9f8b0a9a324110b1c2331de31dc1b0e08f5359cb707e51a939af56cd3`	SIGNATURE_SIGNED	UNKNOWN	VT
aimgr.exe	-	`90f3ed0876860e85bb9053c754b76929b848417d28caf5fc5743329665fb29a2`	SIGNATURE_SIGNED	UNKNOWN	VT
msiexec.exe	-	`677417ba3ad87f73cd95ad30423998c6089e7eef381b309a562cda1eb6fe178e`	SIGNATURE_SIGNED	UNKNOWN	VT
rundll32.exe	-	`4193f529bff2729769d82cb83ee206d2af16c59208d6dc5cd8b54cd9c6703a11`	SIGNATURE_SIGNED	UNKNOWN	VT
ARP.EXE	-	`a1c6fed72b64ce1acf5f5157ea38202ab8bfa2deef6677b5d1b95eb088de0fa7`	SIGNATURE_SIGNED	UNKNOWN	VT
net1.exe	-	`8489db35375d890314eb8f7cd9e0cbd3866475f4e252865f00f649b0a02fd757`	SIGNATURE_SIGNED	UNKNOWN	VT
WINWORD.EXE	-	`f3bd3d2a365048cdf444d97f8815aca6307ae8615b5508703f2be1b102837cc4`	SIGNATURE_SIGNED	UNKNOWN	VT
ai.exe	-	`c76ba120a582b0a69335c993380da7d9fc5a1599dbc107fe236bbba762e843b7`	SIGNATURE_SIGNED	UNKNOWN	VT
EXCEL.EXE	-	`0791706bca883c6f96cf5e9781c8ec1b5232dc85badc3b8fc5a73cead88c7e29`	SIGNATURE_SIGNED	UNKNOWN	VT
calc.exe	-	`81bd48985fa1753e9e2158a7cf969141edddbd050e976801bb477e24a2a06b2a`	SIGNATURE_SIGNED	UNKNOWN	VT
cmstp.exe	-	`6069d2ac168e49a4283c57193e1bf158df4040e66ea634afac4339a1ee7ec557`	SIGNATURE_SIGNED	UNKNOWN	VT
netsh.exe	-	`0fbb280ccb403e51bd9b798f5f1159981f6d575248aaea656fa7982b6f454e3e`	SIGNATURE_SIGNED	UNKNOWN	VT
ftp.exe	-	`42f18d21d381f6eb0ad4eb9d057de87a98dc16f2a8eae3386dc2f08892ab23b3`	SIGNATURE_SIGNED	UNKNOWN	VT
nslookup.exe	-	`72f2fbf04f12e5140d5b3505341c7022872e7b24febe9bfbdc37f09e5042d72c`	SIGNATURE_SIGNED	UNKNOWN	VT
timeout.exe	-	`106490870753d87d0c5a1b4fe83045a06518d415ec595bd1d0c30fe3ed4149c1`	SIGNATURE_SIGNED	UNKNOWN	VT
tasklist.exe	-	`62800679c55682f2f5f38b3df9080d12480bea78b5b8476eace9df014f353b14`	SIGNATURE_SIGNED	UNKNOWN	VT
bitsadmin.exe	-	`5ceec3064d495f73aad77facf9d0b05a89b3a137fc86ba1b43c14b3ca3bd3e11`	SIGNATURE_SIGNED	UNKNOWN	VT
vssadmin.exe	-	`ca35cb78f589520db0eaa2af0453dc472e6aa75709a6cb3053dc38f125024e50`	SIGNATURE_SIGNED	UNKNOWN	VT
at.exe	-	`16885037343ccdf6f1f2061fc769c27ec3333918a2d95c7d7b7d176818c056a0`	SIGNATURE_SIGNED	UNKNOWN	VT
forfiles.exe	-	`715b741d06464a7c5f3b67fec479806bf83543498e04e73b5a2e364bc07968b9`	SIGNATURE_SIGNED	UNKNOWN	VT
explorer.exe	-	`11aef65ef73c2d8fdf6688fbbd16f60c1b58641c46405a1b0fb0f9c2c5b35402`	SIGNATURE_SIGNED	UNKNOWN	VT
wermgr.exe	-	`c142d90a7a76a449ac0ffad77b4e87d0d44cbf7fb6975f57dbab1eb616157a6e`	SIGNATURE_SIGNED	UNKNOWN	VT
sc.exe	-	`a452bfcb6000d03942ddfaddcda5a7eb121447ed99b1ba090446b4a989f1f7ae`	SIGNATURE_SIGNED	UNKNOWN	VT
systeminfo.exe	-	`a220a85750588f5b231ff8cb106ba5409eaabb85e3dd7278a98fca907e171ed2`	SIGNATURE_SIGNED	UNKNOWN	VT
wevtutil.exe	-	`3c4c4fe2fc5590a6af5e5f73b7277da8785695e6a131d255943a88e43cdd2a6a`	SIGNATURE_SIGNED	UNKNOWN	VT
PktMon.exe	-	`43f22720206a268a43dd02bfc6cc60b47185832247188d7772f2e97109aa8f56`	SIGNATURE_SIGNED	UNKNOWN	VT

Network Artifacts 0

No network artifacts found for this incident

Process Artifacts 57

Process	Command Line	Parent Process	User
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
python.exe	`"C:\Users\andsi\AppData\Local\Python\pythoncore-3.14-64\python.exe" incident_g...`	-	dwshin
MegaGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\MegaGenerator\bin\publish\MegaGenerator.exe" ...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
UltimateXdrGenerator.exe	`"C:\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\UltimateXdrG...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_incident_runner.bat...`	-	dwshin
cmd.exe	`C:\Windows\SYSTEM32\cmd.exe /c ""C:\cortex-xdr-siem-test\xdr_ultimate_runner.bat...`	-	dwshin

Registry Artifacts 0

No registry artifacts found for this incident

Analyst Verdict

Classification

Risk Level

HIGH

Recommended Actions

Isolate affected endpoints
Investigate all related alerts
Document findings

Summary

Alerts

Hosts

Files

Network

Alert Categories

Malware

Timeline

01-01 13:53:05

Incident Modified

Status or details updated

01-01 13:53:05

Incident Resolved

resolved security testing

01-01 13:49:06

Impair Defenses - 2363038651

high - Prevented (Blocked)

01-01 13:47:09

Suspicious Process Creation

medium - Prevented (Blocked)

01-01 13:36:04

Network Connection - 1971152322

high - Prevented (Blocked)

01-01 13:33:13

Suspicious Process Creation

medium - Prevented (Blocked)

01-01 13:26:04

File Drop - 2775215878

high - Prevented (Blocked)

01-01 13:26:03

Bypass Attempt - 911079455

high - Prevented (Blocked)

01-01 13:23:34

Persistency - 1983659418

high - Prevented (Blocked)

01-01 13:19:04

Protection Against Security Measures Bypass Techniques - 1952317967

high - Detected (Reported)

01-01 13:19:02

Protection Against Security Measures Bypass Techniques - 1952317967

high - Prevented (Blocked)

01-01 13:12:04

File Drop - 3732557733

high - Prevented (Blocked)

01-01 13:12:04

File Drop - 1815185192

high - Prevented (Blocked)

01-01 13:05:09

Credential Gathering Protection - 122198212

high - Prevented (Blocked)

01-01 12:57:04

Suspicious Process Creation

medium - Prevented (Blocked)

01-01 12:54:01

WildFire Malware

medium - Prevented (Blocked)

01-01 12:51:10

SYNC - Credential Gathering - 1082701410

high - Prevented (Blocked)

01-01 12:44:13

Suspicious Process Creation

medium - Prevented (Blocked)

01-01 12:37:11

SYNC - Credential Gathering - 1082701410

high - Prevented (Blocked)

01-01 12:31:05

File Drop - 3732557733

high - Detected (Reported)

01-01 12:31:04

File Drop - 1815185192

high - Prevented (Blocked)

01-01 12:30:07

Network Connection - 1971152322

high - Prevented (Blocked)

01-01 12:23:16

Masquerading - 2438700916

high - Prevented (Blocked)

01-01 12:23:16

Malware Activity - 2737417481

high - Prevented (Blocked)

01-01 12:18:21

Suspicious Process Creation

medium - Prevented (Blocked)