Windows Server 2012 R2 - RTP detection to a blocked website

[stdiozg]

Hello

I'm managing a Windows Server 2012 R2 which hosts multiple websites. I've installed Malwarebytes for Teams (Trial) today and ran a full scan, no threats were detected.

However, after a while a Malwarebytes popup was displayed, notifying me about an RTP detection. According to your website it's Ransom.Locky and while Malwarebytes blocked the website successfully, I still would like to remove the source so it doesn't happen again. However, I can't figure out from which process/service the call came from. Is there any way to retrieve that information? Do I have a malware on the server which tries to connect to the blocked IP address?

I've attached the log details and the log json file.

Thank you for your help and support!

log_details.txt log_json.txt

[stdiozg]

Another RTP detection event just happened, this time a call to 65.49.20.68 was tried. See attached files for more information.

Again, unfortunately I can't identify where the call came from.

log_2_details.txt log_2_json.txt

[TwinHeadedEagle]

Hi,

This is an Inbound block so it means someone is trying to exploit a vulnerability on your server. Make sure you patch it.

HAFNIUM targeting Exchange Servers with 0-day exploits - Microsoft Security

Released: March 2021 Exchange Server Security Updates - Page 4 - Microsoft Tech Community

Edited March 22, 2021 by AdvancedSetup
corrected font issue

[stdiozg]

Hi TwinHeadedEagle

Thanks for your quick reply! So the server is receiving requests from the blacklisted IPs above, it's not actually sending a request to these IPs, right?

Just want to understand things correctly :)

Thanks!

[TwinHeadedEagle]

That is correct.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you