{"EventID":4624,"TimeCreated":"2024-11-01T07:18:44Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","TargetUserName":"svc_backup","TargetDomainName":"LIFETECHPHARMA","TargetLogonId":"0x2c8a991","LogonType":3,"LogonProcessName":"NtLmSsp","AuthenticationPackageName":"NTLM","WorkstationName":"WS-IT-LEVI","IpAddress":"10.10.3.22","IpPort":50114,"LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"NTLM V2","KeyLength":128,"analyst_note":"svc_backup SMB logon to SERVER-RD-02, 4 min after first C2 beacon (07:14 IST) — first access to R&D server"}
{"EventID":4672,"TimeCreated":"2024-11-01T07:18:44Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2c8a991","PrivilegeList":"SeSecurityPrivilege\nSeBackupPrivilege\nSeRestorePrivilege\nSeDebugPrivilege","analyst_note":"Elevated privileges for svc_backup on SERVER-RD-02"}
{"EventID":5140,"TimeCreated":"2024-11-01T07:19:02Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2c8a991","ObjectType":"File","IpAddress":"10.10.3.22","IpPort":50114,"ShareName":"\\\\*\\LicenseDeals","ShareLocalPath":"D:\\LicenseDeals","AccessMask":"0x1","analyst_note":"Share access to LicenseDeals — first browse/reconnaisance of formula directory"}
{"EventID":4624,"TimeCreated":"2024-11-06T00:09:44Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","TargetUserName":"svc_backup","TargetDomainName":"LIFETECHPHARMA","TargetLogonId":"0x2e91b88","LogonType":3,"LogonProcessName":"NtLmSsp","AuthenticationPackageName":"NTLM","WorkstationName":"WS-IT-LEVI","IpAddress":"10.10.3.22","IpPort":50888,"LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"NTLM V2","KeyLength":128,"analyst_note":"⚠ svc_backup logon to SERVER-RD-02 at 02:09 IST — off hours, night of exfiltration"}
{"EventID":5145,"TimeCreated":"2024-11-06T00:10:01Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectType":"File","IpAddress":"10.10.3.22","IpPort":50888,"ShareName":"\\\\*\\LicenseDeals","ShareLocalPath":"D:\\LicenseDeals","RelativeTargetName":"USPartner2024","AccessMask":"0x120089","AccessList":"%%4416\n%%4423\n%%4424","analyst_note":"⚠ Read access to USPartner2024 directory — formula package enumeration begins"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:14Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\API-FORMULA-BIO-001-FINAL.xlsx","HandleId":"0x1f88","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 1/47 — formula file READ + TIMESTAMP MODIFIED"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:18Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\API-FORMULA-BIO-002-FINAL.xlsx","HandleId":"0x1f89","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 2/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:21Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\API-FORMULA-GENERIC-003.xlsx","HandleId":"0x1f8a","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 3/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:24Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\NDA-SIGNED-2024-09-12.pdf","HandleId":"0x1f8b","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 4/47 — signed NDA document"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:27Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\SYNTHESIS-ROUTE-COMPOUND-A.docx","HandleId":"0x1f8c","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 5/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:30Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\SYNTHESIS-ROUTE-COMPOUND-B.docx","HandleId":"0x1f8d","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 6/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:44Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\QUALITY-CONTROL-BATCH-2024-Q3.xlsx","HandleId":"0x1f8e","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 7/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:10:58Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\STABILITY-STUDY-API-18MONTHS.pdf","HandleId":"0x1f8f","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 8/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:11:12Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\LICENSING-AGREEMENT-DRAFT-v7.docx","HandleId":"0x1f90","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 9/47 — licensing agreement draft"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:12:08Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\IMPURITY-PROFILE-API-COMPOUNDS.xlsx","HandleId":"0x1f91","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 10/47"}
{"EventID":4663,"TimeCreated":"2024-11-06T00:14:02Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","SubjectUserSid":"S-1-5-21-3847948241-1882284908-4023491847-1108","SubjectUserName":"svc_backup","SubjectDomainName":"LIFETECHPHARMA","SubjectLogonId":"0x2e91b88","ObjectServer":"Security","ObjectType":"File","ObjectName":"D:\\LicenseDeals\\USPartner2024\\API-FORMULA-BIO-047-FINAL.xlsx","HandleId":"0x1faf","AccessList":"%%4416\n%%4423","AccessMask":"0x12019f","ProcessId":"0x4","ProcessName":"System","analyst_note":"File 47/47 — last formula file accessed. Exfiltration upload begins 12 seconds later (EID 5156)"}
{"EventID":5156,"TimeCreated":"2024-11-06T00:14:14Z","Computer":"SERVER-RD-02.lifetechpharma.local","Channel":"Security","ProcessId":"0x4","Application":"System","Direction":"Outbound","SourceAddress":"10.10.2.15","SourcePort":50912,"DestAddress":"198.51.100.44","DestPort":443,"Protocol":6,"analyst_note":"⚠ CRITICAL: Outbound HTTPS from SERVER-RD-02 to 198.51.100.44:443 during file access window — exfiltration channel. This IP is secondary C2, not primary (203.0.113.87). Volume confirmed in Palo Alto NGFW: 381 MB outbound."}