Ticket#3536104/STONEHENGE/[##342707##] High - SentinelOne Threat - Stonehenge Advisors, Inc - Advanced_IP_Scanner_2.5.3850.exe -- has been updated - جميع الرسائل الحديثة

This ticket has been updated by John Lewis

John Lewis

5/18/2026 1:39 PM

Reviewed the S1 alert
Advance IP scanner is a known tool used by our technicians.
Checked the timeline on this machine from the date 5/11 and confirmed one of our technicians was on the machine around this time.
Marking as a false positive.
No further action is required.
Closing ticket.

Summary:

[##342707##] High - SentinelOne Threat - Stonehenge Advisors, Inc - Advanced_IP_Scanner_2.5.3850.exe

Status:

Closed

Ticket #

3536104

Company:

Stonehenge Advisors, Inc

Contact:

Dan Sablosky (POC)

Phone:

(215) 320-3777

Address:

4328-42 Ridge Avenue
Suite 104
Philadelphia, PA 19129

View Ticket

Discussion

John Lewis

5/18/2026 1:39 PM-1:40 PM

Dan Sablosky (POC)

5/11/2026 1:21 PM-

{      "@context": "http://schema.org",      "@type": "EmailMessage",      "potentialAction": {        "@type": "ViewAction",        "target": "https://desk.cyflare.cloud/portal/ticket/342707",        "name": "View Ticket "      },      "description": "View Ticket"    }

Dear IH-Atlantic_Stonehenge Advisors,

A ticket has been created with the following details:

Account Name: Atlantic_Stonehenge Advisors
Ticket ID:  342707
Priority:  High
Subject:  High - SentinelOne Threat - Stonehenge Advisors, Inc - Advanced_IP_Scanner_2.5.3850.exe - 05/11/26
Description:

EDR: Advanced_IP_Scanner_2.5.3850.exe

Customer: Stonehenge Advisors, Inc |                            Detected: 2026-05-11 13:01:56 UTC-04

Priority: HighSource: SentineloneThreat status: Mitigated - contained by socKill: SuccessQuarantine: Success
Alert Link:EDR Alert

Executive Summary                AI-Assisted

A suspicious, potentially harmful software item was detected and automatically blocked on an endpoint used by user 'LYNDONPC2\Jennifer' (desktop). The alert is rated high severity due to the software exhibiting obfuscation signs that can evade defenses, posing a risk to data and operations. Mitigation actions were successful and the item has been contained. Business impact risk remains moderate while devices and accounts are monitored.

SOC Response Actions
Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6.
ActionStatus

--- ---
LyndonPC2, no full disk scan command was sent.                        Not Configured
LyndonPC2, endpoint was not isolated from the network.                        Not Configured

Recommended Remediation

[Containment] Isolate host LyndonPC2 (agent UUID 3fc7171f26bd4a859de1e8bf71dfcc32) from network and remove VPN/Wi‑Fi access until remediation is complete.
[Eradication] Remove and securely delete file '\Device\HarddiskVolume3\Users\Jennifer\Downloads\Advanced_IP_Scanner_2.5.3850.exe' and any copies found on the endpoint.
[Eradication] Perform credential actions for user 'LYNDONPC2\Jennifer': force immediate password reset and revoke active sessions and cached credentials.
[Hardening] Validate code signing trust and block publisher 'FAMATECH CORP.' in enterprise application allowlist/denylist if not required by business.
[Hardening] Deploy endpoint IOA/YARA rules or sensor-based prevention to block file hash 87bfb05057f215659cc801750118900145f8a22fa93ac4c6e1bfd81aa98b0a55 and file path patterns for Advanced_IP_Scanner installers.

Key Details
Threat ClassificationMalwareEndpoint NameLyndonPC2
Detection EngineOn-Write DFI - SuspiciousEndpoint IP Address20.13.55.205
File Path\Device\HarddiskVolume3\Users\Jennifer\Downloads\Advanced_IP_Scanner_2.5.3850.exeSite NameStonehenge Advisors
File Hash87bfb05057f215659cc801750118900145f8a22fa93ac4c6e1bfd81aa98b0a55 MaliciousGroup Name Stonehenge Advisors Inc - LYNDON KPG-MCG Curtis Tenant LLC
File Publisher NameFAMATECH CORP.SentinelOne Mitigation Policyprotect
File Publisher Signed & VerifiedSignedVerifiedSentinelOne Mitigation Statusmitigated
Command Line"C:\Users\Jennifer\Downloads\Advanced_IP_Scanner_2.5.3850.exe"
SOC Findings
Threat Intelligence & Reputation
VirusTotal

87bfb050...a98b0a55
Malicious
File hash detected by 4 security engines. Classified under the meaningful name Advanced_IP_Scanner_2.5.3850.exe.
Hybrid-Analysis

87bfb050...a98b0a55
Not Malicious
No malicious engines were detected when the file hash was scanned against known threat indicators.
Indicators of Compromise

The threat indicators suggest that a suspicious process has been detected, which appears to be packed, meaning it has been compressed to hide its true content. This technique is often used by malicious software to evade detection and analysis. The detection by the Static Engine indicates that security measures have identified this unusual behavior, raising concerns about potential malicious activity. It is important to investigate this further to ensure the safety and integrity of the system.

Cross-Service Intelligence Markdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Sy...

Below is additional context from other services subscribed by the customer.
ServiceSourceRelevant InsightReference

--- --- --- ---
ESN/ANo relevant tools configured for enrichment.

Need help or want us to take additional actions? Reply to this ticket and the SOC will assist.

You can view all details here: 342707

View Ticket