Ticket#3536103/STONEHENGE/[##342706##] High - SentinelOne Threat - Stonehenge Advisors, Inc - ipscan.exe - 05/11/26 -- has been updated - All Recent Emails

This ticket has been updated by John Lewis

John Lewis

5/18/2026 1:41 PM

Reviewed the alert in the S1 portal
Reviewed the timeline on this machine and confirmed one of our technicians was working on the machine at this time.
No further action is required.
Closing ticket.

Summary:

[##342706##] High - SentinelOne Threat - Stonehenge Advisors, Inc - ipscan.exe - 05/11/26

Status:

Closed

Ticket #

3536103

Company:

Stonehenge Advisors, Inc

Contact:

Dan Sablosky (POC)

Phone:

(215) 320-3777

Address:

4328-42 Ridge Avenue
Suite 104
Philadelphia, PA 19129

View Ticket

Discussion

John Lewis

5/18/2026 1:41 PM-1:41 PM

Reviewed the alert in the S1 portal
Reviewed the timeline on this machine and confirmed one of our technicians was working on the machine at this time.
No further action is required.
Closing ticket.

Dan Sablosky (POC)

5/11/2026 1:21 PM-

{      "@context": "http://schema.org",      "@type": "EmailMessage",      "potentialAction": {        "@type": "ViewAction",        "target": "https://desk.cyflare.cloud/portal/ticket/342706",        "name": "View Ticket "      },      "description": "View Ticket"    }

Dear IH-Atlantic_Stonehenge Advisors,

A ticket has been created with the following details:

Account Name: Atlantic_Stonehenge Advisors
Ticket ID:  342706
Priority:  High
Subject:  High - SentinelOne Threat - Stonehenge Advisors, Inc - ipscan.exe - 05/11/26
Description:

EDR: ipscan.exe

Customer: Stonehenge Advisors, Inc |                            Detected: 2026-05-11 12:59:17 UTC-04

Priority: HighSource: SentineloneThreat status: Mitigated - contained by socKill: SuccessQuarantine: Success
Alert Link:EDR Alert

Executive Summary                AI-Assisted

A security agent detected suspicious software activity on a desktop used by the user 'LYNDONPC2\Jennifer', assessed as a moderate-severity discovery because it behaved like a reconnaissance tool that could map systems. The endpoint is protected and the SOC applied automated containment actions successfully, so the immediate risk is mitigated. Business impact is limited if no additional malicious actions occurred, though such tools can signal attempts to probe the network that warrant attention.

SOC Response Actions
Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6.
ActionStatus

--- ---
LyndonPC2, no full disk scan command was sent.                        Not Configured
LyndonPC2, endpoint was not isolated from the network.                        Not Configured

Recommended Remediation

[Containment] Isolate endpoint 'LyndonPC2' from the network immediately (disconnect Wi-Fi and block external IP 23.24.19.166 at perimeter).
[Eradication] Remove the file '\Device\HarddiskVolume3\Program Files\Angry IP Scanner\ipscan.exe' and uninstall related application 'ipscan-3.9.3-setup.exe' from 'LYNDONPC2' for user 'LYNDONPC2\Jennifer'.
[Eradication] Quarantine and delete file hash '5b576e5f33a3ae019881cb5942218ab0d28539bd42693654d4d2319eb196ece6' from backups and removable media, and ensure no copies remain on shared drives.
[Hardening] Restrict endpoint software installation rights for 'LYNDONPC2\Jennifer' (apply least privilege — remove local admin rights and require admin approval for installs).
[Hardening] Block execution and network access for Angry IP Scanner binaries and related hacktool signatures via endpoint protection and application allowlist policies.

Key Details
Threat ClassificationMalwareEndpoint NameLyndonPC2
Detection EngineOn-Write DFI - SuspiciousEndpoint IP Address20.13.55.205
File Path\Device\HarddiskVolume3\Program Files\Angry IP Scanner\ipscan.exeSite NameStonehenge Advisors
File Hash5b576e5f33a3ae019881cb5942218ab0d28539bd42693654d4d2319eb196ece6 MaliciousGroup Name Stonehenge Advisors Inc - LYNDON KPG-MCG Curtis Tenant LLC
File Publisher NameSentinelOne Mitigation Policyprotect
File Publisher Signed & VerifiedNotSignedSentinelOne Mitigation Statusmitigated
Command Line
SOC Findings
Threat Intelligence & Reputation
VirusTotal

5b576e5f...b196ece6
Malicious
File hash detected by 3 security engines. Classified under the meaningful name ipscan.exe.
Hybrid-Analysis

5b576e5f...b196ece6
Malicious
File hash detected by 3 security engines. Classified under the meaningful name ipscan.exe.
Indicators of Compromise

The threat indicator shows that a hacking tool known as 'IPScan' has been detected. This tool is commonly used by attackers to scan networks for devices and vulnerabilities, making it easier for them to exploit weaknesses. The presence of IPScan on a system indicates potential unauthorized activities aimed at gathering sensitive information about the network. It is crucial to take immediate action to investigate and mitigate any risks associated with this tool to ensure the security of the system and its data.

Cross-Service Intelligence Markdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Syntax.Inlines.HtmlEntityInlineMarkdig.Sy...

Below is additional context from other services subscribed by the customer.
ServiceSourceRelevant InsightReference

--- --- --- ---
ESN/ANo relevant tools configured for enrichment.

Need help or want us to take additional actions? Reply to this ticket and the SOC will assist.

You can view all details here: 342706

View Ticket