Ticket#3673625/STONEHENGE/[##406086##] Medium - SentinelOne Threat - Stonehenge Advisors, Inc - ScreenConnect.Client (5).exe - -- has been updated (Окт 12, 2026 at 3:39 PM UTC) - #358ce2

This ticket has been updated by Vikash Kumar

Vikash Kumar

10/12/2026 10:37 AM - 10:56 AM UTC-04

Hi Team,

Review of RegattaDesk identified that RegattaDesk\regat manually executed C:\Users\regat\Downloads\ScreenConnect.Client (5).exe, which spawned C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe (Microsoft ClickOnce Deployment Service). Subsequent activity consisted of ScreenConnect installation-related file operations and cleanup within the user's temporary deployment cache, including removal of ScreenConnect.WindowsClient.exe and ScreenConnect.ClientService.exe.
Process lineage and user context indicate a legitimate user-initiated ScreenConnect installation/update. No suspicious or malicious activity was observed in the reviewed events.

Checked the machine backstage and the only RMM agents on the machine are from Atlantic.

No further action required.

Summary:

[##406086##] Medium - SentinelOne Threat - Stonehenge Advisors, Inc - ScreenConnect.Client (5).exe -

Status:

Completed

Ticket #:

3673625

Company:

Stonehenge Advisors, Inc

Contact:

Dan Sablosky (POC)

Phone:

(215) 320-3777

Address:

4328-42 Ridge Avenue
Suite 104
Philadelphia, PA 19129

View Ticket

Discussion

Vikash Kumar

10/12/2026 10:37 AM-10:56 AM

No further action required.

Dan Sablosky (POC)

10/12/2026 9:57 AM-

{ "@context": "http://schema.org", "@type": "EmailMessage", "potentialAction": { "@type": "ViewAction", "target": "https://desk.cyflare.cloud/portal/ticket/406086", "name": "View Ticket " }, "description": "View Ticket" }

Dear IH-Atlantic_Stonehenge Advisors,

A ticket has been created with the following details:

Account Name: Atlantic_Stonehenge Advisors
Ticket ID: 406086
Priority: Medium
Subject: Medium - SentinelOne Threat - Stonehenge Advisors, Inc - ScreenConnect.Client (5).exe - 10/12/26
Description:

EDR: ScreenConnect.Client (5).exe

Customer: Stonehenge Advisors, Inc | Detected: 2026-10-12 09:46:23 UTC-04

Priority: MediumSource: SentinelOneThreat Status: Not mitigatedkill: successquarantine: failed
Alert Link:EDR Alert

Executive Summary AI-Assisted

Suspicious software was detected on a desktop used by user regat, assessed as a moderate-severity risk due to behaviors that could allow persistence and data transmission. The agent attempted protective actions but full containment was not completed, and the file remains under review. Business impact could include unauthorized access to or loss of local data and potential disruption to the user’s workstation if remediation continues.

SOC Response Actions
Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6.
ActionStatus

--- ---
RegattaDesk, no full disk scan command was sent. Not Configured
RegattaDesk, endpoint was not isolated from the network. Not Configured

Recommended Remediation

[Containment] Isolate the affected endpoint 'RegattaDesk' from the network immediately (disconnect wired/wireless and block its IP 192.168.50.70 at switch/router) to prevent further potential data exfiltration or lateral movement.
[Eradication] Remove the detected file \Device\HarddiskVolume3\Users\regat\Downloads\ScreenConnect.Client (5).exe from the endpoint and uninstall any associated remote access tooling; if removal fails, perform a full disk scan and delete the file via trusted endpoint management tools.
[Credential Remediation] Reset passwords for the user account regat and any service accounts that have been used from that host; enforce immediate multi-factor authentication for those accounts.
[Hardening] Ensure the endpoint is patched to the latest OS and SentinelOne agent version, and configure application allowlisting to prevent execution of unsigned executables from user Downloads folders.
[Hardening] Block the file hashes 214466a603d761375805c77facb6892b75da0c83a892f237e507f86c3d6d811f and 362dd3266d2e5e17600c31f5eb95404058017cf9 at endpoint and gateway controls and add the filename pattern 'ScreenConnect.Client*.exe' to prevention rules.

Key Details
Threat ClassificationGeneralEndpoint NameRegattaDesk
Detection EngineOn-Write DFI - SuspiciousEndpoint IP Address192.168.50.70
File Path\Device\HarddiskVolume3\Users\regat\Downloads\ScreenConnect.Client (5).exeSite NameStonehenge Advisors
File Hash362dd3266d2e5e17600c31f5eb95404058017cf9Group NameStonehenge Advisors Inc - HQ
File Publisher NameSentinelOne Mitigation Policyprotect
File Publisher Signed & VerifiedNotSignedSentinelOne Mitigation Statusnot_mitigated
Command Line

SOC Findings
Threat Intelligence & Reputation

VirusTotal

362dd326...58017cf9
No Relevant Results
No behavioral or reputation data returned for this hash at the time of analysis.

Hybrid-Analysis

362dd326...58017cf9
No Relevant Results
No behavioral or reputation data returned for this hash at the time of analysis.

Indicators of Compromise

The detected file shows many signs of malicious behavior. It can persist on a system by modifying registry keys and can execute unmanaged code, allowing it to manipulate critical system functions. The file can access sensitive information, delete files, and send data to external servers. It employs various techniques to avoid detection, such as encoding and encrypting data. Additionally, its high entropy suggests that it may be obfuscated or packed to hide its true purpose. These characteristics indicate a significant security threat that requires immediate attention and investigation.

Cross-Service Intelligence i

Below is additional context from other services subscribed by the customer.
ServiceSourceRelevant InsightReference

--- --- --- ---
ESN/ANo relevant tools configured for enrichment.

Need help or want us to take additional actions? Reply to this ticket and the SOC will assist.

You can view all details here: 406086

This email has been scanned by Trustifi Inbound Shield

View Ticket