Product Tour

LONDON_THREE - SenseOn | Investigate

Case Summary:
SenseOn observed 'regsvr32.exe' had been executed on the device 'WLTBH12113' with the unusual arguments '/s "c:\program files (x86)\notepad++\nppshell_06.dll'. Analysing the telemetry we can see this instance of 'regsvr32.exe' originated from 'npp.7.5.6.Installer.exe', this had been opened through explorer by the user 'Bob.Smith' and the activity identified here appears to be related to the installation of Notepad++

SenseOn further observed the suspicious child program 'jucheck.exe' had spawned from 'javaw.exe' on the device 'EX145113'. This instance of 'java.exe' originated from 'javacpl.exe', this had spawned from the user 'Bob.Smith' opening 'C:\Program Files\Java\jre-1.8\bin\javacpl.exe' through 'explorer.exe'. This activity appears to be related to the use of Java software which uses 'jucheck.exe' to check for updates, the surrounding telemetry appears to be benign

SenseOn later observed the legitimate program 'tasklist.exe', which has the potential for malicious use, has run on this device with the unusual arguments '/FO CSV /NH /FI "PID ne 41356" /FI "WINDOWTITLE eq selektron*"'. This instance of 'tasklist.exe' originated from 'javaw.exe', this spawned from the user 'Bob.Smith' executing the script 'run UK1 UAT.bat'. This activity appears to be related to benign selektron tasks which appear to be common on the environment

Conclusion:
Activity is related to benign the installation of Notepad++ and benign java activity followed by the common use of tasklist by selektron software, the surrounding telemetry appears to be benign.

Recommended Actions:
None