1

This is a Windows 10 Desktop.

This morning I checked our work computer and I noticed a lot of Security Alerts from a Spanish Godaddy Domain trying to use remote login.

  • There were no browsers open when this security alert appeared.
  • This computer does not have admin rights

enter image description here

I was unable to get a screenshot of what happens when you click view certificate. It said something about remote login and the domain .santillanausa.com which seems to be a Spanish language learning website.

After opening task manager I noticed a suspicous program named PROGRAM that needed admin rights to be closed and I can't click on properties.

enter image description here

After IT disabled PROGRAM this Security Alert has not arrived.

I was unable to get a screenshot of what happens when you click view certificate. It said something about remote login and the domain .santillanausa.com

I'm pretty sure that hxxp://santillanausa.com/ is not trying to remote login. My guess is that someone stole their certificate. I'd appreciate if anyone is aware of any exploits like this.


My question is

  • Is disabling PROGRAM enough to no longer be concerend of a security threat?
  • If this is a known exploit for Windows 10 what is it called and how does it work?

UPDATE: It was scanned with Malwarebytes antivirus and it says there are no viruses. This makes me very nervous because there is obviously a virus on the drive.

  • If there's anything you know I can do to get more info that would be helpful just comment here and I'll do it. – ConcernedUser Apr 12 '18 at 16:08
  • 1
    Have you identified the path to the executable that was running PROGRAM? I'd at least run that through a virus scanner, or submit it to VirusTotal to determine if it was something known to be malicious. The effort you put into identifying the issue should be proportionate to the value of the information stored on this system and any that are networked with it. – nbering Apr 12 '18 at 16:51
  • @nbering I'm not sure how to find the path to the executable. When I right click on it and try to get properties this happens. i.stack.imgur.com/Vnz0h.png Any clue how to get around that? – ConcernedUser Apr 12 '18 at 16:53
  • I'm not sure, I primarily service Linux machines. Perhaps someone with more Windows experience would be more familiar. It might help them to give some info about the machine. What version of Windows are you running? Is this a desktop machine or a server? I'm guessing it's a desktop since you have Quickbooks running, but I've seen people put that on a server, too. – nbering Apr 12 '18 at 16:56
  • @nbering I've added that info to the question. Thanks – ConcernedUser Apr 12 '18 at 16:59
1

This will probably sound like a vague answer, but without further analyses of the suspect program/executable, its activity done on-system, packet captures of the suspicious network traffic, etc., this is the 'best' answer I can come up with.


Any 'unknown' program running on a corporate system of any type is inherently a security risk. Therefore, the existence of the program can in and of itself be considered its own security risk. Whether the program is simply 'sitting on the computer' doing nothing, or actively running and doing something is another matter to take into consideration when responding to the existence of the program.

Without more detailed dissection and analysis, it is not possible to give you a definitive answer for your first question of "Is disabling the program enough to mitigate the security risk". However, typically just 'shutting off' the suspicious program is not enough to stop the core cause of the risk; without more in-depth analysis, however, to say whether this is enough to disable the security risk is pure speculation (and more often than not it is safer to assume "No, this is not enough", from my experience).

However, this is not the right question to be asking. The proper question that the IT team (and/or any relevant information security officers or teams) should be asking is "How did this program get there?" This question is important because if it is a program installed by an end user that happened to have admin privileges, that's one thing. If it's a program that got in there without anyone's knowledge, then you have enough to suggest that there may have been a breach somewhere - whether a user went to a site that exploited a vulnerability in the specific system or not or whether the system was hacked into by an external source or not is still to be determined.


As to your second question about whether a known Windows 10 exploit/attack vector was used to get this program to run in your environment, we can't answer that. Any statements saying "yes" or "no" are pure speculation, and cannot be backed by any evidence. Such evidence would be gained through analysis of the system to determine any suspicious network traffic to/from the system, any suspicious remote logins, suspicious system calls, etc., of which we can then use the data found in those investigations to determine whether or not a "known issue" was exploited or not.


As a whole, therefore, the best thing I can say in answer to your questions is this:

Disabling the program or service, alone, is probably not enough to mitigate the risk. However, this is not a certain answer, and without more in-depth analysis the best conclusion I can give you is that there is a potential security risk of unknown scope and risk factor on the system in question, of which additional analysis of the program's activity and behavior can help to determine such scope and/or risk factors.

If I absolutely had to make recommendations to your IT team, then it would be these, to start:

  • Remove the affected system from the network, and provide a new, clean machine if possible to replace this affected machine.
  • Submit the suspicious executable to VirusTotal or similar for analysis.
  • Analyze network traffic on the affected endpoint system(s) or on the network at-large to identify suspicious traffic, and from there determine potential infection vectors or system breaches through which threat actors could utilize to hijack endpoint systems or to 're-implant' the application in other systems.

But these alone are not fully-informed suggestions backed by evidence, and are more 'general' suggestions that many in the Information Security field will be giving you in response to any suspected breaches or infections; in each and every case, deeper, more in-depth analysis of the affected system and suspect executable/program is necessary to give any truly informed recommendations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.