cachelooki.blogg.se - Advance ip scanner

ADVANCE IP SCANNER PORTABLE
ADVANCE IP SCANNER SOFTWARE

3.1 AIS registry keysĪfter the installation of AIS, keys and subkeys are created in the HKEY_USERS hive of the user under which account AIS was installed.

ADVANCE IP SCANNER PORTABLE

Do note that for both the portable version as well as the installer version, the same traces are created in the Windows registry. This section describes the traces that are created during usage of the AIS tool and more specifically, the Windows registry keys that are being created.

Forensic tracesĪIS leaves traces on a host system when it is executed.

The fact that there is a portable version of Advanced IP Scanner, that it has a GUI and that the tool supports a variety of ways to interact with identified systems probably contributes to it popularity. If enabled, this provides the user with functionality to remotely boot a system.

(Re)boot/ Wake-On-Lan : the user can boot / reboot a system if the user is authorized to do so, or can send Wake-On-Lan (WOL) packages to a system.

Remote connections : connect to the corresponding IP address via HTTP, HTTPS, FTP, RDP, or RADMIN (only works if RADMIN is installed).

Tools : provide functionality to ping an IP, perform a Tracert, or connect with Telnet / SSH.

IP scanning : scan the given range for systems that are alive, or dead.

From a high-level perspective, AIS provides the user with the following functionality: ĪIS is a simple and user-friendly IP scanner, which provides the end user with a concise overview of the systems found in the network. After the installation / execution of AIS, the end user is presented with an overview as shown in Figure 1. Furthermore, this blogpost provides some pointers related to detecting Advanced IP Scanner.Īdvanced IP Scanner (AIS) is freely available online 1 and can be executed as an installer and as a portable version. The artefacts might be useful during an investigation, and can shine some (minor) light on threat actors’ activities. This small write-up focuses on some of the forensic traces left by AIS that Hunt & Hackett observed during Incident Response cases. Groups that have (had) used Advanced IP Scanner include: This has not only been observed by Hunt & Hackett, but also by other incident response parties.

During these targeted ransomware cases, ‘Advanced IP Scanner’ (AIS) 1 was regularly used as reconnaissance tool for Active Scanning ( T1595) and Network Service Scanning ( T1046). Users of Advanced IP Scanner gave it a rating of 3 out of 5 stars.Hunt & Hackett has been working on a wide variety of targeted ransomware cases. The most prevalent version is, which is used by 53 % of all installations.Īdvanced IP Scanner runs on the following operating systems: Windows. It was initially added to our database on. The latest version of Advanced IP Scanner is, released on. It was checked for updates 4,304 times by the users of our client application UpdateStar during the last month.

ADVANCE IP SCANNER SOFTWARE

It presents various types of information about local network computers in just a few seconds! It gives you one-click access to many useful functions - remote PC shutdown and wake up, Radmin (integration and more! Powered with multithread scan technology, this program can scan hundreds of computers per second, allowing you to scan 'C' or even 'B' class networks even from your modem connection! Try this program and you'll see how simple network management can be! OverviewĪdvanced IP Scanner is a Freeware software in the category Miscellaneous developed by Famatech International Corp. Advanced IP Scanner is a fast, robust and easy-to-use multithreaded IP scanner for Windows.