Solved Win7 SYSEM (PID 4) ICMP towards Israeli IPs ?

[Stunherald]

Hi all!

I have pfSense FW in front of my home network and i am running pfBlockerNG for blocking Malvertising, Cryptojackers, ADs and other "bad" stuff.

Recently i noticed that FW logs contains quite a lot of outgoing ICMP packets from one of my Win7 Workstations. First i thought that some application is just trying to "call home" and their server IPs got listed in one of the blocklist providers BUT but after some checks i found that it is actually a SYSTEM process (PID 4) trying to ping these IPs.

The most "weird" stuff is that the IP range is NOT a known range of any of the Microsoft servers. RIPE record shows the range belongs to Israeli datacenter (netstyle.io). (I am located in central Europe)

I have ESET Smart Security running on that PC in Interactive mode so every in/out TCP/UDP connection prompts for "approval" + every time rule is created. I haven't noticed any other suspicious activity in term of real data transfer. Only there pings.

I am at dead-end with the SYSTEM Process. Any idea how to narrow down WHAT exactly is causing this? I would understand pinging some EU-based servers which are well-known for Microsoft ... but this ... this is weird...


Firewall logs:
https://i.imgur.com/xh7P8SY.png

Eset logs from that particular workstation (after i created blocking rule for ICMP packets towards that IP range.):
https://i.imgur.com/r8WyDug.png

Process Explorer:
https://i.imgur.com/743aXhT.png


Thank you in advance!


//EDIT: I figured it out. These are pings for latency checks for my VPN provider servers. They're coming from virtual NIC/drivers thus PID4.

 

[Snick]

 

[Alejandro85]

A thing to take into account when troubleshoting those things is that process "SYSTEM" (PID 4) refeers to kernel-mode code, so high-CPU or network connections from it always point out to some driver. Antivirus, VPN like in this case, firewalls, virtual machines, or even Windows itself are likely candidates for being the root causes.

The really bad thing about those is that a bug there is what causes BSODs instead of simple program crashes, should the problem be bad enough.