[SID: 30378] Attack: SMB Ransom Malware Copy Attempt 2 attack blocked. Traffic has been blocked for this application: SYSTEM

Since 31st Oct 2017 Most of our users PC's are getting below Pop up message

When i check with event viewer i found below event. Not able to find from where this attack is lanched 

[SID: 30378] Attack: SMB Ransom Malware Copy Attempt 2 attack blocked. Traffic has been blocked for this application: SYSTEM

Note: No log found in SEP client. How to find the host which tries to attack.

Regards,

Hari