topic Re: File Trajectory - Name in Russian in Endpoint Security

File Trajectory - Name in Russian

Enda McGahern — Tue, 21 Jun 2022 12:18:16 GMT

Hi,

I have a number of files on Windows 10 that are showing as clean

One is svchost.exe

SHA256

5d00bbeb147e0c838a622fc42c543b2913d57eaca4e69d9a37ed61e98c819347

It is reporting as clean.

However, the product name is Microsoft in Russian, which is a concern.© Корпорация Майкрософт

There are other files reporting the same way e.g. taskeng.exe.

Appreciate a view on this.

Re: File Trajectory - Name in Russian

Troja007 — Wed, 22 Jun 2022 18:37:00 GMT

Hello @Enda McGahern ,
I did some research with the hash you provided. Please keep in mind, as I cannot give you any official answer just by a single hash.

Any tool I have access to reports the file as clean and trusted
Threat Response shows the file clean, but yes, the file is not available on any of my systems in the LAB
virustotal.com shows the file is clean
- it was sent two days before and the page outlines Microsoft as the distributor
Talos File Reputation search does not show any info
Google Translator says Корпорация Майкрософт means Microsoft Corporation

There are a lot of question out of my head

More information would be fine from Device Trajectory. Is there any other Event seen for the endpoint?
Any anomaly in the network communication?
Any other possible indicators

What you can do:

Do a root-kit scan directly on one of the systems from the endpoint UI.
Upload the file to Malware Analytics and set it to public, so it gets analyzed again.
Check if the automated action for file analysis is active, so such files get uploaded to the file repository in case the connector detect malicious behavior around the file.
You may open a TAC case, so we can take a close look.

Greetings,

Thorsten

Re: File Trajectory - Name in Russian

Enda McGahern — Thu, 23 Jun 2022 12:04:10 GMT

Hi Thorsen,

I logged a case via our Cisco partner and our partner is seeing the same on their own portal so its seems to be widespread and they have raised it with Cisco.

Ill will keep you updated.

Thanks for taking time to read and reply to my post.

Regards

Enda