Malicious File

SOLVED
ajohn
Conversationalist

Malicious File

I was looking at some security events in my Meraki dashboard and it seems to be showing this malicious filename: W32.4E846BBEDE-95.SBX.TG when I visit the virus total link attached to this finding it gives me different information. I have googled this malicious filename and found that it was linked to a malicious Microsoft Powerpoint exe file. What I am trying to gather here is what exactly does this virus do to the system? Any information would help.

 

Thanks!

 

https://www.virustotal.com/en/file/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36/...

1 ACCEPTED SOLUTION
Zedilt
Here to help

Microsoft classifies it as a PUA:Win32/InstallCore,

 

Summary

This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:

 

  • Adds files that run at startup
  • Modifies file associations
  • Injects into other processes on your system
  • Injects into browsers
  • Changes browser settings
  • Changes browser shortcuts
  • Installs browser extensions
  • Disables User Access Control (UAC)

These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.

If you were trying to install an application, you might have downloaded it from a source other than the official product's website.

We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:

 

  • United States
  • Brazil
  • France
  • Poland
  • Spain

Source

View solution in original post

4 REPLIES 4
Adam
Kind of a big deal

Were there any other details?  I googled that filename and didn't find anything.  

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.
ajohn
Conversationalist

Same here I looked everywhere and could not find anything on it. The virus total link I posted at the bottom said Roblox as the file name. I looked up this hash associated with the file 4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36 and got this.

 

 

https://www.hybrid-analysis.com/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0...

 

Hope this helps.

Zedilt
Here to help

Microsoft classifies it as a PUA:Win32/InstallCore,

 

Summary

This application was stopped from running on your network because it has a poor reputation. This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs:

 

  • Adds files that run at startup
  • Modifies file associations
  • Injects into other processes on your system
  • Injects into browsers
  • Changes browser settings
  • Changes browser shortcuts
  • Installs browser extensions
  • Disables User Access Control (UAC)

These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.

If you were trying to install an application, you might have downloaded it from a source other than the official product's website.

We usually see this application installed on PCs in the following countries. This list is sorted according to prevalence:

 

  • United States
  • Brazil
  • France
  • Poland
  • Spain

Source

ajohn
Conversationalist

Thank you for your help 🙂

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.