High Alert wininfo.exe

[Mohammed_Yasin]

received alert from Traps regarding malware detection of the maximum system due to file “Wininfo.exe”.

Please find a snapshot of one system and suggest how to fix this. Is there any impact?

CORTEXXDR

WildFire Malware

High

Source:XDR Agent

Category:Malware

Action:Detected (Post Detected)

Host:SS-akhil

Username:N/A

Starred:No

Excluded:No

Alert:1240

Incident:123

{     "original_alert_json":{         "uuid":"60950e6e927a42679814266964aa8edb",         "recordType":"threat",         "customerId":"1396903310",         "severity":3,         "generatedTime":"2021-08-13T09:14:58.439860Z",         "originalAgentTime":"2021-08-13T09:14:58.439860Z",         "serverTime":"2021-08-13T09:16:28.194296",         "isEndpoint":1,         "agentId":"8e6737354f7e37f0d7b25c330ebf0c7a",         "endPointHeader":{             "osVersion":"10.0.19043",             "agentIp":"192.168.0.101",             "deviceName":"SS-akhil",             "agentVersion":"5.0.6.5109",             "contentVersion":"193-67945",             "policyTag":"ZWMzNzFjZWEwZThlYjVkYzA5YjZlYWNhMDI0NjlkZTk0OTU2NzgyNTIzM2U2NWQ5ODhmZmM2OTBiNGY5NDk3MjpGYWxzZTpESVNBQkxFRDpMSUNFTlNFXzIwX1BSRVZFTlQ=",             "securityStatus":0,             "protectionStatus":0,             "deviceDomain":"ss.group",             "userName":"akhilheda",             "userDomain":"ss.group",             "userSid":"S-1-5-21-3286644759-2474778216-3316818064-3298",             "osType":1,             "is64":1,             "isVdi":0,             "agentId":"8e6737354f7e37f0d7b25c330ebf0c7a",             "agentTime":"2021-08-13T09:14:58.439860Z",             "tzOffset":0         },         "messageData":{             "eventCategory":"prevention",             "moduleId":"COMPONENT_WILDFIRE_POST_DETECTION",             "moduleStatusId":"CYSTATUS_MALICIOUS_EXE",             "preventionKey":"ee6af308fc1611ebbcfa98fa9b5d3ad5",             "processes":[             ],             "files":[                 {                     "rawFullPath":"\\\\?\\C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\r0zuj05w\\wininfo.exe",                     "fileName":"wininfo.exe",                     "sha256":"3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c",                     "fileSize":"82432"                 },                 {                     "rawFullPath":"\\\\?\\C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\r0zuj12w\\wininfo.exe",                     "fileName":"wininfo.exe",                     "sha256":"3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c",                     "fileSize":"82432"                 }             ],             "users":[             ],             "urls":[             ],             "postDetected":1,             "sockets":[             ],             "block":0,             "eventParameters":[                 "\\\\?\\C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\r0zuj12w\\wininfo.exe",                 "3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c",                 "3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c",                 "1"             ],             "fileIdx":0,             "verdict":1,             "preventionMode":"post_detected",             "trapsSeverity":3,             "profile":"Malware",             "description":"WildFire Malware",             "cystatusDescription":"Suspicious executable detected",             "sourceFile":{                 "rawFullPath":"\\\\?\\C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\r0zuj05w\\wininfo.exe",                 "fileName":"wininfo.exe",                 "sha256":"3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c",                 "fileSize":"82432"             },             "policyId":"3a2d7cfbae6c4ab39e8ffcd727140573"         }     },     "internal_id":1240,     "external_id":"ee6af308fc1611ebbcfa98fa9b5d3ad5",     "severity":"SEV_040_HIGH",     "matching_status":"MATCHED",     "detection_modules":null,     "end_match_attempt_ts":null,     "alert_source":"TRAPS",     "local_insert_ts":1628846247856,     "source_insert_ts":1628846157839,     "alert_name":"WildFire Malware",     "alert_category":"Malware",     "alert_description":"Suspicious executable detected",     "bioc_indicator":null,     "matching_service_rule_id":null,     "attempt_counter":0,     "bioc_category_enum_key":null,     "alert_action_status":"POST_DETECTED",     "case_id":123,     "is_whitelisted":false,     "starred":false,     "deduplicate_tokens":null,     "filter_rule_id":null,     "mitre_technique_id_and_name":[         ""     ],     "mitre_tactic_id_and_name":[         ""     ],     "agent_id":"8e6737354f7e37f0d7b25c330ebf0c7a",     "agent_version":"5.0.6.5109",     "agent_ip_addresses":[         "192.168.0.101"     ],     "agent_hostname":"SS-akhil",     "agent_device_domain":"ss.group",     "agent_fqdn":"SS-akhil.ss.group",     "agent_os_type":"AGENT_OS_WINDOWS",     "agent_os_sub_type":"10.0.19043",     "agent_data_collection_status":null,     "mac":null,     "agent_is_vdi":null,     "agent_install_type":"STANDARD",     "agent_host_boot_time":null,     "event_sub_type":null,     "module_id":[         "WildFire post detection"     ],     "module_name":[         "COMPONENT_WILDFIRE_POST_DETECTION"     ],     "association_strength":null,     "dst_association_strength":null,     "story_id":null,     "is_disintegrated":null,     "event_id":null,     "event_type":[         3     ],     "event_timestamp":[         1628846098439     ],     "actor_effective_username":[         "N\/A"     ],     "actor_process_instance_id":null,     "actor_process_image_path":null,     "actor_process_image_name":null,     "actor_process_command_line":null,     "actor_process_signature_status":[         "SIGNATURE_UNAVAILABLE"     ],     "actor_process_signature_vendor":null,     "actor_process_image_sha256":null,     "actor_process_image_md5":null,     "actor_process_causality_id":null,     "actor_causality_id":null,     "actor_process_os_pid":null,     "actor_thread_thread_id":null,     "actor_process_execution_time":null,     "causality_actor_process_image_name":null,     "causality_actor_process_command_line":null,     "causality_actor_process_image_path":null,     "causality_actor_process_instance_id":null,     "causality_actor_process_os_pid":null,     "causality_actor_process_signature_vendor":null,     "causality_actor_process_signature_status":[         "SIGNATURE_UNAVAILABLE"     ],     "causality_actor_causality_id":null,     "causality_actor_process_execution_time":null,     "causality_actor_process_image_md5":null,     "causality_actor_process_image_sha256":null,     "action_file_path":[         "\\\\?\\C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\r0zuj12w\\wininfo.exe"     ],     "action_file_name":[         "wininfo.exe"     ],     "action_file_md5":null,     "action_file_sha256":[         "3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c"     ],     "action_file_macro_sha256":null,     "action_registry_data":null,     "action_registry_key_name":null,     "action_registry_value_name":null,     "action_registry_full_key":null,     "action_local_ip":null,     "action_local_port":null,     "action_remote_ip":null,     "action_remote_port":null,     "action_external_hostname":null,     "action_country":[         "UNKNOWN"     ],     "action_process_instance_id":null,     "action_process_causality_id":null,     "action_process_image_name":null,     "action_process_image_sha256":null,     "action_process_image_command_line":null,     "action_process_signature_status":[         "SIGNATURE_UNAVAILABLE"     ],     "action_process_signature_vendor":null,     "action_process_image_path":null,     "action_process_image_md5":null,     "action_process_os_pid":null,     "os_actor_effective_username":null,     "os_actor_process_instance_id":null,     "os_actor_process_image_path":null,     "os_actor_process_image_name":null,     "os_actor_process_command_line":null,     "os_actor_process_signature_status":[         "SIGNATURE_UNAVAILABLE"     ],     "os_actor_process_signature_vendor":null,     "os_actor_process_image_md5":null,     "os_actor_process_image_sha256":null,     "os_actor_process_causality_id":null,     "os_actor_causality_id":null,     "os_actor_process_os_pid":null,     "os_actor_thread_thread_id":null,     "os_actor_process_execution_time":null,     "fw_app_id":null,     "fw_interface_from":null,     "fw_interface_to":null,     "fw_rule":null,     "fw_rule_id":null,     "fw_device_name":null,     "fw_serial_number":null,     "fw_url_domain":null,     "fw_email_subject":null,     "fw_email_sender":null,     "fw_email_recipient":null,     "fw_app_subcategory":null,     "fw_app_category":null,     "fw_app_technology":null,     "fw_vsys":null,     "fw_xff":null,     "fw_misc":null,     "fw_is_phishing":[         "NOT_AVAILABLE"     ],     "dst_agent_id":null,     "dst_causality_actor_process_execution_time":null,     "dns_query_name":null,     "dst_action_external_hostname":null,     "dst_action_country":null,     "dst_action_external_port":null,     "is_pcap":null,     "contains_featured_host":[         "NO"     ],     "contains_featured_user":[         "NO"     ],     "contains_featured_ip":[         "NO"     ],     "image_name":null,     "container_id":null,     "cluster_name":null,     "remote_cid":null,     "events_length":1,     "is_excluded":false }

[BigPalo]

Did you have any update? its a false positive?

[Mohammed_Yasin]

No, Still it's receiving a high number of alerts.

[WSeldenIII]

Hi @Mohammed_Yasin, there are several variables to unpack in this scenario. I suggest to investigate if any changes were recently made to the endpoint's assigned malware profile (E.g. Portable Executable and DLL examination - action mode) or the WildFire verdict (E.g. Malware to Benign). The"Detected (Post Detected)" alert action indicates the verdict for the process bas been changed, and the process was executed in the past but still running.  It also appears the process is not signed, which may be one of reason for the initial alert.

In terms of impact, we want to ensure that we are investigating the alert/agent holistically, and the investigation of the impact will be more effective with Support.  I recommend to create a support case, if you have not already raised one, so we can have our engineering investigate this issue holistically. You may leverage either one of the following two workflows to retrieve support logs from the endpoint: retrieve support logs from an endpoint via the XDR Action Center, or you can right-click on the endpoint from the Endpoint Administration page, and navigate to the Endpoint Control field in order to retrieve the support file. The status of the file retrieval action will be in the Action Center in both workflows. I hope this information provides you with a path forward. 

[KRisselada]

@Mohammed_Yasin have a client that generated a lot of Alerts for this file last week during the regular scheduled Malware scans.
I take it you have Lenovo Laptops?   It would appear for a bit of time, last week, Wildfire Global Verdict had it listed as Malicious, but that verdict was short time later changed to Benign as it was reflected in Cortex Hub Console 

I had reviewed other OSINT and found this indicative that this indeed should be benign. https://www.virustotal.com/gui/file/3ae8462769a4d5012b66af226a196bb12571c72a231b66f07afcc838e878045c...

[enewman]

Hi Mohammed, I had this same alert. It was part of the Lenovo update software. We started getting blasted with alerts, ending up with over 700 alerts. I opened a case and our result was: "On August 12th the Research team changed that verdict twice keeping it finally as Benign.

Based on the last data that you provided, those alerts were Post Detected, meaning that since there was a verdict flip, all endpoints containing that hash will trigger an alert."

This is a benign file. We created an exception and an exclusion to allow the process and stop the alerting. Adding the hash did not stop the alerting. I hope that helps!