Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

[AaronBeck]

@hhiggins 

It looks like it stopped around 5:10:41 AM PST 4/15/2020.

[hisingh · Accepted solution]

Hello @hhiggins 

I am glad the signature 341427639, is been disabled. 

This new signature, Virus/Win32.WGeneric.ajepxx, has a very high VT detection https://www.virustotal.com/gui/file/002a33f2f0d47c03a80539b71f3a312d146fa8c671ce8627254cfa0dd55d3407...

Are you sure it is detected in OneDriveSetup.exe

Best 

Himani

[hhiggins]

@hisingh I have had no alerts for 24 hours now. I would consider this resolved at this point.

Thanks

[AaronBeck]

This has recently started occurring again and is filling up my SIEM. Please help @hisingh !

[hisingh]

Hello @AaronBeck 

Thanks for sharing with me. 
This signature is disabled since April 2020. How are you seeing it?

https://threatvault.paloaltonetworks.com/?query=Win32.WGeneric.ajdriy&type=

Best

Himani

[AaronBeck]

Ah, it appears to be a different name now but is triggering on the same file.

oneclient.sfx.ms/Win/Prod/20.084.0426.0007/OneDriveSetup.exe

Virus/Win32.WGeneric.aktxlj

348874710 

https://threatvault.paloaltonetworks.com/?query=348874710

[AaronBeck]

It actually looks like there are multiple:

@hisingh 

Virus/Win32.WGeneric.aktxlj

Virus/Win32.WGeneric.aktpum

[hisingh]

Hi

I have asked the team to check Virus/Win32.WGeneric.aktxlj, I will update.

Win32.WGeneric.aktpum is disabled already. 

Best

Himani

[AaronBeck]

Win32.WGeneric.aktpum Stopped at 7:10 this morning, was this just turned off? @hisingh 

[hisingh]

Hi

Virus/Win32.WGeneric.aktxlj is a malware

Win32.WGeneric.aktpum was disabled on 06-28-2020. 

Best

Himani