Is this an infection?

[MIXIT]

Hi all, 

I do admin for a lot of SEP 14 and SEPC environments.  A common problem I see more times than not is an Auto-Protect or scheduled scan detection of an infected file that is already on the system, but just appears to be a file and not a running process.  This is a non-brainer genrally if you find it in Downloads or found as an email attachment, but what I struggle with att imes is when you find it in the appdata/local/ path.  

Appdata is a bit of a mystery sometimes.  I know that apps will store things there, so for example if a web browser adds a component, it will have pieces there.  But take this recent detection as an example, the detection info is (with some items removed): 

• Source: Auto-Protect
• Threat Name: W97M.Downloader
• Source Version: 1.8.0.244
• Threat Type: Malware
• File Name: 6d7c9b52.doc
• Security Client: SEP Cloud
• File Location:c:\users\username\appdata\local\packages\oice_16_974fa576_32c1d314_3564\ac\temp\
• Security Client Version: 22.16.2.22
• Status: Blocked
• Resource Type: File
• First Seen: 12/20/2018 02:37 am
• Resource Name: W97M.Downloader
• Persistence: Fixed
• Rule Name: Not Available
• Security Definition Version: 2018.12.19.022
• Rule Description: Not Available
• File MD5 Checksum: D8F5EA3EF5EA1D88ECFE60F6E1F6FE47
• File SHA2 Checksum:D9442F97B93E30EDA70D26F1E8664BD6AB12360D9DAAEC64EB975356CB4F3371

 

So do I interpret this to mean that people with naughty intent have breached the computer, or is this normal to have malware detected in a place on the file system that the user clearly doesn't manually save a file to?  I guess it comes down to understanding how Microsoft Windows utilizes the appdata folder - I admit I haven't researched this much.  If I saw this malware in say, System32, I'd be very concerned. But appdata?  Also any advice on how to cross-reference uniqueness ID's in this output with say, registry keys or something is appreicated.  Like a "package named "oice.....".  Needless to say Google found nothing on that full name.  

Thanks all.  

 

[Rafeeq]

packages\oice

folder is used by outlook webmail, user might have tried to download and attachment or something and thats why you get those, not to be worried as long as SEP is detecting those.

https://social.technet.microsoft.com/Forums/en-US/f5ac5feb-712d-4427-bce3-1f597a035adb/malware-in-oice-folder?forum=exchangesvrgeneral

[Mick2009]

Hi MIXIT,

Looks like a successful defense to me.  Perform a manual scan on the computer in case there's any suspicion that there is malware present.  Also, be sure to harden your endpoints and check the configuration of your mail security product in order to ensure it is doing its most to stop malicious macro threats.

Support Perspective: W97M.Downloader Battle Plan
https://www-secure.symantec.com/connect/articles/support-perspective-w97mdownloader-battle-plan

[MIXIT]

I want to get them ATP: Email but this customer's domain is not managed by them, it's a country-wide organization that runs as a franchise model and they're too cheap to implement org-wide email security so my poor customer is stuck weith a domain name they can't secure via such as ATP:Email (Email Safeguard.cloud) so I don't know what to do really - some kind of computer-specific mail platform (I was considered Mailwasher Pro).  Any thoughts?  Seperate subject for sure....