back
On our Windows 2019 fileserver there was a "HEUR:Trojan.Multi.Crypmod.gen" blocked according to the KSC10 administration server Threats Report.
code:
Path to file : System
Result: Blocked: HEUR:Trojan.Multi.Crypmod.gen User: DOMAIN_XXX\USERNAME_XXX (Initiator) Object: System Reason: Dangerous action Database release date: 9/23/2019 3:56:00 AM Remote session: 0x1e08736c Remote host: - (192.168.0.xxx)
Looking in the KES11 "Reports\Behavior Detection" on the File Server i can see the following.
code:
9/23/2019 4:48:27 PM Malicious object detected External application DOMAIN_XXX\USER_XXX Detected: HEUR:Trojan.Multi.Crypmod.gen External application Behavior analysis
Application: External application
User: DOMAIN_XXX\USER_XXX (Initiator)
Remote session: 0x1e08736c
Remote host: - (192.168.0.xxx)
Component: Behavior Detection
Result: Detected: HEUR:Trojan.Multi.Crypmod.gen
Object: External application
Reason: Behavior analysis
Database release date: 9/23/2019 3:56:00 AM
9/23/2019 4:48:27 PM Blocked External application DOMAIN_XXX\USER_XXX Blocked: HEUR:Trojan.Multi.Crypmod.gen External application Dangerous action
Application: External application
User: DOMAIN_XXX\USER_XXX (Initiator)
Remote session: 0x1e08736c
Remote host: - (192.168.0.xxx)
Component: Behavior Detection
Result: Blocked: HEUR:Trojan.Multi.Crypmod.gen
Object: External application
Reason: Dangerous action
Database release date: 9/23/2019 3:56:00 AM
Unfortunately i cannot find much more then this in the Kaspersky logging and cannot find anything at all about this in the KES11 logging on the Users computer.
I've scanned all our Servers and every client computer in our company and found nothing, what i do know is the this user used a private USB stick to print some pictures for his kids birthday, this USB stick was placed in his (up to date) Windows 10 computer but was also placed in the Ricoh printer itself, a device that i cannot scan.
Fortunately it looks like the program was halted before it could do anything and since this happened we did not detect anything strange on our network or our computers.
But the lack of information bothers me, especially because the users client computer has no logging of this issue at all, is there any way i can find out more about this Trojan.Multi.Crypmod.gen or get more useful logging from KES or from KSC..?
