EDR is flagging rununpackaged.exe which appears to be in WindowsApps folder

[Guest GingerC586]

We received the following alert from our EDR:A file (rununpackaged.exe) with a reputation of known malware was found on disk.File Path: C:\program files\windowsapps\microsoft.sysinternalssuite_2022.8.0.0_x64__8wekyb3d8bbwe\rununpackaged.exeFile Hash: f30e22746b59585183e0026b33138eca10452f13f9c8071a36e9c21688372e6dThe file was created by the application C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc.VirusTotal - 7/70This file doesn't appear to be signed and was flagged by on heuristics (behavior). The WindowsApps folder is read-only and there's no way even for us to modify its content.

 

Continue reading...