We getting this alert few days ago. Can somebody help me to understand it legit or not? Thank you in advanced.
Endpoint Type:
Computer
OS:
Windows
Device:
HoKahMunNB
Ransomware:
uid: 0bcd57bb-ee99-4a28-b0d0-ec76291e25f4
family_id: 8f45804d-11b2-7ed4-b890-fa4cc7ab7d1c
process_alias_path: $programfiles\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe
process_name: WhatsApp
process_version: 2.2237.5
thumbprint: d04aac7437df20f9077ef39e95bca83ae49c2bf5a6083a53abe59fb5e3f5a1e7
details: Mitigation CryptoGuard V5
Timestamp 2022-10-06T07:05:49
Platform 10.0.19044/x64 v37 06_8e
PID 20912
Enabled 005D2E3000000100
Silent 0000000000000100
Application C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe
Created 2022-10-05T02:29:21
Modified 2022-10-05T02:29:42
Description WhatsApp 2.2237.5
Filename C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe
Detection Generic.Ransom.C
1*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L0, Write T65536 H32768|^270 #1,8
2 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Created L0 #2
3 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0642.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367489295560.jpg)
Opened, Deleted L65046 #3,8
4*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0642.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367489295560.jpg)
Opened L65046, Read T65536|100% H32768|^3097 #8,1
5 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened, Deleted L65066 #11,17
6 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367489295560.jpg
Created L0, Write T65536 H32768|^3097 #16
7 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L65066, Read T65536|100% H32768|^270 #17
8*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L0, Write T65536 H32768|^270 #18,68
9 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Created L0 #41
10 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0641.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367480807192.jpg)
Opened, Deleted L65046 #67,68
11*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0641.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367480807192.jpg)
Opened L65046, Read T65536|100% H32768|^3097 #68,18
12 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened, Deleted L65066 #69,71
13 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367480807192.jpg
Created L0, Write T65536 H32768|^3097 #70
14 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L65066, Read T65536|100% H32768|^270 #71
15*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L0, Write T65536 H32768|^270 #72,75
16 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Created L0 #73
18*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0640.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367474487474.jpg)
Opened L65046, Read T65536|100% H32768|^3097 #75,72
22*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L0, Write T65536 H32768|^270 #79,133
25*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0639.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367465876046.jpg)
Opened L65046, Read T65536|100% H32768|^3097 #133,79
29*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Opened L0, Write T65536 H32768|^270 #162,295
32*C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\IMG-20221006-WA0638.jpg (C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367453495475.jpg)
Opened L65046, Read T65536|100% H32768|^3097 #295,162
Process Trace
1 C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
"C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe" -ServerName:App.AppXkf4yh0averk473g9chjmra34tgccdh3d.mca
2 C:\Windows\System32\svchost.exe [544]
C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p
3 C:\Windows\System32\services.exe [920]
4 C:\Windows\System32\wininit.exe [848]
wininit.exe
Dropped Files
1 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\d2548b03397a64ce30520eea091627f27c76d9bd286f3ed9e1236a3090142983.tmp
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
2 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006366793774431.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
3 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\tmp\6c5b172e09fa0748a4cb780e53decfb646fd41650b959d5539b887848ebada6f.tmp
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
4 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275a.whatsappdesktop_cv1g1gvanyjgm\AC\INetCache\M3MU30NN\fileG8V8ZM5A.enc
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
5 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\bFsXLgn6B0iky3gOU97Ptkb9QWULlZ1VObiHhI662m8=_plaintext_638006366816264967.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
6 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006366882829609.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
7 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367111187688.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
8 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275a.whatsappdesktop_cv1g1gvanyjgm\AC\INetCache\BTHQ2GHQ\fileZ09MM6QV.enc
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
9 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\bFsXLgn6B0iky3gOU97Ptkb9QWULlZ1VObiHhI662m8=_plaintext_638006367124953973.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
10 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367453495475.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
11 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367465876046.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
12 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367474487474.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
13 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367480807192.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
14 C:\Users\Ho Kah Mun\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\shared\transfers\2022_39\0lSLAzl6ZM4wUg7qCRYn8nx22b0obz7Z4SNqMJAUKYM=_plaintext_638006367489295560.jpg
Dropped by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Read by C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe [20912]
Thumbprint
d04aac7437df20f9077ef39e95bca83ae49c2bf5a6083a53abe59fb5e3f5a1e7
Cryptoguard algorithm based thumbprint
5728a3966147fcb47b577ced6ad1d536dfb2d821a8eadc631598179f220900cc
process_path: C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2237.5.0_x64__cv1g1gvanyjgm\WhatsApp.exe
type: CryptoGuard
process_pid: 20912
version: 3.8.4.37
This thread was automatically locked due to age.