Hi All,
Have a customer running Intercept trial and it looks like they're connecting to a reverse proxy VPN on an F5 that deploys a program called cachecleaner.exe onto the client computer for cleaning up the connection data once the session has been closed.
It looks like a false positive because it reads and writes a lot of files and in the artifacts tab, all reports across 6 systems all have this cacheclearner.exe at the center of it. Now they have been hit by ransomware in the past so our first concern is they have a worm that is deploying this application to all of the computers but that doesn't look like the case. 95% of the files touched appear to be cache related on internet explorer.
I have a copy of the program that appears in all of the Root Cause Analysis scopes of which there are some screen shots below:
Above is what is in 70% of the RCAs
Below is a more complicated RCA from someones PC which looks like to have a lot of fluff but primarily has the fragment above in it regardless:
Happy to provide console information if the team would like to access the RCAs themselves and I also have the cachecleaner.exe program in a zip to provide.
In one of the RCAs it looks like it was the users first time connection so it was deploying some tunnelling and user configuration settings.
This is what is leading me to a false positive and the cachecleaners behaviour is simply showing it as malicious.
Happy to provide more information on request :)
Emile
P.s. Oooh the RCA is cool
This thread was automatically locked due to age.
