Outlook.exe categorized as trojan due to its connection outbound and modification on registry keys.

Outlook.exe performed all these actions, and due to it, it is shown as Trojan. And As far as it seems all the outbound connection has been to Microsoft. And I would like to know if this action is normal or should I be concered and if so what action should I take. 
Here is the hash of the root cause [ outlook.exe ].
Actions performed by this artifact:
200 DNS lookups
200 File deletions
200 File reads
200 File writes
200 IP connections
200 Registry creations
200 Registry deletions
200 Registry value sets
200 URL accesses
92 Registry value deletions
  • Hello Prabin Tamang,

    is this indeed the On-Premise Endpoint, not Intercept X? The former doesn't talk of a Root Cause.

    Anyway, this acticity doesn't seem normal, you should open a case with Support. Is this a report from just one endpoint or a summary?


  • As QC says, we need to clarify if this is a Threat Case in Sophos Central. If it is, and you are seeing Outlook as the root node in the case - then your infection vector was an email and someone clicked on it and it did the malicious actions.

    If this isn't a Threat Case in your Central Dashboard - please post a screenshot of what you are referencing.

  • Hi, 

    Sorry about that, i should have clarified about it. Yes it is generated through the threat analysis, and like you said "Outlook as the root node in the case - then your infection vector was an email and someone clicked on it and it did the malicious actions", you are correct, but since there has been many files and registry keys that has been affected by it, how should I go about it. 

  • So, you really don't need to worry about Outlook. The malicious element was the email. Has that been removed? As for the other elements - the endpoint detected the action and stopped it - that is the only way you get a Threat Case. So, what you want to do now is go take a look at the items touched before the actions were stopped. Were there any network calls to other machines in your environment - if yes, are those machines protected by Sophos? Where there any calls to external resources that could be CnC servers? If yes, what happened at your firewall? Were any critical system or data files touched? If yes, verify the contents and signatures.

    I would also suggest you do a full system scan with the Sophos Endpoint on the reporting machine - just to make sure there isn't any lingering bits sitting around. 

  •  Thank you very much all you help, this has been really helpful and I am grateful.