VAUX-COM package extraction accompanies UAC-policy write
Sandbox records document files unpacked into a VAUX-COM directory, including a temporary executable whose hash matches the submitted sample. A separate UAC-policy write and Sality-signature network alerts warrant scrutiny beyond ordinary extraction, but the records do not establish a linked attack sequence or successful command-server session.
A Windows executable associated with a VAUX-COM software package appears in a sandbox record that sets the User Account Control policy value EnableLUA to zero. Other records show files being unpacked into a VAUX-COM directory and network alerts involving two web addresses ending in logo.gif. That combination raises a more useful question than whether the installer’s name looks suspicious: how much of the observed activity can ordinary package extraction explain?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read