I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting that the hard drive needs to be reimaged.
The computer was only just put on the network on Friday, it runs Windows 7 Professional, Service Pack 1. IT did not even have time to update Windows before the network connection was blocked on Monday morning.
The computer has been behaving as expected. No erratic behavior has been noticed.
Infosec cited the computer's
lsass.exe file as a concern (SHA256: 620638756a5ee6ea933a7a4c94e7dd2537e2a7345bbeff72d28271c0174d10a2)
They stated that this lsass.exe file is "associated" with
Searching the computer's hard disk shows that there is an
There is no
Full scans with Norton antivirus show 0 threats (not even a tracking cookie)
The computer is expressly not used for web browsing or e-mail. The network connection only exists to provide access to local network files.
Reimaging the computer is excessively expensive, as doing so requires full recalibration of attached lab equipment. I'm convinced that this was a false positive.
My question is: Am I correct? Is this computer infected? Secondarily: How do I convince an infosec professional that they are wrong about a file being malware?
Thanks in advance!
Edit for additional requested information:
A screenshot of the following Crowdstrike message was shared:
lsass.exe ASSOCIATED BEHAVIOR: High Severity Intel Detection A hash matched a CrowdStrike Intelligence indicator that has previously been used in targeted attacks. Associated IOC (SHA256 on file write): 74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0 FILE PATH: \Device\HarddiskVolume2\Windows\System32\lsass.exe SHA256: 620638756a5ee6ea933a7a4c94e7dd2537e2a7345bbeff72d28271c0174d10a2 COMMAND LINE: C:\Windows\system32\lsass.exe USER NAME: [redacted] START / END TIME: Feb 5., 2018 08:33:03
The following link was then shared: https://www.virustotal.com/en/file/74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0/analysis/74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0