Windows 10: EDR is flagging rununpackaged.exe which appears to be in WindowsApps folder

We received the following alert from our EDR:A file rununpackaged.exe with a reputation of known malware was found on disk.File Path: C:\program files\windowsapps\microsoft.sysinternalssuite_2022.8.0.0_x64__8wekyb3d8bbwe\rununpackaged.exeFile Hash: f30e22746b59585183e0026b33138eca10452f13f9c8071a36e9c21688372e6dThe file was created by the application C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc.VirusTotal - 7/70This file doesn't appear to be signed and was flagged by on heuristics behavior. The WindowsApps folder is read-only and there's no way even for us to modify its content.

:)

 

WindowsApp Folder

It is already installed. In accordance with your suggestion, I have created a folder for it under Program Files and moved it there. Thanks. I would still be interested in understanding why I cannot get access to the WindowsApps folder, even after following all the steps I can follow online. Any insights please?

 

WindowsApps folder says permissions are corrupted and need to be deleted, is this normal or critical?

According to your description, I suggest you try the following steps:

1. Navigate to the location C:\Program Files.
   
2. Right-click on the WindowsApps folder, and select Properties.
   
3. Turn to Security tab and click on Advanced.
   
4. Click on Change and then type Users in Enter the object name to select area.
   
5. Click on OK, then click Apply > OK. You can also add the TrustedInstaller to the users list and check if it takes effect.
   

However, you might be still not able to access the files. The workaround is to go inside the C:\Program Files\WindowsApps\, and repeat the same way with the Microsoft.WindowsStore* folders.

 

WindowsApps folder issues

A few ways to access that folder without causing damage are listed here:

Taking ownership of windowsapps folder - failed to process?