Managed XDR
Group-IB MDP Report
File info
Filename: irs_document.msi
File Type: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDQConnectAgent, Author: PDQ.com, Keywords: Installer, Comments: This installer database contains the logic and data required to install PDQConnectAgent., Template: x64;1033, Revision Number: {C6F9B3A6-FC67-4A4E-89BF-93626AB07D6E}, Create Time/Date: Thu Sep 4 15:33:32 2025, Last Saved Time/Date: Thu Sep 4 15:33:32 2025, Number of Pages: 200, Number of Words: 2, Name of Creating Application: WiX Toolset (5.0.0.0), Security: 2
File Size: 4.9 MB
Env info
w10/x64 en
Hashes
SHA1: 7e0403d3e4ab887ff88344a3522e0f02121308f9
SHA256: 03be20b4c30788b16291cd5d491bbdb62ab32b95dec333d3fdc7f9a23881401d
MD5: 4fc8718a919e265f46e33933db792f92
Signatures
Execution
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1569.002 persistence_service: Starts newly created service
T1047 has_wmi: Executes one or several WMI requests
Persistence
T1543.003 creates_service: Creates a service, that will start automatically
T1574 dropper_dll: Creates DLL, which is then loaded into the process
Privilege Escalation
T1543.003 creates_service: Creates a service, that will start automatically
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1027.004 compiles_code: Compiles C# code
T1070 stealth_window: A process created a hidden window
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_generic_msi: Checks installed MSI pakages, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1518 recon_programs: Collects information about installed programs
T1518 locates_browser: Attempts to identify where browsers are installed
T1082 reads_csrss: Attempts to read csrss.exe memory
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_generic_msi: Checks installed MSI pakages, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
Command and Control
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
Impact
T1489 change_service_config: Stops services via ChangeServiceConfig
T1489 service_control_stop: Stops services via ControlService
Other
pe_in_bcryptdecrypt: PE found in BCryptDecrypt function
creates_in_windows: Creates files in the Windows directory
creates_exe: Creates executable files in the file system
suspicious_process_network: Unusual process network activity detected
executes_dropped_exe: Executes dropped exe files
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
msi_has_custom_action: MSI file contains custom action
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
yara_rules: Static rules
valid_authenticode: The digital signature has been verified
Managed XDR