| File name: | Intel-Driver-and-Support-Assistant-Installer1.exe |
| Full analysis: | https://app.any.run/tasks/4d492734-7e3e-4acc-84f7-a67bc201328b |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 21, 2025, 00:26:34 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections |
| MD5: | A3F9A844858AE41C3F9C139671437C98 |
| SHA1: | 0D874E9AC40A7CBCAAA5308D885E178B659504AC |
| SHA256: | C8257BD8A8A7E63D927492858E29A50DECF0938AD724E584CC840A40025591AA |
| SSDEEP: | 98304:TiwhXSWAgQEf6cGBm4rmLbFsopn7PYONoyjSUL9A7uxuJnKdACUSQ37YWxsC6tqC:P0aDaToUCR0S |
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:04:05 19:45:02+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit, Removable run from swap, Net run from swap |
| PEType: | PE32 |
| LinkerVersion: | 14.38 |
| CodeSize: | 483328 |
| InitializedDataSize: | 317440 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x517f0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 25.2.15.9 |
| ProductVersionNumber: | 25.2.15.9 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | ASCII |
| CompanyName: | Intel |
| FileDescription: | Intel® Driver & Support Assistant |
| FileVersion: | 25.2.15.9 |
| InternalName: | burn |
| OriginalFileName: | Intel-Driver-and-Support-Assistant-Installer.exe |
| ProductName: | Intel® Driver & Support Assistant |
| ProductVersion: | 25.2.15.9 |
| LegalCopyright: | Copyright © Intel Corporation. All rights reserved. |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 300 | "C:\ProgramData\Package Cache\485aab647c30901f06569b609f5d6f21443fb07fd3ccb76d1be18f738d72ebe8\aspnetcore-runtime-8.0.14-win-x86.exe" /q /norestart /ChainingPackage "Intel® Driver & Support Assistant" | C:\ProgramData\Package Cache\485aab647c30901f06569b609f5d6f21443fb07fd3ccb76d1be18f738d72ebe8\aspnetcore-runtime-8.0.14-win-x86.exe | Intel-Driver-and-Support-Assistant-Installer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ASP.NET Core 8.0.14 - Shared Framework (x86) Exit code: 0 Version: 8.0.14.25112 Modules
| |||||||||||||||
| 684 | C:\Windows\syswow64\MsiExec.exe -Embedding 6A476EA4DA522773BF5C66F80E906EBC | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1184 | "C:\ProgramData\Package Cache\{a6918640-3436-4607-9108-9b6038e680d6}\dotnet-runtime-8.0.14-win-x64.exe" /burn.runonce | C:\ProgramData\Package Cache\{a6918640-3436-4607-9108-9b6038e680d6}\dotnet-runtime-8.0.14-win-x64.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Runtime - 8.0.14 (x64) Exit code: 0 Version: 8.0.14.34611 Modules
| |||||||||||||||
| 1272 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | netcoresearch.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1388 | "C:\ProgramData\Package Cache\{f70d61fa-5d61-4582-bf8d-07dec8e4fcda}\windowsdesktop-runtime-8.0.14-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{f70d61fa-5d61-4582-bf8d-07dec8e4fcda}\windowsdesktop-runtime-8.0.14-win-x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=572 /quiet /norestart /burn.log.append "C:\Users\admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x86)_20250421002733.log" /ChainingPackage "Intel® Driver & Support Assistant" | C:\ProgramData\Package Cache\{f70d61fa-5d61-4582-bf8d-07dec8e4fcda}\windowsdesktop-runtime-8.0.14-win-x86.exe | windowsdesktop-runtime-8.0.14-win-x86.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Desktop Runtime - 8.0.14 (x86) Exit code: 0 Version: 8.0.14.34613 Modules
| |||||||||||||||
| 2084 | C:\Windows\syswow64\MsiExec.exe -Embedding EF700271C5BF63EAB81362BADB860BC9 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2084 | "C:\ProgramData\Package Cache\{a6918640-3436-4607-9108-9b6038e680d6}\dotnet-runtime-8.0.14-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a6918640-3436-4607-9108-9b6038e680d6}\dotnet-runtime-8.0.14-win-x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=560 /quiet /norestart /burn.log.append "C:\Users\admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_8.0.14_(x64)_20250421002903.log" /ChainingPackage "Intel® Driver & Support Assistant" | C:\ProgramData\Package Cache\{a6918640-3436-4607-9108-9b6038e680d6}\dotnet-runtime-8.0.14-win-x64.exe | dotnet-runtime-8.0.14-win-x64.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Runtime - 8.0.14 (x64) Version: 8.0.14.34611 Modules
| |||||||||||||||
| 2152 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | dllhost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2320 | "C:\Users\admin\AppData\Local\Temp\{D095C0BB-C28F-40A3-B478-5EA9F4212476}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.AspNetCore.App | C:\Users\admin\AppData\Local\Temp\{D095C0BB-C28F-40A3-B478-5EA9F4212476}\.ba\Wix4NetfxBootstrapperExtension_X86\x86\netcoresearch.exe | — | Intel-Driver-and-Support-Assistant-Installer.exe | |||||||||||
User: admin Company: WiX Toolset Integrity Level: MEDIUM Description: netcoresearch Exit code: 0 Version: 5.0.0.0 Modules
| |||||||||||||||
| 2392 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 4800000000000000EA633F1154B2DB01841E0000981E0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7756) Intel-Driver-and-Support-Assistant-Installer.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 4000000000000000EA633F1154B2DB014C1E0000501E0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Leave) |
Value: 4800000000000000BD50891154B2DB01841E0000981E0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppCreate (Enter) |
Value: 48000000000000008F198E1154B2DB01841E0000981E0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 48000000000000006EED861154B2DB01841E0000981E0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppEnumGroups (Enter) |
Value: 48000000000000006EED861154B2DB01841E0000981E0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7812) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 11 | |||
| (PID) Process: | (7860) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 48000000000000002ED50E1254B2DB01B41E0000D01E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7860) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 48000000000000002ED50E1254B2DB01B41E00002C1F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7860) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer |
| Operation: | write | Name: | IDENTIFY (Enter) |
Value: 48000000000000002ED50E1254B2DB01B41E0000341F0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\BootstrapperUI_V2.pdb | binary | |
MD5:19505A97D904B55067919D69C59114B7 | SHA256:47AF9EB9D2FADA509728D196EA4B185AFCA2A0235DA41FA68444E730F3F6DE59 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\CommunityToolkit.Mvvm.dll | executable | |
MD5:277B42047F081D70DE67AD09A31D8B35 | SHA256:540F0F3FD0CBF1DAC653F3A4EE432EBD9365F812B74BD9986FDEAFF973F6D5CB | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\BootstrapperUI_V2.runtimeconfig.json | binary | |
MD5:94BCC836ACB02EBF70B1D9AC60C3DA3E | SHA256:545CF61B0E7C5672E3DA3DB0945C85B28C2DC3D453C649B793C6271B26CAB521 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\mbanative.dll | executable | |
MD5:0D1702D52E86DD07C489E30B9ADBF153 | SHA256:443506029D771D1598BDABF0B4F9E4D363C562AFD8FDDFE68462A0FFFE6A8138 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\System.CodeDom.dll | executable | |
MD5:027E139F08873948F55A896A178DD426 | SHA256:98ED5E5DFFBFC8D540AFA10AEF8A57AB24165FAD13387E9288F2E26F51094081 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\fr\BootstrapperUI_V2.resources.dll | executable | |
MD5:096F2BA54EC195AB5AA59309CF6359C9 | SHA256:CCCE58987FE8E295B364915752A251BEC86CB24C1D877C13812A38419F4E27F9 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\BootstrapperUI_V2.exe | executable | |
MD5:2577A461587CA759C49683FEC1097749 | SHA256:4C961009AE13A5C9A2BC5C010201EA8A3CC10D4DB07530592F356751E561FAE0 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\de\BootstrapperUI_V2.resources.dll | executable | |
MD5:CA132A84DFEA164CEBD4130DBB38E725 | SHA256:FBE8295B9C51AC14D666A6AF44AA1DF12F06CDD533A82A6BBE57897AC9889155 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\id\BootstrapperUI_V2.resources.dll | executable | |
MD5:BF97F5898683F8A453AFAA651F174399 | SHA256:8CB050805E48EFE966867BB93DBCBE4B6890FA2A438A865B6657ADF0471D9F04 | |||
| 7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | C:\Users\admin\AppData\Local\Temp\{7B6F66D2-E714-48B2-BA2F-5ED77EA0966B}\.ba\zh-TW\BootstrapperUI_V2.resources.dll | executable | |
MD5:591596E03746E5C09773FCE0EF7B9AC6 | SHA256:64B9A29FD1545C6A1DB2FCA78E7E6A4E99FBACA011E72A7517C9CFF2E7994A37 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 199.232.210.172:443 | https://download.visualstudio.microsoft.com/download/pr/882d76b3-fd56-4808-a933-a3e3e30d0ccc/9b7d6a303a276deb808466a0fc8d52e6/windowsdesktop-runtime-8.0.14-win-x86.exe | unknown | — | — | — |
— | — | HEAD | 200 | 199.232.210.172:443 | https://download.visualstudio.microsoft.com/download/pr/882d76b3-fd56-4808-a933-a3e3e30d0ccc/9b7d6a303a276deb808466a0fc8d52e6/windowsdesktop-runtime-8.0.14-win-x86.exe | unknown | — | — | — |
6724 | msiexec.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6724 | msiexec.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl | unknown | — | — | whitelisted |
— | — | HEAD | 200 | 199.232.210.172:443 | https://download.visualstudio.microsoft.com/download/pr/62a830a9-9853-4afb-b23e-d0e35039ce86/6f7455b2509928536299f6b75c00633b/aspnetcore-runtime-8.0.14-win-x86.exe | unknown | — | — | — |
— | — | HEAD | 200 | 199.232.210.172:443 | https://download.visualstudio.microsoft.com/download/pr/d90eedfa-ee55-4748-b672-9f01fdc5cba7/6fe60c798e09d343e9ed7621d094eba3/dotnet-runtime-8.0.14-win-x64.exe | unknown | — | — | — |
— | — | HEAD | 302 | 23.35.229.160:443 | https://go.microsoft.com/fwlink/?LinkId=863262 | unknown | — | — | — |
— | — | HEAD | 200 | 199.232.210.172:443 | https://download.visualstudio.microsoft.com/download/pr/1f5af042-d0e4-4002-9c59-9ba66bcf15f6/124d2afe5c8f67dfa910da5f9e3db9c1/ndp472-kb4054531-web.exe | unknown | — | — | — |
— | — | GET | 302 | 23.35.229.160:443 | https://go.microsoft.com/fwlink/?LinkId=863262 | unknown | — | — | — |
— | — | GET | 200 | 199.232.214.172:443 | https://download.visualstudio.microsoft.com/download/pr/882d76b3-fd56-4808-a933-a3e3e30d0ccc/9b7d6a303a276deb808466a0fc8d52e6/windowsdesktop-runtime-8.0.14-win-x86.exe | unknown | executable | 51.2 Mb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | 199.232.214.172:443 | download.visualstudio.microsoft.com | FASTLY | US | whitelisted |
5116 | Intel-Driver-and-Support-Assistant-Installer.exe | 199.232.210.172:443 | download.visualstudio.microsoft.com | FASTLY | US | whitelisted |
6724 | msiexec.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6724 | msiexec.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
780 | slui.exe | 20.83.72.98:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
7396 | Intel-Driver-and-Support-Assistant-Installer1.exe | 69.192.162.125:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
download.visualstudio.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
dsadata.intel.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |
— | — | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |