Adsunwan Malware Detected in Corporate Downloads Folder

Initial Signal

Microsoft Defender for Endpoint detected a malicious executable file named "ZoomInfoContactContributor (1).exe" in the Downloads folder of user user_1 on a domain-joined Windows 10 system (ws-001.[INTERNAL_DOMAIN_1].local) on 2026-03-11 at 16:35:14 UTC. The file was classified as Adsunwan malware with an IsIoc (Indicator of Compromise) flag set to true and received a "Suspicious" verdict from the security platform. The filename pattern is the signal within the signal: "ZoomInfoContactContributor (1).exe" mimics legitimate ZoomInfo business software, a common social engineering tactic to trick users into executing malware. The duplicate numbering in parentheses suggests the user may have downloaded the file multiple times, increasing the likelihood of user interaction. Microsoft Defender's "Active" remediation state indicates ongoing security response. While the file was successfully detected and blocked, the available telemetry does not confirm whether execution occurred before detection or if the system sustained any compromise. The investigation correlated data from Microsoft 365 Defender advanced hunting across 6 records in 1 minute 44 seconds.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified the file classification by Microsoft Defender
   Pass
2. fp2
   Analyzed filename pattern for legitimacy
   Pass
3. fp3
   Evaluated file characteristics
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. Microsoft Defender explicitly classified the file as Adsunwan malware with an IsIoc flag set to true, a definitive indicator of compromise

2. Specific hash values were identified (MD5 1c0674970e55ff28e3d6d4b9fc435f39, SHA1 e33df0cd1ead927fb3ad769ff311e5598c533da2, SHA256 be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db) that match known malicious patterns

3. The filename pattern "ZoomInfoContactContributor

4. exe" matches known social engineering tactics impersonating legitimate business software

5. The file was confirmed as a Windows Portable Executable (IsPe: true) with a size of 265,600 bytes consistent with malicious executables. Confidence remains High rather than Confirmed because the available data does not include process execution logs, network connection data, or persistence indicators that would confirm the malware was executed and established control over the system—the detection may represent pre-execution identification by antivirus

Lessons

1. 01
   Filename impersonation is a reliable social engineering signal. The 'ZoomInfoContactContributor (1).exe' filename mimics legitimate business software to lower user suspicion. In this investigation, the duplicate numbering in parentheses suggested the user had downloaded the file multiple times, indicating the social engineering tactic was effective at the user level. Always flag executables in Downloads folders with names matching legitimate SaaS platforms (ZoomInfo, Slack, Teams, Salesforce, etc.), especially when the IsIoc flag is set. The filename alone is not proof, but combined with threat classification, it's a strong indicator of deliberate impersonation.
2. 02
   Pre-execution detection is not the same as containment. Microsoft Defender detected this file before execution, which is a win for the security stack. However, the investigation did not confirm whether the user had already executed the file before the detection occurred. Always correlate file detection alerts with process creation logs and network telemetry to determine the true execution timeline. A file sitting in Downloads with an 'Active' remediation state may mean the user is still interacting with it, not that it was safely contained.
3. 03
   Absence of evidence is not evidence of absence in malware investigations. This investigation dismissed the 'Compromised' verdict as 'Medium confidence' because process execution logs, network connections, and persistence indicators were not available. The lack of these logs does not prove the malware was not executed—it means the investigation lacked the telemetry to confirm execution. When investigating malware detections, always request endpoint detection and response (EDR) logs, process creation events, and network connection data. If these are unavailable, escalate the confidence level downward and recommend immediate EDR deployment or forensic analysis.
4. 04
   IsIoc flag is a high-confidence malware indicator. Microsoft Defender's IsIoc flag set to true means the file hash is a confirmed indicator of compromise in threat intelligence databases. In this investigation, the IsIoc flag combined with the Adsunwan threat family classification and the suspicious filename pattern created a convergence of signals that ruled out false positive and normal activity verdicts with high confidence. When you see IsIoc set to true, treat it as a strong signal for escalation and immediate remediation, not as a candidate for further analysis.
5. 05
   Social engineering attacks target the user, not just the system. The 'ZoomInfoContactContributor (1).exe' file was found in user user_1's Downloads folder, indicating user interaction. The duplicate numbering suggests the user may have been confused or re-downloaded the file. When investigating malware detections in user-writable directories like Downloads, always include user awareness and training in the remediation plan. A single blocked file is a technical win, but if the user is still vulnerable to the social engineering tactic, the risk persists.