Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 12:20
General
- Target infonotary-signer.exe
- Size 2.1MB
- Sample260709-phw7cabv3w
- SHA256 02fa4cfe27b567286c7646eb188a835cce57e019d5fccc0311191199b11c5aaa
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe"C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UCRXVNGX6W.tmp\infonotary-signer.tmp"C:\Users\Admin\AppData\Local\Temp\is-UCRXVNGX6W.tmp\infonotary-signer.tmp" /SL5="$60206,958464,958464,C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-U81NP8FRJZ.tmp\setup.msi" /passive /norestart3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 94B9870A66128940F475DDE6C37612412⤵
-
-
C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"2⤵
-
C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e5b3be0.rbs
InfoNotary e-Doc Signer.exe
.package
InfoNotary e-Doc Signer.cfg
VCRUNTIME140.dll
java.dll
jimage.dll
jli.dll
msvcp140.dll
net.dll
nio.dll
jvm.dll
jvm.dll
vcruntime140_1.dll
zip.dll
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
jvm.cfg
release
infonotary-signer.tmp
MSI4ED8.tmp
MSI50AE.tmp
metadata-2
{9a8ea74f-0e63-4e16-b4b9-441ac0be1215}_OnDiskSnapshotProp
memory/1600-8-0x0000000000240000-0x0000000000338000-memory.dmp
memory/1600-0-0x0000000000240000-0x0000000000338000-memory.dmp
memory/1600-447-0x0000000000240000-0x0000000000338000-memory.dmp
memory/3276-6-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/3276-446-0x0000000000DA0000-0x00000000011F3000-memory.dmp
memory/3276-10-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/3276-9-0x0000000000DA0000-0x00000000011F3000-memory.dmp
memory/3276-35-0x0000000000DA0000-0x00000000011F3000-memory.dmp
memory/3276-37-0x0000000000DA0000-0x00000000011F3000-memory.dmp
memory/3276-46-0x0000000000DA0000-0x00000000011F3000-memory.dmp