Overview
overview
8Static
static
3INNORIX-Agent.exe
windows10-2004-x64
8INNORIX-Agent.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...og.dll
windows10-2004-x64
3$PLUGINSDI...og.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/time.dll
windows10-2004-x64
3$PLUGINSDIR/time.dll
windows11-ltsc_2024-x64
3innorixam.exe
windows10-2004-x64
3innorixam.exe
windows11-ltsc_2024-x64
3innorixas.exe
windows10-2004-x64
1innorixas.exe
windows11-ltsc_2024-x64
1innorixst.exe
windows10-2004-x64
1innorixst.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 12:17
Behavioral task
behavioral1
Sample
INNORIX-Agent.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
INNORIX-Agent.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisFirewall.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisFirewall.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsislog.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsislog.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/time.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/time.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
innorixam.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
innorixam.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
innorixas.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
innorixas.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
innorixst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
innorixst.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target INNORIX-Agent.exe
- Size 10.7MB
- Sample260805-pgf4qsag74
- SHA256 6d6832a752a60fe0a5b24444cbc4a1bb6da1a81323d8df9af0df46571f10e943
- MD5 d2277d44827f5de7971581b25aa5a5f6
- SHA1 f9375d0e6af34ac4e472d2a1afbe71cd7c93d0a0
- SHA512 889ab9e744a0a0183f4ff90c45cbe1c9999da5dadd290cb88160dfa76217b81a9adaccc30f24a6d20dd7b4974c10604ba1495192c81cf20909e5c4880c59bced
- SSDEEP 196608:nxKRtPDQJqqK1s+TTvBPboDZtYtVE9U82HpYqtOENtvw7zsM313Nr:BJqd1FTD1QrYtl5xOENtzM3zr
- TLSH T1E4B633672313EA81C9C6E07E12C4AD7D21B6B252C558DD4E3F982B9C0DF9963F902D78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 3 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION" certutil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL" certutil.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\innorix_securly.cfg innorixas.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\innorix_securly.js innorixas.exe - Executes dropped EXE 11 IoCs
pid Process 4780 innorixas.exe 4316 innorixam.exe 2092 innorixam.exe 3680 innorixam.exe 2268 innorixas.exe 436 innorixas.exe 1572 innorixas.exe 3032 innorixas.exe 4576 innorixam.exe 1096 innorixst.exe 1112 innorixst.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1300 sc.exe 988 sc.exe 5060 sc.exe 2052 sc.exe - Loads dropped DLL 51 IoCs
pid Process 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4760 cmd.exe 3908 cmd.exe 2528 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innorixam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language certutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innorixam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INNORIX-Agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - System Network Connections Discovery 1 TTPs 2 IoCs
Attempt to get a listing of network connections.
pid Process 3820 NETSTAT.EXE 4760 cmd.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3820 NETSTAT.EXE - Kills process with taskkill 6 IoCs
pid Process 3808 taskkill.exe 4420 taskkill.exe 1716 taskkill.exe 1112 taskkill.exe 2368 taskkill.exe 312 taskkill.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 3680 innorixam.exe 3680 innorixam.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1572 innorixas.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 1872 INNORIX-Agent.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe 3680 innorixam.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2368 taskkill.exe Token: SeDebugPrivilege 312 taskkill.exe Token: SeDebugPrivilege 3808 taskkill.exe Token: SeDebugPrivilege 4420 taskkill.exe Token: SeDebugPrivilege 1716 taskkill.exe Token: SeDebugPrivilege 1112 taskkill.exe Token: SeDebugPrivilege 3820 NETSTAT.EXE Token: SeTcbPrivilege 1572 innorixas.exe Token: SeTcbPrivilege 1572 innorixas.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1112 innorixst.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1112 innorixst.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1112 innorixst.exe 1096 innorixst.exe 1112 innorixst.exe 1096 innorixst.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2368 1872 INNORIX-Agent.exe 85 PID 1872 wrote to memory of 312 1872 INNORIX-Agent.exe 88 PID 1872 wrote to memory of 3808 1872 INNORIX-Agent.exe 90 PID 1872 wrote to memory of 4420 1872 INNORIX-Agent.exe 92 PID 1872 wrote to memory of 1716 1872 INNORIX-Agent.exe 94 PID 1872 wrote to memory of 1112 1872 INNORIX-Agent.exe 96 PID 1872 wrote to memory of 1300 1872 INNORIX-Agent.exe 98 PID 1872 wrote to memory of 988 1872 INNORIX-Agent.exe 100 PID 1872 wrote to memory of 5060 1872 INNORIX-Agent.exe 102 PID 1872 wrote to memory of 2052 1872 INNORIX-Agent.exe 104 PID 1872 wrote to memory of 3920 1872 INNORIX-Agent.exe 106 PID 1872 wrote to memory of 4780 1872 INNORIX-Agent.exe 108 PID 1872 wrote to memory of 4316 1872 INNORIX-Agent.exe 110 PID 1872 wrote to memory of 2092 1872 INNORIX-Agent.exe 112 PID 3680 wrote to memory of 4760 3680 innorixam.exe 115 PID 4760 wrote to memory of 3820 4760 cmd.exe 118 PID 3680 wrote to memory of 3908 3680 innorixam.exe 119 PID 3908 wrote to memory of 436 3908 cmd.exe 122 PID 1572 wrote to memory of 2528 1572 innorixas.exe 125 PID 1872 wrote to memory of 3032 1872 INNORIX-Agent.exe 127 PID 2528 wrote to memory of 4576 2528 cmd.exe 128 PID 1572 wrote to memory of 1096 1572 innorixas.exe 129 PID 1572 wrote to memory of 1112 1572 innorixas.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\INNORIX-Agent.exe"C:\Users\Admin\AppData\Local\Temp\INNORIX-Agent.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innorixam.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innorixas.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innorixst.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innoiotm.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innoiot.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im innorixTray.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\SysWOW64\sc.exesc delete innoiot2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Windows\SysWOW64\sc.exesc delete innoiotm2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:988
-
-
C:\Windows\SysWOW64\sc.exesc delete innorixam2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5060
-
-
C:\Windows\SysWOW64\sc.exesc delete innorixas2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2052
-
-
C:\Windows\SysWOW64\certutil.execertutil -addstore -f ROOT C:\INNORIX_Agent\ca.crt2⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
PID:3920
-
-
C:\INNORIX_Agent\innorixas.exeC:\INNORIX_Agent\innorixas.exe -install2⤵
- Executes dropped EXE
PID:4780
-
-
C:\INNORIX_Agent\innorixam.exeC:\INNORIX_Agent\innorixam.exe -install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316
-
-
C:\INNORIX_Agent\innorixam.exeC:\INNORIX_Agent\innorixam.exe -start2⤵
- Executes dropped EXE
PID:2092
-
-
C:\INNORIX_Agent\innorixas.exeC:\INNORIX_Agent\innorixas.exe -start2⤵
- Executes dropped EXE
PID:3032
-
-
C:\INNORIX_Agent\innorixam.exeC:\INNORIX_Agent\innorixam.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netstat -ano2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano3⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\INNORIX_Agent\innorixas.exe -start2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\INNORIX_Agent\innorixas.exeC:\INNORIX_Agent\innorixas.exe -start3⤵
- Executes dropped EXE
PID:436
-
-
-
C:\INNORIX_Agent\innorixas.exeC:\INNORIX_Agent\innorixas.exe1⤵
- Executes dropped EXE
PID:2268
-
C:\INNORIX_Agent\innorixas.exeC:\INNORIX_Agent\innorixas.exe1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\INNORIX_Agent\innorixam.exe -start2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\INNORIX_Agent\innorixam.exeC:\INNORIX_Agent\innorixam.exe -start3⤵
- Executes dropped EXE
PID:4576
-
-
-
C:\INNORIX_Agent\innorixst.exe"C:\INNORIX_Agent" "C:\INNORIX_Agent" "" "" "" "4033" "4523" "" "true" "4e52af0c-887c-429c-a471-b98b3452c25c"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\INNORIX_Agent\innorixst.exe"C:\INNORIX_Agent" "C:\INNORIX_Agent" "" "" "" "4033" "4523" "" "true" "c8f1dfb3-82e5-4d87-92f2-1a896bfa1035"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1112
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
1Service Execution
1Defense Evasion
Impair Defenses
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\INNORIX_Agent\ca.crt
- Size 1KB
- SHA256 3d5948994e5d9ffb5367fdd6466ad7d734a7d45275126a8fac4478d93cddcfb8
- MD5 15252889e5d99a2ac60734b4f1c7148a
- SHA1 adcb02d0367c24df48755cf375e7efd566f9ab43
- SHA512 1ccc761d6932fa20f79c14cffb4ff8b0779f3dc161bfa93cc70f6dbb101af1b6ab775c3f7cdcd41d7f640b49f73d98a93bc32f7694fdf6d4f443e821db4ba892
- TLSH T12421A7E95AF03D9E24B6B92CF0310BC9A92424B7DF46E82A86601899C648710D1FD4CF
- MD5 SHA1 SHA512 TLSH
- Path C:\INNORIX_Agent\innorixam.exe
- Size 788KB
- SHA256 00947ee184215932683d20f2e086c76ecf1a76f4616dd17f1489058d8586d27f
- MD5 a8f0aac0c896acd5f70ae726ba2971ff
- SHA1 a24dceda87dd19e168a852cf83e593d074e062f8
- SHA512 c510c41c746f92d3b2a22b2ab3706b7e6f2bbc332ec20457dfcf348859a380a03506e7fb4710b32328d564be01b5f695817d2887fc7a8e69c4c0553a63a8b8eb
- SSDEEP 12288:KqQhVZnevuAHtxuJhM9CjXUCKyoKsScTOiAFampeRgKT9El48fj4+tBRh2ysl6m:KqR8jECboBTvQwel4Ujzj46m
- TLSH T1A105C0113AB2C075D492C1798E79E72A20BEBC714B614EC777C82A0D2EF15C2E736766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\INNORIX_Agent\innorixas.conf
- Size 47B
- SHA256 84deac6cf7580e40dc86380261f8fc6599b1238816a0dd34ddf562658142f0c9
- MD5 62231b49a299ff9c4b5d1a5616b683d9
- SHA1 01b0981c9f99a47786904621bc39bd2efcfbff74
- SHA512 a4044a44beaf07a236b0b562b073c3b09d0427e0976cd5532e44b7d1a32dd9673af8789f84bac505aa2de47a3671d22a9ba0d996a7ac7cbb71867ec18adab178
- MD5 SHA1 SHA512
- Path C:\INNORIX_Agent\innorixas.exe
- Size 16.9MB
- SHA256 d8342126d7bd959813895f522ba6885dd6918069b09297a8bc1e101bc0681cf1
- MD5 910145271fd5cb579cb98b57366b6f29
- SHA1 e67e71eda73e407fc14ca6d603279dc3ef6ff09d
- SHA512 334bd63bb6f921e1929250f7b261f9e3fec17947c1a0f706648512ca363f38660d9d50efcd9c3676a91bbdcd9e6a24787c3876a283f85481f0385fc761675c0e
- SSDEEP 393216:5QGpMbWvhZZb9T/qrHu1eoATC3wTRmGbEuc:5QHbI/hZkmAc
- TLSH T17C076D0DEB9441F5C0B6C1BC8A574683E1B2B8A74B3067E709B916350E776E0AF3EE51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\INNORIX_Agent\innorixst.exe
- Size 16.3MB
- SHA256 cffc4ecaa8256c9e2d3dd7655b17ef7577b61632df7ee85b7498fcee3ec35b73
- MD5 09dab3d1ab13b164841f4e928fe8c342
- SHA1 8183b040820fbfe43b22b8f82b7ab49a06cc5ac9
- SHA512 9eb7a64e8a8f428532184357aaa417250439fd13a800cd01498b6a3803867dcc82014a77bf44aac43efa68d1202fe3ecfb817ef9ba659e65ad0660b9e53b4c40
- SSDEEP 196608:LP1V1oHbaNq9pwvQWqbJHtPbC7ujoBOccRkSU90F2oH:LNoHbD9pwvQ9bnPbDjISUZoH
- TLSH T124076D0DAB9441E6C0B7C1BC8A474797E2F2BC964B3067EB0575233A1E376D05F3A662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\INNORIX_Agent\property.conf
- Size 26B
- SHA256 f248d284a53970af9d2fe64df226651f8b217b55f7198f3e45a7e66594a19f37
- MD5 392ee6c636b21d9dda55c91997c73488
- SHA1 a82cbd80b881621f3d80dda591d6ca74e572d385
- SHA512 4f2034c4e394dd5d6f242feb8dced3748672b6632215fbf1bd2c381fe6eb4ff1c6dca86046f9d709b41a77449aa7af58b2bed16f45579ae142180c94d94ea425
- MD5 SHA1 SHA512
- Path C:\INNORIX_Agent\transferInfo\transferDownloadFileInfo
- Size 4KB
- SHA256 94c2dad35f74a98663c93e22b31af200047e956d57faafc9e1251afe62ef5631
- MD5 7fa23aaeef4a693d80f8ab9495527aa3
- SHA1 d4c13753ffc154740d7054b45300e16f3c4daf65
- SHA512 896c401ce996b70cb03e25dd7a67e8ee17934dc884ef93ec489167ecacef55a6a36a8aefd269a77c44d5d37db18aea002819a4e149c251e8bdd0a0e4e5bf81fe
- TLSH T124810240434001E3D05417B254E113085B16939497430F03160102018851B484C61A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- TLSH T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\innorixas-splash.jpg
- Size 92KB
- SHA256 23ec9c10c5a40a48e335f222c24de21d5b79cd2627d298cd04b140ef95c9a380
- MD5 8ee69255008f34fa3e6af8ea9bedd5ba
- SHA1 623ac574eee4bd35f4eafb4f14a5d6fe26a3b662
- SHA512 06b0e10240f6083b22b3f02c78e2a3d6b239eafa369ad6a1485d5edf63725d3fe1b6850e5857476ddb6b6d55d77e38314282b4e8ddef6f3edafe9e547f7d27e2
- SSDEEP 1536:JENQpxbClWvJViKwqA+eL+2uAq6rE/102W3v2Tyy7+giu7Qqu0DHtN4Uq/Hg:KNOFiXWeL+irg102Wf0yy1iAtumHTCHg
- TLSH T10F9302122F56B10EF628FC43CBD7394CC8ABC524D383A5CB92C5C55AE19ADE1631A6E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\newadvsplash.dll
- Size 8KB
- SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
- MD5 7ee14dff57fb6e6c644b318d16768f4c
- SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
- SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
- SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
- TLSH T1A002E839618096F3D26F15F45882AB1D4BFAE074239290324F73A1EA6DC0297FDB6347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\nsExec.dll
- Size 6KB
- SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
- MD5 b648c78981c02c434d6a04d4422a6198
- SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
- SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
- SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
- TLSH T128D1F97675E22EB3C54ACA353C527A2B57F8C8111B9401549B978BD238C5EF3EA29282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\nsProcess.dll
- Size 4KB
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- TLSH T10E91D77693D440B2D186093255A31AA31BEDC536035B590EAF835E937F90DFBECB9322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nshA2C5.tmp\nsisFirewall.dll
- Size 8KB
- SHA256 2e204ee4f1d12b4ca35c8205cea0cabe354f2e79a471863cfb76a7cee83cf107
- MD5 69f2e8c6fd141e9e720b2c4c366a8154
- SHA1 a6279d93a102b6d7608dced32a36ddcd3e51994c
- SHA512 bf23a5f3ce98e6a1c04fe8ae6b6f385483ceed62470cd109017c97f37c23adbf0203bfb43d09b007c6925aeb5da9617f33bc5c478618f00cc91da83a48cacaf2
- SSDEEP 96:KCQjg8aCpUcmloiwmXaYY8NVxIYn69TEdUc1ND0RrXQAcuAtoFrJxalMu2k:KCQPeip58NjMNWND0RrXYuAWkM
- TLSH T14DF1D73076E181B2D32F02F45F4B539EA5B5B630BBE041336B53570D2DB068DE96AB22
- MD5 SHA1 SHA512 SSDEEP TLSH