Overview

overview

7

Static

static

3

infonotary-signer.exe

windows10-2004-x64

7

infonotary-signer.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    153s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    infonotary-signer.exe
  • Size 2.1MB
  • Sample260805-pgssjafm91
  • SHA256 02fa4cfe27b567286c7646eb188a835cce57e019d5fccc0311191199b11c5aaa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerransomware

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe
    "C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Local\Temp\is-TM2WT4UDRS.tmp\infonotary-signer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TM2WT4UDRS.tmp\infonotary-signer.tmp" /SL5="$60204,958464,958464,C:\Users\Admin\AppData\Local\Temp\infonotary-signer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-VRLSC74IPC.tmp\setup.msi" /passive /norestart
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:5940
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5220
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 2BA685F2FB109AEA9FB9CB8B8E3A7A70
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4596
    • C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe
      "C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe
        "C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Windows\SYSTEM32\reg.exe
          reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
          4⤵
            PID:4236
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3108

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5b16e3.rbs
          • Path C:\Config.Msi\e5b16e3.rbs
          • Size 91KB
          • SHA256 ac53276d92542844c88fc167fc4a9ce4a3def14bef550e72e1cf18a74670048f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InfoNotary e-Doc Signer.exe
          • Path C:\Program Files\InfoNotary e-Doc Signer\InfoNotary e-Doc Signer.exe
          • Size 598KB
          • SHA256 73f54ba6f23b2333797c8215acba994968b886c836287c6057f29889d708b7a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .package
          • Path C:\Program Files\InfoNotary e-Doc Signer\app\.package
          • Size 23B
          • SHA256 6417e3b88fb403acd853f8a3f950ab2ec0b594bffa915c3a406cfc4683e01413
          • MD5 SHA1 SHA512
          Submit Download

          InfoNotary e-Doc Signer.cfg
          • Path C:\Program Files\InfoNotary e-Doc Signer\app\InfoNotary e-Doc Signer.cfg
          • Size 186B
          • SHA256 ddd935d14488b546cace2efdc4de590a3ff2e9978d781d7cee8908ea59a1ee50
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extnet.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\extnet.dll
          • Size 24KB
          • SHA256 7ba7194450a89b2365d9b8a5fbdb671aae7b910e7033544ae9e214df41616a28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\java.dll
          • Size 116KB
          • SHA256 18e4048d79e7c93261b62fce8c62e177c06ce80f05d791c88134e6e576200e34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jimage.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\jimage.dll
          • Size 33KB
          • SHA256 8a118ff02c90b355796f24ec76bddb650277427653c310f81efeee639cdb0e5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jli.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\jli.dll
          • Size 82KB
          • SHA256 037991792d5d3e20c46982cbe69ddad55f713e5bce3f845e910cf4ca2e26becb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          management.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\management.dll
          • Size 29KB
          • SHA256 76dd225c79f4d9e04229bb2ea17ad6ec40ff87365fd90d026b4c07934745d67f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          management_ext.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\management_ext.dll
          • Size 35KB
          • SHA256 9952fa5de1278b601aa5780f1d614542a1fcb7d4b58992f4f893bc07eec6fc7a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\msvcp140.dll
          • Size 562KB
          • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          net.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\net.dll
          • Size 60KB
          • SHA256 86b62d441327cd36efc40f14464a2e26dc3357f84ffd6ed8c85419d9d9c5c52b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nio.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\nio.dll
          • Size 80KB
          • SHA256 ece76e08f8b533cf65cb720ca85e73b20d16b9f277c1bef2e82a6875e14fe5a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jvm.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\server\jvm.dll
          • Size 13.9MB
          • SHA256 994727373b31175683282e530d6dc2772f6b0f189e31d9b5f4a3c132ebdb92bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sunmscapi.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\sunmscapi.dll
          • Size 48KB
          • SHA256 68487a862d510b6f835bcbede02759f8d92fb59bb6c00f9f0082aa61f192ffa2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\vcruntime140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zip.dll
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\bin\zip.dll
          • Size 82KB
          • SHA256 11ad1392935c11a5de365eba4326730d0c7258bcb9e885372d3f4f66ce7c11e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jaxp.properties
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\jaxp.properties
          • Size 8KB
          • SHA256 d4f45052a100e5aef02b6638a3b9c69b2bdd46155ceb58a52671e5d594c30100
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logging.properties
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\logging.properties
          • Size 2KB
          • SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          net.properties
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\net.properties
          • Size 7KB
          • SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.security
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\security\java.security
          • Size 67KB
          • SHA256 778c41102c3a82f92d1717cf0768e5c82bc6d143a10dfa3f084a331b430ddd5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          default_US_export.policy
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\security\policy\unlimited\default_US_export.policy
          • Size 146B
          • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          default_local.policy
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\conf\security\policy\unlimited\default_local.policy
          • Size 193B
          • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ADDITIONAL_LICENSE_INFO
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\legal\java.logging\ADDITIONAL_LICENSE_INFO
          • Size 49B
          • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
          • MD5 SHA1 SHA512
          Submit Download

          ASSEMBLY_EXCEPTION
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\legal\java.logging\ASSEMBLY_EXCEPTION
          • Size 44B
          • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\legal\java.logging\LICENSE
          • Size 33B
          • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
          • MD5 SHA1 SHA512
          Submit Download

          jvm.cfg
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\lib\jvm.cfg
          • Size 29B
          • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
          • MD5 SHA1 SHA512
          Submit Download

          blocked.certs
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\lib\security\blocked.certs
          • Size 2KB
          • SHA256 583500b76965eb54b03493372989ab4d3426f85462d1db232c5ae6706a4d6c58
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cacerts
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\lib\security\cacerts
          • Size 133KB
          • SHA256 18364915b67185fff18ec010be0a41525bdcf7b31f517a457d7a14103a59424c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tzdb.dat
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\lib\tzdb.dat
          • Size 100KB
          • SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tzmappings
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\lib\tzmappings
          • Size 15KB
          • SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          release
          • Path C:\Program Files\InfoNotary e-Doc Signer\runtime\release
          • Size 818B
          • SHA256 2587cd1ab864886203333e43162e17c63c3b4d6637690500f3e00795ff62da10
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.ini
          • Path C:\Users\Admin\.InfoNotary\config.ini
          • Size 533B
          • SHA256 6cc611078ce0f695b84ad507b9bacd6abad1944eba89647864d6035f5144632b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          api-ms-win-core-console-l1-1-0.dll
          • Path C:\Users\Admin\.openjfx\cache\25+29\amd64\api-ms-win-core-console-l1-1-0.dll
          • Size 21KB
          • SHA256 22b0d0412c274a04d11d7fd3f6545eff245e6f032e21b86d920c2844dd1007c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-console-l1-2-0.dll
          • Path C:\Users\Admin\.openjfx\cache\25+29\amd64\api-ms-win-core-console-l1-2-0.dll
          • Size 21KB
          • SHA256 0c60ddcfddc6e11d77354d5695b822881f37fb537192e61e62f2ebd703fb2119
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-datetime-l1-1-0.dll
          • Path C:\Users\Admin\.openjfx\cache\25+29\amd64\api-ms-win-core-datetime-l1-1-0.dll
          • Size 21KB
          • SHA256 631a106755f13a78032d7c17cd19c5185fe89d93fda2ac108c4f53e27dcdecdb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-debug-l1-1-0.dll
          • Path C:\Users\Admin\.openjfx\cache\25+29\amd64\api-ms-win-core-debug-l1-1-0.dll
          • Size 21KB
          • SHA256 1ce185afeea0a30a12b496d95df395c18bd0e99570c0ac3126758476d4b6aea0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-errorhandling-l1-1-0.dll
          • Path C:\Users\Admin\.openjfx\cache\25+29\amd64\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 21KB
          • SHA256 cdbc9ee30658188fd9af68ad52b5d8e7f59111191b0681ec2ed9095d9c85ebee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          https___crc_bg_files__en_TSL_BG_xml
          • Path C:\Users\Admin\AppData\Local\Temp\https___crc_bg_files__en_TSL_BG_xml
          • Size 612KB
          • SHA256 b7ac246a31e6d805f4830cb36449ed86cdecef328a66a37b9bca9c2969b6fd66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          infonotary-signer.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-TM2WT4UDRS.tmp\infonotary-signer.tmp
          • Size 4.3MB
          • SHA256 24d5243fbfdb3e338a796f402acd7f8e26bc3da694fdd9d099f18438edb49069
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jna4025053538812059854.dll
          • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4025053538812059854.dll
          • Size 267KB
          • SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI2E31.tmp
          • Path C:\Windows\Installer\MSI2E31.tmp
          • Size 401KB
          • SHA256 6568a026ef61ef54e9b5441e643773ea701f6e74e52f2bab467b31bf76fce121
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI2EBE.tmp
          • Path C:\Windows\Installer\MSI2EBE.tmp
          • Size 412KB
          • SHA256 dbc7b083e46cb6ae1450e2b9b32c97689209290473fcc30c563c12291ae323ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 b30e3890b81cc26558378b407584fdaf6cfd8ef00dfa81be29d467bfd3374176
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {a54f875e-8443-44b4-969d-6d4ba1ac5ef4}_OnDiskSnapshotProp
          • Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a54f875e-8443-44b4-969d-6d4ba1ac5ef4}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 bcb1ea55d4b0a2f4ae240f6bf0760d89aa4adcb7658e962d745a44d4179b57cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2776-33-0x0000000000110000-0x0000000000563000-memory.dmp
          Download

          memory/2776-441-0x0000000000110000-0x0000000000563000-memory.dmp
          Download

          memory/2776-6-0x0000000002C80000-0x0000000002C81000-memory.dmp
          Download

          memory/2776-10-0x0000000002C80000-0x0000000002C81000-memory.dmp
          Download

          memory/2776-9-0x0000000000110000-0x0000000000563000-memory.dmp
          Download

          memory/2776-25-0x0000000000110000-0x0000000000563000-memory.dmp
          Download

          memory/2776-27-0x0000000000110000-0x0000000000563000-memory.dmp
          Download

          memory/4032-446-0x0000000000290000-0x0000000000388000-memory.dmp
          Download

          memory/4032-0-0x0000000000290000-0x0000000000388000-memory.dmp
          Download

          memory/4032-8-0x0000000000290000-0x0000000000388000-memory.dmp
          Download