File name:

INNORIX-Agent.exe

Full analysis: https://app.any.run/tasks/62f75520-f2ac-435f-9100-ddff4cdd68a8
Verdict: Malicious activity
Analysis date: June 19, 2023, 19:40:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

DD0BE022FBF0067F411C2EA9C6FA4E3A

SHA1:

9BC82B1A31DFD07A28C151C4F26DC3DB3DD68644

SHA256:

96DEA30902A4D98469D15E8089A44556646F733D9980F081CF2F33FD599786B3

SSDEEP:

196608:G69RngPaCE8aZJ2M9Pn/7yGJu4NIdyWtIT/GrZBgFV16OY92FidMjaheET:jRgPaCE8afh+eTNuPtuGVBgb16cIlhHT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • INNORIX-Agent.exe (PID: 3792)

    • Application was dropped or rewritten from another process

      • innorixam.exe (PID: 3508)
      • innorixam.exe (PID: 3132)
      • innorixam.exe (PID: 3928)

  • SUSPICIOUS

    • Reads the Internet Settings

      • INNORIX-Agent.exe (PID: 3792)

    • Executable content was dropped or overwritten

      • INNORIX-Agent.exe (PID: 3792)

    • Uses TASKKILL.EXE to kill process

      • nsA385.tmp (PID: 548)
      • nsA461.tmp (PID: 3208)
      • nsA4CF.tmp (PID: 3484)
      • nsA61A.tmp (PID: 2384)
      • nsA5AB.tmp (PID: 1584)
      • nsA688.tmp (PID: 940)

    • Starts application with an unusual extension

      • INNORIX-Agent.exe (PID: 3792)

    • Starts SC.EXE for service management

      • nsA7C2.tmp (PID: 3164)
      • nsA831.tmp (PID: 568)
      • nsA754.tmp (PID: 3492)
      • nsA89F.tmp (PID: 1280)

    • Executes as Windows Service

      • innorixam.exe (PID: 3928)

    • Starts CMD.EXE for commands execution

      • innorixam.exe (PID: 3928)

  • INFO

    • Manual execution by a user

      • INNORIX-Agent.exe (PID: 148)
      • INNORIX-Agent.exe (PID: 3792)

    • Reads the computer name

      • INNORIX-Agent.exe (PID: 3792)
      • innorixam.exe (PID: 3508)
      • innorixam.exe (PID: 3132)
      • innorixam.exe (PID: 3928)

    • The process checks LSA protection

      • INNORIX-Agent.exe (PID: 3792)
      • taskkill.exe (PID: 2724)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 2660)
      • taskkill.exe (PID: 2912)
      • taskkill.exe (PID: 3956)
      • taskkill.exe (PID: 2776)
      • certutil.exe (PID: 2908)

    • Checks supported languages

      • INNORIX-Agent.exe (PID: 3792)
      • nsA299.tmp (PID: 1544)
      • nsA385.tmp (PID: 548)
      • nsA317.tmp (PID: 1848)
      • nsA461.tmp (PID: 3208)
      • nsA4CF.tmp (PID: 3484)
      • nsA5AB.tmp (PID: 1584)
      • nsA61A.tmp (PID: 2384)
      • nsA688.tmp (PID: 940)
      • nsA7C2.tmp (PID: 3164)
      • nsA754.tmp (PID: 3492)
      • nsA831.tmp (PID: 568)
      • nsB91B.tmp (PID: 4000)
      • nsA89F.tmp (PID: 1280)
      • nsBA06.tmp (PID: 2976)
      • innorixam.exe (PID: 3508)
      • nsBA75.tmp (PID: 3308)
      • innorixam.exe (PID: 3132)
      • nsBB41.tmp (PID: 3552)
      • innorixam.exe (PID: 3928)
      • nsBFA7.tmp (PID: 2176)

    • Reads the machine GUID from the registry

      • INNORIX-Agent.exe (PID: 3792)

    • Create files in a temporary directory

      • INNORIX-Agent.exe (PID: 3792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductVersion: 9.2.18.458
ProductName: INNORIX Agent x64
LegalCopyright: -
FileVersion: 9.2.18.458
FileDescription: -
CompanyWebsite: http://www.innorix.com
CompanyName: INNORIX
CharacterSet: ASCII
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 9.2.18.458
FileVersionNumber: 9.2.18.458
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x322b
UninitializedDataSize: 1024
InitializedDataSize: 118784
CodeSize: 24064
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2016:07:25 00:55:47+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Jul-2016 00:55:47
Detected languages:
  • English - United States
CompanyName: INNORIX
CompanyWebsite: http://www.innorix.com
FileDescription: -
FileVersion: 9.2.18.458
LegalCopyright: -
ProductName: INNORIX Agent x64
ProductVersion: 9.2.18.458

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Jul-2016 00:55:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005DC5
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47111
.rdata
0x00007000
0x00001246
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.0004
.data
0x00009000
0x0001A818
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.2206
.ndata
0x00024000
0x0000D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00031000
0x0004E340
0x0004E400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.06358

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29551
1065
UNKNOWN
English - United States
RT_MANIFEST
2
5.60569
67624
UNKNOWN
English - United States
RT_ICON
3
7.92698
47620
UNKNOWN
English - United States
RT_ICON
4
5.65203
38056
UNKNOWN
English - United States
RT_ICON
5
5.71884
16936
UNKNOWN
English - United States
RT_ICON
6
5.73019
9640
UNKNOWN
English - United States
RT_ICON
7
5.85252
6760
UNKNOWN
English - United States
RT_ICON
8
3.12135
4264
UNKNOWN
English - United States
RT_ICON
9
3.45759
2440
UNKNOWN
English - United States
RT_ICON
10
3.47025
1720
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
113
Monitored processes
46
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runas.exe no specs innorix-agent.exe no specs innorix-agent.exe nsa299.tmp no specs nsa317.tmp no specs nsa385.tmp no specs taskkill.exe no specs nsa461.tmp no specs taskkill.exe no specs nsa4cf.tmp no specs taskkill.exe no specs nsa5ab.tmp no specs taskkill.exe no specs nsa61a.tmp no specs taskkill.exe no specs nsa688.tmp no specs taskkill.exe no specs nsa754.tmp no specs sc.exe no specs nsa7c2.tmp no specs sc.exe no specs nsa831.tmp no specs sc.exe no specs nsa89f.tmp no specs sc.exe no specs nsb91b.tmp no specs certutil.exe no specs nsba06.tmp no specs nsba75.tmp no specs innorixam.exe no specs nsbb41.tmp no specs innorixam.exe no specs innorixam.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs nsbfa7.tmp no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
148"C:\Users\admin\Desktop\INNORIX-Agent.exe" C:\Users\admin\Desktop\INNORIX-Agent.exe—explorer.exe
User:
admin
Company:
INNORIX
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
9.2.18.458
Modules
Images
c:\users\admin\desktop\innorix-agent.exe
c:\windows\system32\ntdll.dll
548"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA385.tmp" taskkill.exe /f /im innorixam.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA385.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa385.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
568"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA831.tmp" sc delete innorixamC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA831.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1060
Modules
Images
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa831.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
676C:\Windows\system32\cmd.exe /c -startC:\Windows\System32\cmd.exe—innorixam.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
940"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA688.tmp" taskkill.exe /f /im innorixTray.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA688.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa688.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
1148sc delete innoiotmC:\Windows\System32\sc.exe—nsA7C2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA89F.tmp" sc delete innorixasC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA89F.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1060
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa89f.tmp
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1544"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA299.tmp" C:\INNORIX_Agent\innorixam.exe -stopC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA299.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa299.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1584"C:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA5AB.tmp" taskkill.exe /f /im innoiotm.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA5AB.tmp—INNORIX-Agent.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nsz9951.tmp\nsa5ab.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
1604netstat -anoC:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\iphlpapi.dll
Total events
1 641
Read events
1 615
Write events
26
Delete events
0

Modification events

(PID) Process:(3792) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3792) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3792) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3792) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2908) certutil.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3792) INNORIX-Agent.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\INNORIX\Agent
Operation:writeName:configPath
Value:
C:\INNORIX_Agent
(PID) Process:(2504) NETSTAT.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters
Operation:writeName:TrapPollTimeMilliSecs
Value:
15000
(PID) Process:(3472) NETSTAT.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters
Operation:writeName:TrapPollTimeMilliSecs
Value:
15000
(PID) Process:(1604) NETSTAT.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent\CurrentVersion\Parameters
Operation:writeName:TrapPollTimeMilliSecs
Value:
15000
Executable files
28
Suspicious files
2
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA299.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA5AB.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\innorixas-splash.jpgimage
MD5:DF801E9C13F1DA03087FC0F7429DC988
SHA256:1DED59B3015590B45150A956476266742DE0066F74BF6D313CD7289FFF008F3C
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsProcess.dllexecutable
MD5:FAA7F034B38E729A983965C04CC70FC1
SHA256:579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA4CF.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA7C2.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
3792INNORIX-Agent.exeC:\INNORIX_Agent\ca.crttext
MD5:15252889E5D99A2AC60734B4F1C7148A
SHA256:3D5948994E5D9FFB5367FDD6466AD7D734A7D45275126A8FAC4478D93CDDCFB8
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA385.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
3792INNORIX-Agent.exeC:\INNORIX_Agent\innorix.pemtext
MD5:45CBE8DF9229EEA1CB05BD566C2A827E
SHA256:562B4BF1094935979A9D10C38A7609516A4FA108809875F6FD53B7D134B75A05
3792INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsz9951.tmp\nsA831.tmpexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1820
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
INNORIX-Agent.exe