File name:

INNORIX-Agent.exe

Full analysis: https://app.any.run/tasks/9f6838aa-0ea6-460a-a2a9-981f56e4bca1
Verdict: Malicious activity
Analysis date: August 30, 2024, 11:05:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

2AFCDE413B0B05FCF22E8DBF14306502

SHA1:

96DFA67BAB560937CAA001FB2EA16CCC8753E871

SHA256:

E35031C6F4AB917233E380F7922140D90D1FE1EC16BEB5A94B1504DC975CC5DD

SSDEEP:

98304:xsr0JvrJLaAwLUwfkogTwHG2nDold9hSDo85e3/9uH5OoVQqn+mw+wyc1Bpq7nIC:d1mjMqA+Xm7g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • INNORIX-Agent.exe (PID: 5000)

    • Reads security settings of Internet Explorer

      • INNORIX-Agent.exe (PID: 5000)

    • Uses TASKKILL.EXE to kill process

      • INNORIX-Agent.exe (PID: 5000)

    • Executable content was dropped or overwritten

      • INNORIX-Agent.exe (PID: 5000)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 5504)

    • Creates a software uninstall entry

      • INNORIX-Agent.exe (PID: 5000)

    • Executes as Windows Service

      • innorixam.exe (PID: 4996)
      • innorixas.exe (PID: 6824)

    • Starts CMD.EXE for commands execution

      • innorixam.exe (PID: 4996)
      • innorixas.exe (PID: 6824)

  • INFO

    • Checks supported languages

      • INNORIX-Agent.exe (PID: 5000)
      • innorixas.exe (PID: 6576)
      • innorixam.exe (PID: 3700)
      • innorixam.exe (PID: 2876)
      • innorixam.exe (PID: 4996)
      • innorixas.exe (PID: 6376)
      • innorixas.exe (PID: 6824)
      • innorixst.exe (PID: 7032)
      • innorixam.exe (PID: 7080)
      • innorixas.exe (PID: 6888)

    • Reads the computer name

      • INNORIX-Agent.exe (PID: 5000)
      • innorixas.exe (PID: 6576)
      • innorixam.exe (PID: 3700)
      • innorixam.exe (PID: 2876)
      • innorixam.exe (PID: 4996)
      • innorixas.exe (PID: 6376)
      • innorixas.exe (PID: 6824)
      • innorixam.exe (PID: 7080)
      • innorixas.exe (PID: 6888)
      • innorixst.exe (PID: 7032)

    • The process uses the downloaded file

      • INNORIX-Agent.exe (PID: 5000)

    • Create files in a temporary directory

      • INNORIX-Agent.exe (PID: 5000)

    • Reads the machine GUID from the registry

      • innorixas.exe (PID: 6824)
      • innorixst.exe (PID: 7032)

    • Creates files in the program directory

      • innorixas.exe (PID: 6824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x322b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.2.18.389
ProductVersionNumber: 9.2.18.389
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: INNORIX
CompanyWebsite: http://www.innorix.com
FileDescription: -
FileVersion: 9.2.18.389
LegalCopyright: -
ProductName: INNORIX Agent x86
ProductVersion: 9.2.18.389
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
37
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start innorix-agent.exe taskkill.exe no specs taskkill.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs innorixas.exe no specs conhost.exe no specs innorixam.exe no specs conhost.exe no specs innorixam.exe no specs conhost.exe no specs innorixam.exe no specs cmd.exe no specs conhost.exe no specs netstat.exe no specs cmd.exe no specs conhost.exe no specs innorixas.exe no specs innorixas.exe no specs cmd.exe no specs conhost.exe no specs innorixam.exe no specs innorixst.exe no specs innorixas.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs innorix-agent.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1124sc delete innoiotC:\Windows\SysWOW64\sc.exe—INNORIX-Agent.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1224C:\WINDOWS\system32\cmd.exe /c C:\INNORIX_Agent\innorixas.exe -startC:\Windows\SysWOW64\cmd.exe—innorixam.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1616C:\WINDOWS\system32\cmd.exe /c C:\INNORIX_Agent\innorixam.exe -startC:\Windows\SysWOW64\cmd.exe—innorixas.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092taskkill.exe /f /im innorixTray.exeC:\Windows\SysWOW64\taskkill.exe—INNORIX-Agent.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2232netstat -anoC:\Windows\SysWOW64\NETSTAT.EXE—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
2584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—innorixam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—innorixas.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2876C:\INNORIX_Agent\innorixam.exe -startC:\INNORIX_Agent\innorixam.exe—INNORIX-Agent.exe
User:
admin
Company:
INNORIX
Integrity Level:
HIGH
Description:
INNORIX Agent Monitor
Exit code:
0
Version:
1.1.0.8
Modules
Images
c:\innorix_agent\innorixam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
8 703
Read events
8 670
Write events
32
Delete events
1

Modification events

(PID) Process:(5000) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5000) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5000) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5000) INNORIX-Agent.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5504) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION
(PID) Process:(5504) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION
(PID) Process:(5504) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL
(PID) Process:(5504) certutil.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%systemroot%\system32\wsdapi.dll,-200
Value:
Trusted Devices
(PID) Process:(5504) certutil.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Windows\SysWOW64\AppxPackaging.dll,-1001
Value:
Trusted Packaged App Installation Authorities
(PID) Process:(5504) certutil.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\SessEnv.dll,-101
Value:
Remote Desktop
Executable files
10
Suspicious files
44
Text files
9
Unknown types
7

Dropped files

PID
Process
Filename
Type
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\nsProcess.dllexecutable
MD5:FAA7F034B38E729A983965C04CC70FC1
SHA256:579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\nsisFirewall.dllexecutable
MD5:69F2E8C6FD141E9E720B2C4C366A8154
SHA256:2E204EE4F1D12B4CA35C8205CEA0CABE354F2E79A471863CFB76A7CEE83CF107
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\newadvsplash.dllexecutable
MD5:7EE14DFF57FB6E6C644B318D16768F4C
SHA256:53377D0710F551182EDBAB4150935425948535D11B92BF08A1C2DCF989723BD7
5000INNORIX-Agent.exeC:\INNORIX_Agent\innorixas.confbinary
MD5:152D26F387A05F9C858D1E18B5CF13C2
SHA256:0C1E9B0A92F09F794702C4C6D001F8F3A07D8E0A451BF90855C8F7A7421A1EEE
5000INNORIX-Agent.exeC:\INNORIX_Agent\innorixam.exeexecutable
MD5:1ABF549CF57A20097E91DFD5B5934810
SHA256:E1B82474B4464D3B593DD1D980578483363FB80BA93F5C0F8BF183F64AD5792D
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\innorixas-splash.jpgimage
MD5:DF801E9C13F1DA03087FC0F7429DC988
SHA256:1DED59B3015590B45150A956476266742DE0066F74BF6D313CD7289FFF008F3C
5000INNORIX-Agent.exeC:\INNORIX_Agent\innorix.pemtext
MD5:45CBE8DF9229EEA1CB05BD566C2A827E
SHA256:562B4BF1094935979A9D10C38A7609516A4FA108809875F6FD53B7D134B75A05
5000INNORIX-Agent.exeC:\INNORIX_Agent\ca.crttext
MD5:15252889E5D99A2AC60734B4F1C7148A
SHA256:3D5948994E5D9FFB5367FDD6466AD7D734A7D45275126A8FAC4478D93CDDCFB8
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\nsExec.dllexecutable
MD5:B648C78981C02C434D6A04D4422A6198
SHA256:3E3D516D4F28948A474704D5DC9907DBE39E3B3F98E7299F536337278C59C5C9
5000INNORIX-Agent.exeC:\Users\admin\AppData\Local\Temp\nsbA87F.tmp\SimpleSC.dllexecutable
MD5:D63975CE28F801F236C4ACA5AF726961
SHA256:E0C580BBE48A483075C21277C6E0F23F3CBD6CE3EB2CCD3BF48CF68F05628F43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
23
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2108
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3292
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3292
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4760
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2108
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2108
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3292
SIHClient.exe
52.165.165.26:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3292
SIHClient.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 52.183.220.149
whitelisted
google.com
  • 142.251.140.14
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
INNORIX-Agent.exe