{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Silent proxyware and compute-resource theft expose an organization to unauthorized network traffic and resource degradation; identifying and clearing these persistent tasks is necessary to stop the ongoing monetization of business assets." }, "name": "Trojanized Inno Installer Staging and Callbacks", "type": "investigation", "labels": [ "hunt", "attack.t1036", "attack.t1053.005", "attack.t1059.001", "attack.t1071.001", "attack.t1105", "attack.t1195.002", "attack.t1204.002", "attack.t1496", "attack.t1562.001", "attack.t1564.003", "command and control", "execution", "initial access", "persistence" ], "related": [ { "hunt": "proxyware-resource-theft", "reason": "This hunt focuses on the Inno Setup delivery mechanism; a broader hunt would look for any proxyware installation regardless of the original lure.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule may fire on the task name, but this hunt correlates the initial staging behavior, the rare temporary executables, and the network callbacks into a two-phase assessment that confirms the infection chain.", "coverage": [ { "stage": "initial-access-deceptive-lures", "steps": [ "scope-hosts-with-lures" ], "status": "covered" }, { "stage": "execution-inno-runner-staging", "steps": [ "inno-staging-activity", "rare-temporary-runners" ], "status": "covered" }, { "stage": "c2-offer-callback", "steps": [ "tracking-callbacks" ], "status": "covered" }, { "stage": "persistence-monetization-payloads", "steps": [ "monetization-persistence" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Deceptive download lures", "slug": "initial-access-deceptive-lures", "tactic": "initial-access", "techniques": [ "T1195.002", "T1204.002" ], "observables": [ "Echo Client.exe", "FabFilter Total Bundle.exe", "Navicat Premium crack.exe", "auto-clicker.exe", "clownfishvoicechanger.exe" ] }, { "name": "Inno Setup runner staging", "slug": "execution-inno-runner-staging", "tactic": "execution", "techniques": [ "T1059.001", "T1036" ], "observables": [ "%TEMP%\\is-*.tmp\\", "eld0.exe", "eld1.exe", "eld5.exe", "set_*.exe", "/SL5=", "/SPAWNWND=", "/FIRSTWND=" ] }, { "name": "Offer execution callback", "slug": "c2-offer-callback", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1105" ], "observables": [ "d=inno", "r=offer_execution", "r=offer_execution_fail", "orbittrack.cfd", "prairielink.cfd", "willowbox.xyz", "stonestation.cfd", "foldlodge.xyz", "friendsanchor.xyz", "fallport.cfd", "wishcourt.cfd", "cratebase.cfd", "beliefdesk.xyz", "companyharbor.xyz", "signalpane.cfd", "inkact.xyz", "wishgrove.cfd" ] }, { "name": "Monetization payload installation", "slug": "persistence-monetization-payloads", "tactic": "persistence", "techniques": [ "T1053.005", "T1496", "T1564.003", "T1562.001" ], "observables": [ "C:\\Program Files\\WorldProxyPool\\sdk-agent.exe", "WorldProxyPoolAgent", "WorldProxyPoolWatchdog", "WorldProxyPoolUpdater", "CharityEngine", "Berkeley Open Infrastructure for Network Computing", "Advanced Windows Manager", "Windows Manager" ] } ], "summary": "A campaign using trojanized Inno Setup installers delivered via fake software downloads to install various monetization payloads such as proxyware, distributed computing agents, and adware. The campaign utilizes a structured HTTP callback system to track offer installation status and secures persistence through SYSTEM-level scheduled tasks." }, "severity": "high", "rationale": "Focus on user workstations where software inventory shows activators or cracked tools. If these are not present, expand to the whole estate filtering for Inno-specific temp paths.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has delivered monetization payloads using a trojanized Inno Setup installer that stages numbered executables in temporary paths, contacts offer-tracking infrastructure, and establishes persistence via SYSTEM-level scheduled tasks.", "parameters": { "c2_domains": { "from": { "ref": "msrc-blog-20261103", "kind": "article", "observed": "2026-11-03" }, "type": "list[domain]", "default": [ "offerloader.da", "orbittrack.cfd", "prairielink.cfd", "willowbox.xyz", "stonestation.cfd", "foldlodge.xyz", "friendsanchor.xyz", "fallport.cfd", "wishcourt.cfd", "cratebase.cfd" ], "description": "Offer-tracking and callback domains identified in the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty to scan the full estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/", "name": "Microsoft Security Blog \u2014 Fake-download campaign uses trojanized installers to deliver monetization payloads" } ], "blind_spots": [ { "id": "no-dns-attribution", "risk": "If DNS logs only capture the resolver's traffic without the client's internal IP, the infected host cannot be identified directly from network telemetry.", "stage": "c2-offer-callback", "question": "Which specific host resolved the campaign tracking domain?", "requires": "hb_dns_activity with host-to-IP attribution" }, { "id": "http-query-truncation", "risk": "The campaign relies on HTTP query parameters for attribution; if proxy logs truncate the URL after the path, the offer-execution signal is lost.", "stage": "c2-offer-callback", "question": "Was the 'd=inno' parameter present in the tracking callback?", "requires": "hb_http_activity with url_query retention" } ] }, "name": "Trojanized Inno Installer Staging and Callbacks", "description": "This hunt identifies the multi-stage execution and persistence model used by a fake-download campaign. The campaign lures users with cracked software and activators to run Inno Setup-style wrappers. These wrappers stage numbered payloads in the user's temp directory and contact rotating infrastructure to report offer outcomes. Finally, the campaign installs monetization components like proxyware or compute-resource miners, often persistent through SYSTEM-level scheduled tasks. The hunt follows these stages in two phases: first identifying the temporary staging activity and then corroborating it with the network callbacks and persistence mechanisms." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-deceptive-lures", "steps": [ "scope-hosts-with-lures" ], "status": "covered" }, { "stage": "execution-inno-runner-staging", "steps": [ "inno-staging-activity", "rare-temporary-runners" ], "status": "covered" }, { "stage": "c2-offer-callback", "steps": [ "tracking-callbacks" ], "status": "covered" }, { "stage": "persistence-monetization-payloads", "steps": [ "monetization-persistence" ], "status": "covered" } ], "rationale": "An adversary has delivered monetization payloads using a trojanized Inno Setup installer that stages numbered executables in temporary paths, contacts offer-tracking infrastructure, and establishes persistence via SYSTEM-level scheduled tasks.", "blind_spots": [ { "id": "no-dns-attribution", "risk": "If DNS logs only capture the resolver's traffic without the client's internal IP, the infected host cannot be identified directly from network telemetry.", "stage": "c2-offer-callback", "question": "Which specific host resolved the campaign tracking domain?", "requires": "hb_dns_activity with host-to-IP attribution" }, { "id": "http-query-truncation", "risk": "The campaign relies on HTTP query parameters for attribution; if proxy logs truncate the URL after the path, the offer-execution signal is lost.", "stage": "c2-offer-callback", "question": "Was the 'd=inno' parameter present in the tracking callback?", "requires": "hb_http_activity with url_query retention" } ], "scoping_notes": "Focus on user workstations where software inventory shows activators or cracked tools. If these are not present, expand to the whole estate filtering for Inno-specific temp paths.", "beyond_detection": "A simple rule may fire on the task name, but this hunt correlates the initial staging behavior, the rare temporary executables, and the network callbacks into a two-phase assessment that confirms the infection chain." } }, { "id": "scope-hosts-with-lures", "type": "query", "label": "Scope to hosts with software lures", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%crack%' OR LOWER(package_name) LIKE '%activator%' OR LOWER(package_name) LIKE '%unlocker%' OR LOWER(package_name) LIKE '%roblox%') AND asset_scope = 'endpoint'", "surface": "hb_software_inventory", "description": "Identify hosts running software packages commonly used as lures for this campaign, such as cracked tools, activators, or game-related executors.", "expected_signal": "A list of hosts containing suspicious software. Silence means no such software is indexed, but the hunt should still proceed unscoped if the analyst chooses." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope to hosts with software lures", "reads": [ "asset_scope", "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%crack%' OR LOWER(package_name) LIKE '%activator%' OR LOWER(package_name) LIKE '%unlocker%' OR LOWER(package_name) LIKE '%roblox%') AND asset_scope = 'endpoint'", "silence": "not_evidence_of_absence", "expected": "A list of hosts containing suspicious software. Silence means no such software is indexed, but the hunt should still proceed unscoped if the analyst chooses.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "inno-staging-activity", "type": "query", "label": "Inno runner execution patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\is-%.tmp\\%' OR LOWER(process_cmd_line) LIKE '%/sl5=%' OR LOWER(process_cmd_line) LIKE '%/spawnwnd=%' OR LOWER(process_cmd_line) LIKE '%/firstwnd=%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Identify processes executing from the Inno temporary directory or using characteristic wrapper arguments like /SL5.", "expected_signal": "Process rows showing the Inno runner staging environment. The parent may be the original lure filename." }, "parents": [ { "id": "scope-hosts-with-lures" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Inno runner execution patterns", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_path, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\temp\\is-%.tmp\\%' OR LOWER(process_cmd_line) LIKE '%/sl5=%' OR LOWER(process_cmd_line) LIKE '%/spawnwnd=%' OR LOWER(process_cmd_line) LIKE '%/firstwnd=%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Process rows showing the Inno runner staging environment. The parent may be the original lure filename.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "rare-temporary-runners", "type": "query", "label": "Prevalence of temporary runner names", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS p_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\temp\\is-%.tmp\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY 1 HAVING host_count <= 5 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count processes running from the Inno temp path so rare numbered stages like eld0.exe stand out from legitimate updaters.", "expected_signal": "A binary name seen on very few hosts (e.g., eld1.exe); common installer names are ignored." }, "parents": [ { "id": "scope-hosts-with-lures" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Prevalence of temporary runner names", "reads": [ "device_hostname", "process_name", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS p_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_path) LIKE '%\\temp\\is-%.tmp\\%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY 1 HAVING host_count <= 5 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A binary name seen on very few hosts (e.g., eld1.exe); common installer names are ignored.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 5 }, "verified_at": "2026-11-04" } }, { "id": "triage-early-staging", "type": "analytic", "label": "Triage early staging activity", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "inno-staging-activity", "rare-temporary-runners" ], "objective": "Identify hosts showing Inno Setup runner activity based on temp paths and rare numbered process names.", "description": "Determine whether the process execution and prevalence patterns indicate a trojanized Inno Setup installer session.", "max_iterations": 3, "expected_signal": "A per-host verdict on the staging phase.", "success_criteria": "A verdict of suspicious if rare processes execute from the Inno temp path with /SL5 arguments." }, "parents": [ { "id": "inno-staging-activity", "kind": "merge" }, { "id": "rare-temporary-runners", "kind": "merge" } ] }, { "id": "tracking-callbacks", "type": "query", "label": "DNS callbacks to tracking domains", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_dns_activity", "description": "Match the report's offer-tracking domains to DNS activity on the host.", "expected_signal": "Any row links a host to a known campaign tracking domain. Silence is common as domains rotate." }, "parents": [ { "id": "triage-early-staging" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS callbacks to tracking domains", "reads": [ "device_hostname", "process_name", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Any row links a host to a known campaign tracking domain. Silence is common as domains rotate.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "monetization-persistence", "type": "query", "label": "Monetization task persistence", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) LIKE '%worldproxypool%' OR LOWER(job_name) LIKE '%charityengine%' OR LOWER(job_name) LIKE '%boinc%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_scheduled_job", "description": "Find scheduled tasks associated with WorldProxyPool, CharityEngine, or BOINC installed by the campaign.", "expected_signal": "Hosts with monetization tasks. WorldProxyPoolAgent is the high-confidence indicator." }, "parents": [ { "id": "triage-early-staging" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Monetization task persistence", "reads": [ "device_hostname", "job_cmd_line", "job_name", "job_user_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (LOWER(job_name) LIKE '%worldproxypool%' OR LOWER(job_name) LIKE '%charityengine%' OR LOWER(job_name) LIKE '%boinc%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Hosts with monetization tasks. WorldProxyPoolAgent is the high-confidence indicator.", "verified": "dry-run", "verified_at": "2026-11-04" } }, { "id": "final-monetization-triage", "type": "analytic", "label": "Confirm monetization payload installation", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "triage-early-staging", "tracking-callbacks", "monetization-persistence" ], "objective": "Confirm whether the host has been compromised by the fake-download campaign by linking the Inno staging activity to follow-on callbacks and monetization tasks.", "description": "Correlate the staging verdict with the network and persistence evidence to confirm a complete infection chain.", "max_iterations": 3, "expected_signal": "A definitive verdict confirming monetization payloads.", "success_criteria": "A verdict of malicious for hosts showing both staging activity and either persistent tasks or DNS callbacks." }, "parents": [ { "id": "tracking-callbacks", "kind": "merge" }, { "id": "monetization-persistence", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on monetization verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-monetization-triage verdict is malicious for at least one host", "condition": "the final-monetization-triage verdict is malicious for at least one host", "blind_spot": "no-dns-attribution", "confidence": "high", "description": "Direct the hunt to containment for malicious hosts or review for suspicious ones.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-monetization-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further monetization activity and resource theft from the confirmed beachhead.", "instructions": "Isolate the host to prevent proxyware traffic and compute monetization. Collect temporary files and task XML for forensic capture.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "remediation-review", "type": "task", "label": "Remediation and analyst review", "config": { "assignee": "analyst", "description": "Verify the isolation and coordinate the removal of monetization persistence.", "instructions": "Review the rows cited by the agents. Confirm the removal of the WorldProxyPool or CharityEngine tasks and their associated binaries from Program Files. Scan for other PUA components that may have been bundled." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-report", "type": "task", "label": "Close-out report", "config": { "assignee": "analyst", "description": "Finalize the hunt and document findings and gaps.", "instructions": "Summarize the number of hosts identified and the specific monetization branches found. Note any blind spots in DNS or HTTP telemetry encountered during the hunt." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "remediation-review" } ] } ] }