Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)

Key facts for Inno Setup fake-download installers

Detection coverage for Inno Setup fake-download installers

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5169 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Trojanized Inno Setup Offer Runner (eld*.exe / set_*.exe / FirstFast[1].exe / SecondRunner[1].exe) Executed from is-*.tmp

TL-2026-5169: detects the Inno Setup wrapper spawning staged offer-loader runners (eld0-eld5 as eld*.exe, set_*.exe, FirstFast[1].exe, SecondRunner[1].exe) from %TEMP%\is-*.tmp\, the stage-2 behaviour of the fake-download (cracked software lure) campaign that delivers WorldProxyPool, CharityEngine/BOINC and AW Manager payloads. Flags the Inno switches /SL5, /SPAWNWND and /FIRSTWND when present.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: medium
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h Image IN ("*\\is-*.tmp\\eld*.exe", "*\\is-*.tmp\\set_*.exe", "*\\is-*.tmp\\FirstFast[1].exe", "*\\is-*.tmp\\SecondRunner[1].exe")
| eval inno_switch=if(match(CommandLine,"(?i) /(SL5|SPAWNWND|FIRSTWND)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line values(Hashes) as hashes values(inno_switch) as inno_switch by host, User, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath matches regex @"(?i)\\is-[^\\]+\.tmp\\(eld[0-5]|set_[^\\]+|FirstFast\[1\]|SecondRunner\[1\])\.exe$"
| extend InnoSwitch = ProcessCommandLine matches regex @"(?i)\s/(SL5|SPAWNWND|FIRSTWND)"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InnoSwitch, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Trojanized Inno Setup Offer Runner Executed from is-*.tmp (TL-2026-5169)
id: 3f1c7a52-8b1d-4e0a-9a67-5c2d1e8b4a01
status: experimental
description: Detects staged offer-loader runners eld*.exe, set_*.exe, FirstFast[1].exe and SecondRunner[1].exe launched from the Inno Setup temporary directory used by the fake-download monetization campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|re: '(?i)\\is-[^\\]+\.tmp\\(eld[0-5]|set_[^\\]+|FirstFast\[1\]|SecondRunner\[1\])\.exe$'
  condition: selection
falsepositives:
  - Legitimate Inno Setup installers that ship helper executables named set_*.exe from their temp directory
level: medium

Known false positives:

• Legitimate Inno Setup installers that stage a helper named set_*.exe in is-*.tmp
• Software packagers testing Inno-built installers in a lab

Tuning notes: Baseline set_*.exe by signer or hash for approved installers and exclude them; raise priority when the inno_switch field is yes or the parent is a user-writable download path; correlate with the d=inno offer callback detection (TL-2026-5169-SIG-003).

• 🔒 Silent Monetization Payload Installs Spawned by Inno Offer Runners (CharityEngine, VirtualBox 7.2.8, AW Manager, WorldProxyPool) · unlock with TL Creds
• 🔒 Hidden Non-Interactive PowerShell WorldProxyPool Watchdog Execution · unlock with TL Creds
• 🔒 WorldProxyPool Agent or Inno Runner Outbound Network Activity (Proxyware Relay / Offer Callback) · unlock with TL Creds
• 🔒 Known Campaign SHA-256 Hashes for Inno Offer Loaders and Runners · unlock with TL Creds
• 🔒 Monetization Payload Files Dropped (WorldProxyPool, CharityEngine/BOINC, AW Manager) · unlock with TL Creds
• 🔒 Inno Offer Execution Callback Query String (d=inno & r=offer_execution) · unlock with TL Creds
• 🔒 WorldProxyPool SYSTEM Scheduled Tasks Created (Agent, Watchdog, Updater) · unlock with TL Creds
• 🔒 Campaign Offer-Callback Domain Resolution or Request (.xyz / .cfd Rotating Infrastructure) · unlock with TL Creds

Indicators of compromise for Inno Setup fake-download installers

As of 2026-11-03, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5169.

Sample indicators (3 of 29)

• Domain: beliefdesk[.]xyz
• File hash: 006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
• Domain: companyharbor[.]xyz

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How Inno Setup fake-download installers works

Microsoft Threat Intelligence (blog dated 2026-11-03) describes a fake-download campaign in which users looking for cracked commercial software, free games, activators, plugins, executors or unofficial utilities run trojanized installers built with Inno Setup. Observed lure names include Echo Client, FabFilter Total Bundle, Navicat Premium crack, Cue Club, auto-clicker, Deadpool Apunka Games, Command & Conquer: Red Alert 2, TFT Unlock Tool and clownfishvoicechanger.

The chain has four stages: (1) the user executes the fake installer from a download; (2) the Inno wrapper spawns temporary runners from %TEMP%\is-*.tmp\ (observed with the Inno arguments /SL5, /SPAWNWND and /FIRSTWND) with staged executables (eld0-eld5 as eld*.exe, set_*.exe, FirstFast[1].exe, SecondRunner[1].exe); (3) the runners call back to rotating infrastructure with an HTTP request containing d=inno and r=offer_execution (r=offer_execution_fail with an msg error text on failure) and receive offer-controlled payloads; (4) one or more monetization payloads are installed, often with silent switches such as /qn, /S, /quiet and /norestart. The callback carries parameters such as sis (session correlation), a (affiliate/campaign identifier), o (offer id), dn (download/offer network), spot (offer slot/placement), fz (package size), t, paw, ko and cr. Observed o/dn pairs include 1712/507 (primary first-stage offer), 1720/536 (CharityEngine/BOINC branch), 1727/564 (WorldProxyPool branch), 1729/566, 331/244, 1674/440, 1675/441, 1681/447 and 1730/567.

WorldProxyPool is a proxyware agent that routes third-party internet traffic through the victim device. It installs to C:\Program Files\WorldProxyPool\ (sdk-agent.exe, sdk-agent.updater.exe, watchdog.ps1) and creates three SYSTEM/highest-privilege scheduled tasks: WorldProxyPoolAgent (runs sdk-agent.exe at startup), WorldProxyPoolWatchdog (hidden non-interactive PowerShell every 5 minutes) and WorldProxyPoolUpdater (sdk-agent.updater.exe update, hourly). The CharityEngine/BOINC branch enrolls the device in a distributed-computing platform (ce-installer_7.14.2_vbox-7.2.8.exe, wrapper_2022110901_windows_x86_64.exe, boinc.exe, charityengine.exe, ce11.exe, boinctray.exe, boinc.scr, boincscr.exe) and installs BOINC under C:\Program Files\BOINC\ and C:\ProgramData\BOINC\, together with a VirtualBox 7.2.8 MSI (VirtualBox-7.2.8-r173730.msi). The AW Manager / Windows Manager branch silently installs an adware-style utility (AdvancedWindowsManager.exe, Windows Updater.exe, Windows Manager - Postback Johan.msi) under %APPDATA%\AW Manager\Windows Manager 1.0.0\ and C:\Program Files (x86)\AW Manager\Windows Manager\.

No threat actor, CVE or CVSS is attributed in the source. Impact is resource hijacking and unconsented software installation rather than data theft or ransomware; the proxyware component does expose victim IP addresses to third-party traffic. Microsoft Defender detections include Trojan:Win64/OfferLoader.DA!MTB, Trojan:Win64/OfferLoader.DB!MTB, Behavior:Win32/SuspInnoOffer.A!mapsi, Trojan:Win32/OffLoader.A and Adware:Win32/Clover, plus endpoint behavior blocks SuspInnoOffer, SuspEtherRpcConn and SuspSmsScanConn. Note: the source did not state first-observed dates or victim counts.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1564.003 Hidden Window

Execution

T1053.005 Scheduled Task; T1059.001 PowerShell; T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task

Privilege Escalation

T1053.005 Scheduled Task

Command and Control

T1071.001 Web Protocols; T1090 Proxy

Impact

T1496 Resource Hijacking

Remediation for Inno Setup fake-download installers

Immediate actions

• Hunt for HTTP requests containing d=inno with r=offer_execution or r=offer_execution_fail
• Block the campaign domains (beliefdesk.xyz, companyharbor.xyz, signalpane.cfd, inkact.xyz, wishgrove.cfd, orbittrack.cfd, prairielink.cfd, willowbox.xyz, stonestation.cfd, foldlodge.xyz, friendsanchor.xyz, fallport.cfd, wishcourt.cfd, cratebase.cfd, belieftrack.cfd)
• Remove the WorldProxyPoolAgent, WorldProxyPoolWatchdog and WorldProxyPoolUpdater scheduled tasks and C:\Program Files\WorldProxyPool\ on affected hosts
• Uninstall unauthorized CharityEngine/BOINC, VirtualBox and AW Manager / Windows Manager installations

Workarounds

• Monitor execution from %TEMP%\is-*.tmp\ of eld*.exe, set_*.exe, FirstFast[1].exe and SecondRunner[1].exe

Longer-term hardening

• Avoid untrusted software sources such as cracked software and key generators
• Enable cloud-delivered protection and keep tamper protection enabled in Microsoft Defender Antivirus
• Configure reputation-based protection (SmartScreen) and evaluate Attack Surface Reduction rules
• Enable Event 4698 auditing for scheduled task creation and review new SYSTEM-level tasks
• Audit software inventory (e.g. Defender Vulnerability Management) for WorldProxyPool, CharityEngine, BOINC, VirtualBox and unexpected applications

Affected and fixed versions

• Microsoft — Windows (endpoints where users run trojanized Inno Setup installers)
  Vulnerable versions: Not version-specific; user-execution based

Timeline of Inno Setup fake-download installers

• 2022-11-09 The CharityEngine/BOINC branch drops wrapper_2022110901_windows_x86_64.exe; the embedded 2022110901 stamp is consistent with a 2022-11-09 build of the third-party wrapper component (source gives no first-observed date for the campaign).
• 2026-11-03 Microsoft lists Defender detections (OfferLoader.DA/DB!MTB, SuspInnoOffer.A!mapsi, OffLoader.A, Clover; behavior blocks SuspInnoOffer, SuspEtherRpcConn, SuspSmsScanConn), 15 campaign domains, 7 SHA-256 hashes and advanced hunting queries.
• 2026-11-03 WorldProxyPool persistence documented: SYSTEM scheduled tasks WorldProxyPoolAgent (startup), WorldProxyPoolWatchdog (5-minute hidden PowerShell) and WorldProxyPoolUpdater (hourly).
• 2026-11-03 Payload branches identified: WorldProxyPool proxyware (offer 1727/564), CharityEngine/BOINC with VirtualBox 7.2.8 (offer 1720/536) and AW Manager / Windows Manager adware-style utility.
• 2026-11-03 Four-stage chain documented: fake installer lure, Inno runners in locked-ioc-17 (/SL5 /SPAWNWND /FIRSTWND), offer callback (d=inno, r=offer_execution) and monetization payload installation.
• 2026-11-03 Microsoft Threat Intelligence publishes analysis of the fake-download campaign delivering monetization payloads via trojanized Inno Setup installers (source does not state first-observed dates).

Sources cited for Inno Setup fake-download installers

• Event 4698: A scheduled task was created Microsoft · Advisory
• Defender Vulnerability Management software inventory Microsoft · Advisory
• Configure cloud-delivered protection for Microsoft Defender Antivirus Microsoft · Advisory
• Protect security settings with tamper protection Microsoft · Advisory
• Attack surface reduction rules reference Microsoft · Advisory
• Microsoft Defender SmartScreen reputation-based protection Microsoft · Advisory
• Fake-download campaign uses trojanized installers to deliver monetization payloads Microsoft · Vendor report · 2026-11-03
• Microsoft Threat Intelligence Blog aka.ms · Vendor report
• MITRE ATT&CK framework MITRE · Research
• ProxyNation: The dark nexus between proxy apps and malware (related proxyware research) alienvault.com · Research

More in malware

• ClickFix Campaign via Microsoft Lookalike Domain (login.microsoftofice.cz) Targeting Czech Company with Unnamed PureBasic/Batch RAT
• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware