# Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)

> Microsoft Threat Intelligence reports a fake-download campaign targeting users seeking cracked software, games, activators and utilities. Trojanized Inno Setup installers deliver multiple monetization payloads in one session (proxyware agent, distributed computing client, adware-style utility), turning compromised devices into monetized assets.

- **Published:** 2026-11-03T18:51:56Z
- **Last reviewed:** 2026-11-03T18:51:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5169
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5169.png
- **ID:** TL-2026-5169
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Microsoft Threat Intelligence (blog dated 2026-11-03) describes a fake-download campaign in which users looking for cracked commercial software, free games, activators, plugins, executors or unofficial utilities run trojanized installers built with Inno Setup. Observed lure names include Echo Client, FabFilter Total Bundle, Navicat Premium crack, Cue Club, auto-clicker, Deadpool Apunka Games, Command & Conquer: Red Alert 2, TFT Unlock Tool and clownfishvoicechanger.

The chain has four stages: (1) the user executes the fake installer from a download; (2) the Inno wrapper spawns temporary runners from %TEMP%\is-*.tmp\ (observed with the Inno arguments /SL5, /SPAWNWND and /FIRSTWND) with staged executables (eld0-eld5 as eld*.exe, set_*.exe, FirstFast[1].exe, SecondRunner[1].exe); (3) the runners call back to rotating infrastructure with an HTTP request containing d=inno and r=offer_execution (r=offer_execution_fail with an msg error text on failure) and receive offer-controlled payloads; (4) one or more monetization payloads are installed, often with silent switches such as /qn, /S, /quiet and /norestart. The callback carries parameters such as sis (session correlation), a (affiliate/campaign identifier), o (offer id), dn (download/offer network), spot (offer slot/placement), fz (package size), t, paw, ko and cr. Observed o/dn pairs include 1712/507 (primary first-stage offer), 1720/536 (CharityEngine/BOINC branch), 1727/564 (WorldProxyPool branch), 1729/566, 331/244, 1674/440, 1675/441, 1681/447 and 1730/567.

WorldProxyPool is a proxyware agent that routes third-party internet traffic through the victim device. It installs to C:\Program Files\WorldProxyPool\ (sdk-agent.exe, sdk-agent.updater.exe, watchdog.ps1) and creates three SYSTEM/highest-privilege scheduled tasks: WorldProxyPoolAgent (runs sdk-agent.exe at startup), WorldProxyPoolWatchdog (hidden non-interactive PowerShell every 5 minutes) and WorldProxyPoolUpdater (sdk-agent.updater.exe update, hourly). The CharityEngine/BOINC branch enrolls the device in a distributed-computing platform (ce-installer_7.14.2_vbox-7.2.8.exe, wrapper_2022110901_windows_x86_64.exe, boinc.exe, charityengine.exe, ce11.exe, boinctray.exe, boinc.scr, boincscr.exe) and installs BOINC under C:\Program Files\BOINC\ and C:\ProgramData\BOINC\, together with a VirtualBox 7.2.8 MSI (VirtualBox-7.2.8-r173730.msi). The AW Manager / Windows Manager branch silently installs an adware-style utility (AdvancedWindowsManager.exe, Windows Updater.exe, Windows Manager - Postback Johan.msi) under %APPDATA%\AW Manager\Windows Manager 1.0.0\ and C:\Program Files (x86)\AW Manager\Windows Manager\.

No threat actor, CVE or CVSS is attributed in the source. Impact is resource hijacking and unconsented software installation rather than data theft or ransomware; the proxyware component does expose victim IP addresses to third-party traffic. Microsoft Defender detections include Trojan:Win64/OfferLoader.DA!MTB, Trojan:Win64/OfferLoader.DB!MTB, Behavior:Win32/SuspInnoOffer.A!mapsi, Trojan:Win32/OffLoader.A and Adware:Win32/Clover, plus endpoint behavior blocks SuspInnoOffer, SuspEtherRpcConn and SuspSmsScanConn. Note: the source did not state first-observed dates or victim counts.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1036 Masquerading
- T1564.003 Hidden Window
- T1071.001 Web Protocols
- T1090 Proxy
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized Inno Setup Offer Runner (eld*.exe / set_*.exe / FirstFast[1].exe / SecondRunner[1].exe) Executed from is-*.tmp** (`TL-2026-5169-SPL-001`)

TL-2026-5169: detects the Inno Setup wrapper spawning staged offer-loader runners (eld0-eld5 as eld*.exe, set_*.exe, FirstFast[1].exe, SecondRunner[1].exe) from %TEMP%\is-*.tmp\, the stage-2 behaviour of the fake-download (cracked software lure) campaign that delivers WorldProxyPool, CharityEngine/BOINC and AW Manager payloads. Flags the Inno switches /SL5, /SPAWNWND and /FIRSTWND when present.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h Image IN ("*\\is-*.tmp\\eld*.exe", "*\\is-*.tmp\\set_*.exe", "*\\is-*.tmp\\FirstFast[1].exe", "*\\is-*.tmp\\SecondRunner[1].exe")
| eval inno_switch=if(match(CommandLine,"(?i) /(SL5|SPAWNWND|FIRSTWND)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parent_image values(CommandLine) as command_line values(Hashes) as hashes values(inno_switch) as inno_switch by host, User, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath matches regex @"(?i)\\is-[^\\]+\.tmp\\(eld[0-5]|set_[^\\]+|FirstFast\[1\]|SecondRunner\[1\])\.exe$"
| extend InnoSwitch = ProcessCommandLine matches regex @"(?i)\s/(SL5|SPAWNWND|FIRSTWND)"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InnoSwitch, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Trojanized Inno Setup Offer Runner Executed from is-*.tmp (TL-2026-5169)
id: 3f1c7a52-8b1d-4e0a-9a67-5c2d1e8b4a01
status: experimental
description: Detects staged offer-loader runners eld*.exe, set_*.exe, FirstFast[1].exe and SecondRunner[1].exe launched from the Inno Setup temporary directory used by the fake-download monetization campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|re: '(?i)\\is-[^\\]+\.tmp\\(eld[0-5]|set_[^\\]+|FirstFast\[1\]|SecondRunner\[1\])\.exe$'
  condition: selection
falsepositives:
  - Legitimate Inno Setup installers that ship helper executables named set_*.exe from their temp directory
level: medium
```

**Known false positives:**

- Legitimate Inno Setup installers that stage a helper named set_*.exe in is-*.tmp
- Software packagers testing Inno-built installers in a lab

**Tuning notes:** Baseline set_*.exe by signer or hash for approved installers and exclude them; raise priority when the inno_switch field is yes or the parent is a user-writable download path; correlate with the d=inno offer callback detection (TL-2026-5169-SIG-003).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Silent Monetization Payload Installs Spawned by Inno Offer Runners (CharityEngine, VirtualBox 7.2.8, AW Manager, WorldProxyPool) (locked: unlock with TL Creds)
- Hidden Non-Interactive PowerShell WorldProxyPool Watchdog Execution (locked: unlock with TL Creds)
- WorldProxyPool Agent or Inno Runner Outbound Network Activity (Proxyware Relay / Offer Callback) (locked: unlock with TL Creds)
- Known Campaign SHA-256 Hashes for Inno Offer Loaders and Runners (locked: unlock with TL Creds)
- Monetization Payload Files Dropped (WorldProxyPool, CharityEngine/BOINC, AW Manager) (locked: unlock with TL Creds)
- Inno Offer Execution Callback Query String (d=inno & r=offer_execution) (locked: unlock with TL Creds)
- WorldProxyPool SYSTEM Scheduled Tasks Created (Agent, Watchdog, Updater) (locked: unlock with TL Creds)
- Campaign Offer-Callback Domain Resolution or Request (.xyz / .cfd Rotating Infrastructure) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `beliefdesk[.]xyz`
- File hash: `006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c`
- Domain: `companyharbor[.]xyz`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake-download campaign uses trojanized installers to deliver monetization payloads](https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/)
- [Microsoft Threat Intelligence Blog](https://aka.ms/threatintelblog)
- [Event 4698: A scheduled task was created](https://learn.microsoft.com/windows/security/threat-protection/auditing/event-4698)
- [Defender Vulnerability Management software inventory](https://learn.microsoft.com/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory)
- [Configure cloud-delivered protection for Microsoft Defender Antivirus](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus#turn-on-cloud-delivered-protection)
- [Protect security settings with tamper protection](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)
- [Attack surface reduction rules reference](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference)
- [Microsoft Defender SmartScreen reputation-based protection](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
- [MITRE ATT&CK framework](https://attack.mitre.org/)
- [ProxyNation: The dark nexus between proxy apps and malware (related proxyware research)](https://alienvault.com/blogs/labs-research/proxynation-the-dark-nexus-between-proxy-apps-and-malware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5169