Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Extreme Injector v3.7.2 - by master131_[unknowncheats.me]_.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Extreme Injector v3.7.2 - by master131_[unknowncheats.me]_.rar
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Extreme Injector v3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Extreme Injector v3.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Extreme Injector v3.7.2 - by master131_[unknowncheats.me]_.rar
- Size 1.3MB
- Sample260702-e1hfssbx5x
- SHA256 86f5b99943eb87662af3ca9ec26163ab2bfeb7b892c8cc068b8eb9589035adbc
- MD5 7453b0b6c9ccaf7abd220f68c03c37ea
- SHA1 e622f382e9680bef59eea35bd0a7e37488bbd755
- SHA512 92233d4394700a54e8a4959ca1184d1f419e974d3c34faed3e5fe3b32a824019f92f360caef5cc7fd86fb52fd81807d00fdeebf296dda1308cb1a571fcfd96fd
- SSDEEP 24576:SlyPdkdUv/eid0GIEgGvZfxDBi5k83JwWu2g/ZZGNAEHrST1ITGJF8lULu:PPdkdyLvIEgGti5k83Jju2g/q5STOy8x
- TLSH T13155338A00E082DD322EDAB707EBE8B3E0D10CE759B35651916D1823D6D9A9C39E7CD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3440 Extreme Injector v3.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 7 raw.githubusercontent.com - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2752 7zFM.exe Token: 35 2752 7zFM.exe Token: SeSecurityPrivilege 2752 7zFM.exe Token: SeDebugPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: SeDebugPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 3440 Extreme Injector v3.exe Token: 33 3440 Extreme Injector v3.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2752 7zFM.exe 2752 7zFM.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3440 2752 7zFM.exe 88
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.7.2 - by master131_[unknowncheats.me]_.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\7zO0CAEE558\Extreme Injector v3.exe"C:\Users\Admin\AppData\Local\Temp\7zO0CAEE558\Extreme Injector v3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7zO0CAEE558\Extreme Injector v3.exe
- Size 1.9MB
- SHA256 0ac3387b6e0283c972722c2a6664ee23ac5ba10640d18b827e8732f5c57e7d2c
- MD5 c4394fb4daaf350cdbf5303d812e917e
- SHA1 6a780c9f1c15e555b72640299b9c10e7927252f6
- SHA512 585664a31ac2131efde439468f98c53423588348019edb3c767ffc9bb6a8a881959fd1f4a30d623a0e6a4cc02d180a146b37bef8679b55b111f46d2fb8fb82e1
- SSDEEP 49152:7oHuLeTSY8W7DDDDDDNc/9Lqd9gpaPk+hTM:7oHu29c/909gpa
- TLSH T19C957D897650B68EC857C932CAE51C28F761A47B571BD303A05366FCAE4DA9BCF140B3
- MD5 SHA1 SHA512 SSDEEP TLSH