Analysis
- user interaction
yes - max time kernel
898s - max time network
470s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/08/2026, 12:31
General
- Target JumplistExtender_v0.4-B(1).exe
- Size 1.5MB
- Sample260802-pp7xesztas
- SHA256 23472f11993bddebcb8b1f23e3ee3afba33a8881ba4f8df3984a2028299623a9
- MD5 3da1af4cb0f8adc92631d169488c44d4
- SHA1 7ade8d734198ee322831a18748dc90cfb89be294
- SHA512 335def7bf6afa0ba56e811598a98d927150a0fa663aa4a32bd2729f0757ebfc8d61d2c07e959ba4221610a6d45c5d7287fedc8d7a1f4658db544a41c654f9295
- SSDEEP 24576:RxG3Jii10VWiyJIL30o5sKPSdBIMiHnEp4FpXWBWn6jdVuh6YOiT:q5v1IUOrhdanppMpPnx9OK
- TLSH T1E375AEBBE29325F1D8228A3654F64BA49CB76D6D20F830142CB9F76C50761675C33A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2736 JumplistExtender_v0.4-B(1).tmp - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\eventvwr.msc mmc.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JumplistExtender_v0.4-B(1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JumplistExtender_v0.4-B(1).tmp - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000046F000-memory.dmp innosetup behavioral1/memory/2940-10-0x0000000000400000-0x000000000046F000-memory.dmp innosetup - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 mmc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: SeSecurityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe Token: 33 2460 mmc.exe Token: SeIncBasePriorityPrivilege 2460 mmc.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe 2460 mmc.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2736 2940 JumplistExtender_v0.4-B(1).exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\JumplistExtender_v0.4-B(1).exe"C:\Users\Admin\AppData\Local\Temp\JumplistExtender_v0.4-B(1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\is-7HBDJ.tmp\JumplistExtender_v0.4-B(1).tmp"C:\Users\Admin\AppData\Local\Temp\is-7HBDJ.tmp\JumplistExtender_v0.4-B(1).tmp" /SL5="$9004E,1163768,410112,C:\Users\Admin\AppData\Local\Temp\JumplistExtender_v0.4-B(1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\eventvwr.msc"1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-7HBDJ.tmp\JumplistExtender_v0.4-B(1).tmp
- Size 1.4MB
- SHA256 c7a4ab8282b10b8a7c887baf3ff5b43b9bc5cf62a4558fc761bb8b4c905dec38
- MD5 c4d370c1dd0ecd031fb6950e1f00a5d1
- SHA1 0f485394d0f3ed27bb0efbab8f8ffa488df53591
- SHA512 daf7967467186bf62c8eb443c4cef02cb9b56a9c9e8280611ddad19f9c8e0736fc2d9296ab7f662baaa93896789407c4fe400a7e368c185a712609bc32fc7e6f
- SSDEEP 24576:QEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsytt7x9Ry:NdmbjTKlD00tz+
- TLSH T18E653A76E39354B3D4331F355CB7879458377D282AB8A04A3EF8AF0C19796526C3268B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpA910.tmp
- Size 21KB
- SHA256 34cfeeb7abe46577f268766cbf1d80de277215d4cc25735a480814fa1cf6a231
- MD5 f5862e51f0f1e4b7cdcf94a9e8e62a9b
- SHA1 6e043f4edfbec69b215a0ade3976cd2c608960c0
- SHA512 e95714b0e9f4d8f61cf6729918b8d8b393439beae2c14f0898fb279a1b666dd1f689795a17681c41e2328a141842e02fdb8daae716e0a03efa93e16bbbbc0411
- SSDEEP 192:qe4vcAMGfaa48a/a2gva2D84g0BPYakQ/oSyKFAM:B4vf7pJaa7zN
- TLSH T10DA28B15A0C0F614D8765062E7523AB6EED1013BAB8B89B0391F6E5FBF34CA5036779C
- MD5 SHA1 SHA512 SSDEEP TLSH