Analysis
- user interaction
yes - max time kernel
60s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Extreme Injector v3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
60 seconds
Behavioral task
behavioral2
Sample
Extreme Injector v3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
60 seconds
General
- Target Extreme Injector v3.exe
- Size 1.9MB
- Sample260812-e4pz2syele
- SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
- MD5 ec801a7d4b72a288ec6c207bb9ff0131
- SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
- SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
- SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
- TLSH T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: SeDebugPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: 33 944 Extreme Injector v3.exe Token: SeIncBasePriorityPrivilege 944 Extreme Injector v3.exe Token: SeDebugPrivilege 240 taskmgr.exe Token: SeSystemProfilePrivilege 240 taskmgr.exe Token: SeCreateGlobalPrivilege 240 taskmgr.exe Token: 33 944 Extreme Injector v3.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe - Suspicious use of SendNotifyMessage 34 IoCs
pid Process 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe 240 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 240 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5736