Analysis
- user interaction
yes - max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 01:53
General
- Target JMJ_Tribute_1_0_0_211.exe
- Size 435KB
- Sample261011-ca22eacf66
- SHA256 9268c34f97718572079ec54c0bf5442efbf74f85c6a6f811e67626d5d795fd5a
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JMJ_Tribute_1_0_0_211.exe"C:\Users\Admin\AppData\Local\Temp\JMJ_Tribute_1_0_0_211.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RC7F5.tmp\JMJ_Tribute_1_0_0_211.tmp"C:\Users\Admin\AppData\Local\Temp\is-RC7F5.tmp\JMJ_Tribute_1_0_0_211.tmp" /SL5="$70062,184998,57856,C:\Users\Admin\AppData\Local\Temp\JMJ_Tribute_1_0_0_211.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ChantsMag1 Seq1
ChantsMag1 SeqBass
ChantsMag1 Sparkle1
ChantsMag1 Sparkle2
ChantsMag1 Sparkle3
EQNX1 Bass
EQNX1 FrenchHorn
EQNX1 Glissando
EQNX2 BirdFX1
EQNX2 BirdSwarmFX2
EQNX2 EchoNotes
EQNX2 H2OFX1
EQNX2 H2OFX2
EQNX2 UniLead
EQNX2 Vox
EQNX3 Seq1 114bpm
EQNX3 UniLead
EQNX4 Seq 114bpm
EQNX4 Seq2 114bpm
EQNX4 SeqRandom
EQNX5 ArpSeq Legato
EQNX5 ArpSeq1 163bpm
EQNX5 ArpSeq2 163bpm
EQNX5 Bass Sweep
EQNX5 Lead
EQNX5 Seq1 163bpm
EQNX5 Seq2 163bpm
EQNX5 Seq3 163bpm
EQNX6 MW TrillSeq
EQNX6 Seq2 163bpm
EQNX6 Seq2 Alt 163bpm
EQNX6 Seq3 163bpm
Minor Seq
PulseBeam
JMJ Tribute.json
ChantsMag1 Drums
ChantsMag1 Poly Pad
Equinoxe5 Drum 163bpm
Equinoxe5 Guiro
MiniPops Dark Snare
MiniPops7 Drums
Equinoxe1 StringBass
Equinoxe1 Strings
Equinoxe1 StringsLong
Equinoxe2 DarkBass
Equinoxe2 Lead
Equinoxe2 PhasePad
Equinoxe2 PhasePad2
Equinoxe5 Strings
PhaseDelay
gui.xml
jmj.jpg
JMJ_Tribute_1_0_0_211.tmp
memory/1696-5-0x00000000021F0000-0x00000000021F1000-memory.dmp
memory/1696-274-0x00000000021F0000-0x00000000021F1000-memory.dmp
memory/1696-273-0x0000000000400000-0x00000000004BE000-memory.dmp
memory/1696-275-0x0000000000400000-0x00000000004BE000-memory.dmp
memory/3236-0-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3236-272-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3236-276-0x0000000000400000-0x0000000000415000-memory.dmp