a3c07c9152add0aed1ae97f33061c81539b0708b7069bce6b1304fbf4990bb34

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
433s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
instantgames.jar
Size 152KB
Sample260706-bbfdcscw9p
SHA256 a3c07c9152add0aed1ae97f33061c81539b0708b7069bce6b1304fbf4990bb34
MD5 2fb377fa7498c30b5834b889cd5ee817
SHA1 84c05ca53474053e52e6b96c8ed574eacf668219
SHA512 b431d163e2ca345265709bbb322f6b114d6407e7258cf5f7de0161688ada910916fcb9191db25e146b862898266492a8e3d422ad4df42eef9f143488545c6bd7
SSDEEP 3072:5/rWH7D6zrc5wykmoCvRiiA5dBMZOQP/jKBGFLNptbJCc:5/rCn6zg5w5xzB2PNpCc
TLSH
T1E3E3F1D49BE90D0AF475B93B9D2723423F01CAB41E23D7B7D381A25D6D2BB9238071A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6704 wrote to memory of 5580	6704	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\instantgames.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:6704
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\instantgames.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2520

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6204