180172704d483145f26a6123db91adb6f3a5aa03d75b5436ad370685c64d0845

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
900s
max time network
840s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:57

Target
instantgamesads.jar
Size 1.0MB
Sample260706-bbfdcscw9p
SHA256 180172704d483145f26a6123db91adb6f3a5aa03d75b5436ad370685c64d0845
MD5 f002b20aaf464457baaf769c266ecc8b
SHA1 e9da5e27359e3102c9e06aaee148c06478ae671e
SHA512 277f8752f1b10120343c3d37533af9cef911a50977449e9057e45946f463d8357910be3feaaf5973818c3dc488034bd8402ee557b0c7503240585045cc241c3c
SSDEEP 24576:Z2xgQyWN+QDmzsQ0AdmWgZ5XcHV3g36hKJ5vjpNCkhFwa:ZcnpN+QigzAd/A213rwJ5vjjCAwa
TLSH
T14F2523E427541D04FB3D713E8102C348FB61E4419E33CB7B8B44B1ED2D69AA5BFA529A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1276	4608	cmd.exe	92

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\instantgamesads.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\instantgamesads.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1276