128cf2dccd6315bf8bee390750fc64382d3e7b67451e49549287119a922fdf29

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
405s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
maplibre.jar
Size 1020KB
Sample260706-bbfdcscw9p
SHA256 128cf2dccd6315bf8bee390750fc64382d3e7b67451e49549287119a922fdf29
MD5 956cf29ceb99fed44f369aad421ba3b4
SHA1 474b8eecff46b25eabba0c585788b228b6a40e3b
SHA512 72e9a7d3da9344d9fe8ff4dd49e7126810943a9929bafc6aedf449609e87f1f41bbc1448988503738ad68b9f70bcd88e058222610f671dd02083f4a5f94cffa1
SSDEEP 24576:BBwukSHz7ygiPKTmBGjfj2y7ByqXccfMaMeW6wfIiZ:8upfviPQ9HtPXcckwWUe
TLSH
T1152522C9A7F90C49FAA076760D6767906F71C27D27A3C3B387E45A6C2D071F0B206299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 6104	1696	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\maplibre.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\maplibre.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5392

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:352