982c2d5acfb51306f4ab2f79f31be4282aa411e8fd5dc85ff9bf0e14937154ba

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
898s
max time network
393s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:57

Target
papaya.jar
Size 76KB
Sample260706-bbfdcscw9p
SHA256 982c2d5acfb51306f4ab2f79f31be4282aa411e8fd5dc85ff9bf0e14937154ba
MD5 8ec9eb42adc6c75de2b35cf92fff7d22
SHA1 991494653598efb8812c43b8ebf82455052efd45
SHA512 df50aee73f74dd6523952b938612242bb04e090136c6901290fc6af763587ffc60b28a191ec039d0e570197658f0d335f6b64386e8f96ee260efcc9fc4611f6f
SSDEEP 1536:Vnw0tRx2665IZF/PxBqnFYsTPyJSJLWPxoo:u0nZF/keO0SdWPh
TLSH
T13773BFC2A2F04C4BF974B27FDD66A661776487364A429FE3C29013ECA944AF327070D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 3200	5536	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\papaya.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\papaya.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3200