88b45cbebb8b02bab60e52a05756b28c6c28966b5ccdbb3b02dcd735d9cbbb74

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
390s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
pytorch.jar
Size 1.6MB
Sample260706-bbfdcscw9p
SHA256 88b45cbebb8b02bab60e52a05756b28c6c28966b5ccdbb3b02dcd735d9cbbb74
MD5 6a31b5533115b816a44831d42160f9cf
SHA1 0db84c6fb4958d82474c8caf3de4af77a0b5ed61
SHA512 4ebdbe8e53c2ced6f8ffbf5ee38da12d1cb2cab0843bb8ab7bef8957c4472151de0043634c06d8f806c4a9ebd78f887a616617a7eef10d6cf188a01cf35be6f3
SSDEEP 49152:7pvi9jhz3JW7MHnpWvGM8g44yj+/NI119SQ7bc:7Q9jhDJZHoFyC/wSGc
TLSH
T1488533E4E7EACE6EF0BAB1B59453FD862A28CE709237C7B34A80381D6F75105708614D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 5812	2280	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\pytorch.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\pytorch.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2028

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2820