451d61cb38307af9489c864b178c76228377732c9d0ce2fcccddd1e501efe3b3

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
378s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
s_arservicesoptional_slam.jar
Size 16KB
Sample260706-bbfdcscw9p
SHA256 451d61cb38307af9489c864b178c76228377732c9d0ce2fcccddd1e501efe3b3
MD5 64b85b44dbd880a839f4470806c752f4
SHA1 2c1091ccc2ff92190abedd92ed492ad70c4b68e0
SHA512 d891fcf417b20d4f8e39845c7a81936f74ed53b30edcb9e45cef9f5e1df0d351a6bd61ff03a278bd13fec05f231a9d682c8dca542c8cecf581c30189e3f9689f
SSDEEP 192:Ca/bkXBWFybC9apHi+vuTJvyeTXbymj9tFHSAmcoEgFdf:ZabnV9W1vyQ2mj9tpn6
TLSH
T19E7208D5BAE44E1BF429317FCE69A2627B22437206844FCB498463C435953F7270B0EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1732	1004	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_arservicesoptional_slam.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_arservicesoptional_slam.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4248

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4016