7c0a8bb69eb7c412291aa861a6871733faed43c8b8f22a41565ba372937bfd09

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
415s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
s_papayaanalyticstorch_papayatorch.jar
Size 36KB
Sample260706-bbfdcscw9p
SHA256 7c0a8bb69eb7c412291aa861a6871733faed43c8b8f22a41565ba372937bfd09
MD5 596410094dc49b13ff324f6db4ea2c6a
SHA1 da5b680e14ca9386e9fe36decb6043c575afffbb
SHA512 80f93e54da10082ed8251da87f7514e08dbaf1ebfab74cbc4c30406e460354498b17f0bb72e88b84259710953c1d2222718ccc0621d8cb732653272b4dd92f52
SSDEEP 768:hKRmiW/3vcqK4nsK8vrTQqBWCqpzH2FC6neB/ax1ZDmGo:h+miW9K4nwTTZBWAFCYeB/aMGo
TLSH
T184F2E5C47AF05C0BF1B6727FADA6E22137A283740E124FDB86C517D868452F727161EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 6076	4444	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_papayaanalyticstorch_papayatorch.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_papayaanalyticstorch_papayatorch.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6072

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2548