e27bb0067253e4c2c20d6bfd0410b0b3d8c1a342f3f69eb671ce29b48a661f4b

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
1799s
max time network
1103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
s_papayatorch_torchedlooper.jar
Size 52KB
Sample260706-bbfdcscw9p
SHA256 e27bb0067253e4c2c20d6bfd0410b0b3d8c1a342f3f69eb671ce29b48a661f4b
MD5 d4acd12c41956cdb5e3fcc7f2466f53d
SHA1 a996d23078093551586c9b204d20e070eb3cbec1
SHA512 2fa98d0a82e9db544fc506bff1ea00bf67f370a3e60be9ff798d8ef3379d532eb0a163a05b16057a85c67d06a81a380e23d2f191e8e2cc6c34c9cfc69013b9e8
SSDEEP 768:8RTQQwTHq0tyfQU3tPZOVhO06nZWEHVMbdZsVFDPFXlrI9ebCbCyWYn:ULwTTyoit2hsZ5VESO9eUyW
TLSH
T12E337BD1A2F08C0BF5B0B27FAC76A660372583740E019FEBC6C55388A9462E337571D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 6780	4072	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_papayatorch_torchedlooper.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\s_papayatorch_torchedlooper.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3856

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6984