4d5678f090b3a0a886d7560e31588f52fa62c7d7381046a1051b3fb299c91159

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
844s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 00:57

Target
arservicesoptional.jar
Size 584KB
Sample260706-bbfdcscw9p
SHA256 4d5678f090b3a0a886d7560e31588f52fa62c7d7381046a1051b3fb299c91159
MD5 da47e8b84f99e4e277856fa7526097ed
SHA1 59c99e3d1cac5f17507bc46ba7fb497c03d42466
SHA512 ae433f6c509681d08eaabd99e5ff2ff7139bfc6360eec4588dc37e1d2ae84df42eb9208635588287562ec4ca283c49ce476278dfa1ccdb28a2c5ea1da083572e
SSDEEP 12288:zYzYJY8P844qIoXqCPAFPYPPijYxyYXBO1vGC9zlHaxO:OYUiXqWAFPYPPNyYRO1dl6xO
TLSH
T174D422C8D2E20D29F87832BF1E6747217B21C2B11D23DBB78695436CAD2A3D079475D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 6372	4184	cmd.exe	89

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\arservicesoptional.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\arservicesoptional.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3476

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1836