c2b1c2cfbdf9fbc21195b9942cab7463fe46a00a3f8a69e04a173556a2e6980d

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
898s
max time network
391s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:57

Target
executorch.jar
Size 1.4MB
Sample260706-bbfdcscw9p
SHA256 c2b1c2cfbdf9fbc21195b9942cab7463fe46a00a3f8a69e04a173556a2e6980d
MD5 3d63e47373a4e7864d202c2add5f269d
SHA1 ec94f31462bd0277d1c369df777289051da03aa4
SHA512 230b27e879c53cb86e7b50f2d66dce434d312807b464e9ca82267014549fb0bb50dce807266a60445a84e3517cb0978e58c9fc147d1eb0a181f9982ecb45412b
SSDEEP 24576:RpRZCy3mYdh/R7pwadN4/Y92vagyz2F8rKIzCNmjvEPurbLFx11QYves+BfkMFtG:RnZFdh5Nw3YX2F8+I2gEmn5xAnWstG
TLSH
T1BF6533D7EFD08E44F45A187E84D39AA03726D1B34A7683FBB71C01187C89166BE096ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3992	1948	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\executorch.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\executorch.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3992