e9722d5dd36866714f05a8ed41da8289a9ab7a4c8ffdc6d90db947d0b45d6abb

Resubmissions

06/07/2026, 01:26

06/07/2026, 01:13

06/07/2026, 00:57

max time kernel
899s
max time network
388s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 00:57

Target
heliumiab.jar
Size 138.9MB
Sample260706-bbfdcscw9p
SHA256 e9722d5dd36866714f05a8ed41da8289a9ab7a4c8ffdc6d90db947d0b45d6abb
MD5 5a47c51e4b40d95064287b61d1f6e7e1
SHA1 cf6ec113179b823a3083a16d023a52dbfdf8ba14
SHA512 1a1b95190a2518d091ed94bc52b0ae90fdf97d97136a82f379e00b0c9f0cc51d75b8b70ea710b894bf5ad3f5598345fc08e8dbedc04f946434d8d60b7e80f766
SSDEEP 1572864:5o9A0trzaCa2GlfwMfc7snVVpttvUORe/fo:qtHaCa2GlfwMfcspjD
TLSH
T129687D00690D6423FBCBF4BD9F4107D5300B3DAD85B4D2D73567921EC781A9A93ABAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4088	4072	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c mkdir "%TEMP%\ext" & "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\heliumiab.jar -o"%TEMP%\ext" -y & for /r "%TEMP%\ext" %f in (*.exe *.bat *.vbs *.cmd *.ps1 *.doc *.docx *.xls *.xlsx *.pdf *.jpg *.png) do start "" "%f"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" x C:\Users\Admin\AppData\Local\Temp\heliumiab.jar -o"C:\Users\Admin\AppData\Local\Temp\ext" -y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4088