Analysis
- max time kernel
148s - max time network
191s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
Legend of Zelda, The - Twilight Princess (USA).7z
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Legend of Zelda, The - Twilight Princess (USA).7z
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Legend of Zelda, The - Twilight Princess (USA).rvz
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Legend of Zelda, The - Twilight Princess (USA).rvz
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Vimm's Lair.txt
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Vimm's Lair.txt
Resource
win11ltsc2024-20260710-en
0 signatures
150 seconds
General
- Target Legend of Zelda, The - Twilight Princess (USA).7z
- Size 678.3MB
- Sample260718-dr1ekshz7z
- SHA256 f9f76b0ddf6f4535e8e2b4818f4337c3712378518ae1be2160f0208d5621e6c5
- MD5 c227d0a0109b8bf4be49d194493d0906
- SHA1 80e9fa0f7e2c00b474b27a437595a21fd94bbca2
- SHA512 9e2bd86dc5227a214a6be385642b511a6e8a7ab87c6c4caaae7cdeaa9df91229c8c1948a6ae19663ebf2f1a018beaa52a702709f7e41ecebc3b285c8b311f9b4
- SSDEEP 12582912:jqngAcKfjgL8FJtqH6GoJDVXAVUMknr9d5fWTWAovHU82MP+AMVbW4pGWBHU7:UOkgLIDY6Goz2UMknr9Lf0ah2M2AMVyv
- TLSH T14F79331FCC0D283630867C426DB6CDE7FDBBBF5B6EDA0850A1D643DB25251DA384192A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2464 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2464 7zFM.exe Token: 35 2464 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2464 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Legend of Zelda, The - Twilight Princess (USA).7z"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2464