Analysis
- max time kernel
299s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 14:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
A π in the Right Hand, a Sword in the Left Hand.rar
Resource
win10v2004-20260513-en
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
A π in the Right Hand, a Sword in the Left Hand.rar
Resource
win11ltsc2024-20260709-en
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
A π in the Right Hand, a Sword in the Left Hand/Game.exe
Resource
win10v2004-20260513-en
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
A π in the Right Hand, a Sword in the Left Hand/Game.exe
Resource
win11ltsc2024-20260709-en
0 signatures
300 seconds
General
- Target A π in the Right Hand, a Sword in the Left Hand.rar
- Size 53.3MB
- Sample260803-sa6ycstvbv
- SHA256 58bef0a08852611918d4b66d9265619e5303f5cafebf7b50e5234b4a224d67a9
- MD5 87e6ce8dc8b5fabf026855dc74d69849
- SHA1 ce1986d589788e8c9dcb0531084a69073f1e5633
- SHA512 6e1d9373f88dd56044866ee6cf558170d4d3936e6ed356968bbc7c8b97c04582d8b9c69e04e60f6f128a149c4464eecaee373978a5b170b812d2101932a1529c
- SSDEEP 1572864:1MNcKnrKN5fGOQHfJj3R9KqQqh0WXK1oqc:14ZrKNwpHfJNIxi0p1y
- TLSH T15AC73331B5CD5716D02F2F7687CAC2743739AC0E2B3146DF768012A5E8E49F6DA412AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2916 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2916 7zFM.exe Token: 35 2916 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\A π in the Right Hand, a Sword in the Left Hand.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2916