Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/03/2024, 22:35

General

  • Target

    five-nights-at-freddy-s-2-multiplayer.exe

  • Size

    304.0MB

  • MD5

    d4139b6b15bd378ce7b0c7d0649616e1

  • SHA1

    f21534750351411c4f157aee2628d3197cda77a9

  • SHA256

    71e276cbf3b9cbfe9ced9d65cf1fddf28b00719fce9f0812332044fbcb5190ad

  • SHA512

    27f76fbb4d5e96f36552c5a74e47e34bbd5e46ff3f35c6dfc2cb00e8f725d6da757e7d719f4da61a27d96d8e73c160ea8e1f88db52b5f7c4ea8ef9c2189c8dff

  • SSDEEP

    6291456:IDOuivTf6+CP4exRYUNR0gtc3bBRpI6kBbu:IDOuivTf6+CP4SDc3bLpI6kRu

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\five-nights-at-freddy-s-2-multiplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\five-nights-at-freddy-s-2-multiplayer.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2292
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.5.1200088394\1488728644" -childID 4 -isForBrowser -prefsHandle 4452 -prefMapHandle 4616 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79f068d3-64f9-4df6-9376-7d20a1e4713a} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4684 1d0e07faf58 tab
    1⤵
      PID:3032
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.6.2058615413\499215227" -childID 5 -isForBrowser -prefsHandle 4820 -prefMapHandle 4824 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0079a1f6-472f-4f63-b7d9-a3fed6a70918} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4808 1d0e19ce458 tab
      1⤵
        PID:1036
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.7.412699581\1546406577" -childID 6 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4d56e13-020f-4471-ac10-dc9fcc70c4cd} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4992 1d0e19cfc58 tab
        1⤵
          PID:1292
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x3c8
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1512
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.8.860356206\30326531" -childID 7 -isForBrowser -prefsHandle 2600 -prefMapHandle 2604 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e76aeeb-22c0-4e3e-aa71-1a3b25e976d2} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 2492 1d0de09c858 tab
          1⤵
            PID:4424
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:2376

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\MMFApplications\fnaf2m

              Filesize

              12B

              MD5

              fc3c1444645529fb8750de21e882f428

              SHA1

              4b826c157e1d7e60e883d33ace1ad148f346f48f

              SHA256

              bb293578bc77d24dea6ee52624ac7628d24607773faa681df12fe634692a3a44

              SHA512

              a03e063a3767a96cee24609ee632bc23b5e61119c9b539aaff21dcd001c37c928cc1132f81b35221f25bc06b5a36d34b230b5f33cab4501da017b1a6846fbaff

            • C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

              Filesize

              190KB

              MD5

              a59ce74fc8cbf165fd68bc3900844637

              SHA1

              e1a3188df779356c5fc4cb4222f125a1312108ac

              SHA256

              0d3b16bcbf0368a6b33d782007aa124d3af1fe1969a40ba7c2d15c74560b3d90

              SHA512

              a08154c9d12b59bae5e4b962257d8fb91009f396b269c70294a44a8eba2a5d1b88403d522cc1247d01149b066739e306db929d0b5fec1e24a83379c084a27808

            • C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

              Filesize

              169KB

              MD5

              80f0fd556eec13434bdabe896e8d484d

              SHA1

              bd21b85591a0300028fedd089f0d027891ca4dd6

              SHA256

              326506e0818c20bbfab6accf0a2cffb1fa8ec931cae7b9740b55c417d85dd73b

              SHA512

              b02e1e814c37b35604f5af9c12c687533991a8b26ea9f86f4b507e7db67f8754ca2752876f584aed4c8222021b8789aa4c4840aa1596cda8b7e838401ca54da0

            • C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

              Filesize

              198KB

              MD5

              d05b910622dc181bfcd148d74dcfe5da

              SHA1

              117ae86272401427e93e0175d675da805e2f6826

              SHA256

              b321162fcb0363c6c52e5c07b276d1c9600e3e0bb7be181436c5695faf015fc3

              SHA512

              7518099328610a57d7942cea73c767c00f7d5a273a898f5676e3ccc1b1cfe50729f929bc04ccc48e040b2cb5ccc7678fb827e62457d7e8cc7bcdcab53e162511

            • C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

              Filesize

              122KB

              MD5

              1a0c305a025feed8f11fe4be6653e82b

              SHA1

              6821aad18b33eca86e6e4e50962df22d61db0d84

              SHA256

              b899f9c9663d8bd31d02bcae7c7e99e4188c54b1ebd7befb57ff8cef9a504e3c

              SHA512

              0ac2e97b7d51e9151b4ec9a2ff82103b1d71d0165ac13d2ba35a420d82304eb4e645ee09aced533d91b81c815df5ecbc74e4491050623f419a2205b449198f88

            • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

              Filesize

              129KB

              MD5

              f9ae474b1872c3a0f9b80f7e94b25590

              SHA1

              07260d14c7f78990a9070acb83a8549b42e43372

              SHA256

              e643031cf0e0baebf12ed248b289e272c2e542ca5f6a8e94a8b09e46b8e3d7ce

              SHA512

              2fbe6eb30b5bd7afd58dabbeaf138dcee4976327b291bbc43c81afb683b9431994eda6dd10f5e0de3e65ef71fadd352cacfd712fa43f72421afff2e6e52a95f5

            • C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log

              Filesize

              123KB

              MD5

              df91e0e91ff449cc20a08600ddc59a23

              SHA1

              d8799b97f8a51bb928ba58ae8cf86989e6ae554a

              SHA256

              a75c44a64f49610c539f06377979d2d414e5627d700adcc359caea09b6201d11

              SHA512

              91031549055b100d59edef68c90045c81365b6e4932c897a3d4658f70080808b0434ebbf15324b14f505d493e61500724dd92e66e58c462e610c02ec230f1a67

            • C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log

              Filesize

              134KB

              MD5

              8d3df9401fa959498a206abb077e86f6

              SHA1

              0f905a27a7db57b4091f5cfd446fb4f62fce6adc

              SHA256

              0bdf3860cc31e18dc0701f952f238c21cce13a180128c32eedb45afbc2a76600

              SHA512

              45ca41e4216ac46ce57d682fdeae2fa7a14ad4da3491834b6eeb6adef790f19e53860dac59d11765dd6dd021a0abdb73f984424174d471246f34c5f4176233b5

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\DRPC.mfx

              Filesize

              861KB

              MD5

              66726fdf933ad94bf73ab40430abadd0

              SHA1

              77bfe6fd11acb69d9735af1fd291c496773e1249

              SHA256

              163f8e16167f79bf88a4175af056d31256775b6c68f33e00528f26585e4d0354

              SHA512

              83f6b4d61a5366bd6cf6b99f55a8d0681b413271fdfa8e9164b73032a9c972c7a1a1b2ecc2ded30c7a352a2895e1780facefc66f1436abd62d148a30300ce4f6

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\Get.mfx

              Filesize

              305KB

              MD5

              0836ffc32147508400f557286e7574e5

              SHA1

              402d0c938eb8982611496f388737595616516040

              SHA256

              b339ba20b3341cf3da19301eada3370f59e193513a06c90f401f19aec774e757

              SHA512

              4b31fdae9e1c37812cbe365ca3bbe28949cd9b34df1478b9c7834021cde9361d5fbbdfd7fa53177a13d34b2305ae31611afcc7a3a3025720e5ba805b28b36e4d

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\KcButton.mfx

              Filesize

              40KB

              MD5

              619af4af177ae18c098c504af34daa46

              SHA1

              9f12e2ac12aa78148d1aba4856999dd47d687562

              SHA256

              7ad7ca933a51bcd7458cd281bb9e7e30badb85c919d25572407e5afb22750f5e

              SHA512

              112914c83fb2fce858a38f96396fd8dd5a0d49797c7b847641d5ac21a254511059fd668943f1963b2ec2812c98fb0f9aca631407d9b80d9a7265ebcfa2cb6f5f

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\Lacewing.mfx

              Filesize

              215KB

              MD5

              8a8767b9d44ff18cc9a2986cc1efcd5c

              SHA1

              1ab46ea5c4eb66c059113b715fda146b75c0de23

              SHA256

              50fe75b79197c5cff2d7f256ffff8d9f9d58e66c90f9fd00fd7aa4688c7d2e5a

              SHA512

              dfbc478d9504ab6cd375e1a987223afe993777417756d9901a46dffd31ee006ffd768f1fdc8279722a94e24344bbe5f2fd8b2b9bde9f92f73bddf880aa654857

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\Perspective.mfx

              Filesize

              15KB

              MD5

              9f064bdcb066daa428db0ed9e33e785d

              SHA1

              3c0df73cf247ce49d1010fe0e2f722424fe43f4f

              SHA256

              090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777

              SHA512

              4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\ctrlx.mfx

              Filesize

              44KB

              MD5

              ceb8b2e522d0aaaecdf69b3bcc89a530

              SHA1

              c1cf769a96a9612f7fd0c1965413f4a57e4907e1

              SHA256

              3407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65

              SHA512

              3c46743c635eb96351e6a82490cececb24e6a104433c962f263ec01cf78fa9747d4f56d05c3085c0a18eff7c180b145df5e8e74bc008fe2f617f7f4c24be0331

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\kcclock.mfx

              Filesize

              108KB

              MD5

              3aa5cbe7b31e550511ce011457c44790

              SHA1

              93c22c4f9ddb40d72865ec5dc169cef3feb3e337

              SHA256

              58588b5e12d0c5629ee481ad7ed9e8b4d6798cfa83004aecaa600a6924bc97e6

              SHA512

              c29a54368badaae841eb27dfb3a9ca74571828618888021c45949d1d999242e07bf240b08f602dfacded4c82e12fb6a13f501a09efe68fd5a310541099fa4a42

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\kcedit.mfx

              Filesize

              32KB

              MD5

              a00acf3af0958898345fca9893cb6f57

              SHA1

              561717e33e2877fd0db99411265186ca468041bd

              SHA256

              b38ad01ad8a22f3f553530b000d6d061356601d308e6a79284605c30cb0674ad

              SHA512

              9435f612a23864ac7e4d22cff927b4155463fdddd8d143b805d7233dd372e9a5975c9a4170de9bcfc3adce4ab9fffdab2937f053e48743d2791753d2dc727850

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\kcini.mfx

              Filesize

              330KB

              MD5

              a6ad14845999c5aa7adf2911671a7c5b

              SHA1

              98dfd5a9584d1c1b330c2c104c1779bd55ded211

              SHA256

              5af175ffb932fb653873dad095dd40f2ab8d3fb56f287213c21bb68652ddad2d

              SHA512

              32bb59826b82d47ec420ac2532e1387a85422d2f0ce5370ad2c95b914a7615d3b122dbf4dd045105eb8ffea49324dac57659f0e5f2500b4d0eb75047cb36dfd8

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\kclist.mfx

              Filesize

              32KB

              MD5

              10a8ccacb046c0dc05adfc6964e99e95

              SHA1

              48acabc563a9c6d48eae3eda5254306127c00528

              SHA256

              57d8f859ecf57eed8f2fdc3271ec1d57c879899a527d77a80c9f45b1377742f5

              SHA512

              e972e0a6d4aa5c0cab99283c27038eb31f0adf2f581b4be9b58768d25a81f71e2aa5482500e4cb16bbc60d41f84ef926cd61a9cbe9fce1fce4adca564a6b147a

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\mmf2d3d9.dll

              Filesize

              1.5MB

              MD5

              c85bcc9f3049b57aa8ccbb290342ff14

              SHA1

              38f5b81a540f1c995ff8d949702440b70921acc5

              SHA256

              bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5

              SHA512

              5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\mmfs2.dll

              Filesize

              768KB

              MD5

              200520e6e8b4d675b77971dfa9fb91b3

              SHA1

              0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07

              SHA256

              763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b

              SHA512

              8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\mp3flt.sft

              Filesize

              24KB

              MD5

              5bebc3ae0122702b89f9262888d3a393

              SHA1

              064731c0f1d493b5b82921fa78f06e3d1db95284

              SHA256

              81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2

              SHA512

              c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\parser.mfx

              Filesize

              30KB

              MD5

              5903e2efe098dae179c07d670ff836b7

              SHA1

              93a2ce92a28c646735790d2cc9ff8959cc6e0c11

              SHA256

              9813631f63f79fbaa741094786d4b13c34515ec4a33c0d4e88b75a20973c887c

              SHA512

              e39bb67dc8765558274f93953de141e17de18550912bf79a94a2cc998918d07631a0251551abc080363ea52444c1511f15458232d0c656d8f62550d33756e740

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\txtblt.mfx

              Filesize

              36KB

              MD5

              8740745e7af7926a0e7d3b194fb51fdf

              SHA1

              d7688925efd0287334d444a9e4bd584177ed0fbc

              SHA256

              09a214d9738946b14c4470ea95b45de41641e5d69b7559dbf336f7b4624859b0

              SHA512

              dc52c25b588f386cceb0eef912e0ac38ffb07443011c957ca3d0fda8c2c6d41e8fbcb33dfc1b7c5ff469216cd8c233d5025b88575bd10684827c18fb5ef52bb3

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\ultimatefullscreen.mfx

              Filesize

              73KB

              MD5

              96059dbec69c3904e4d7ce734a4b38d0

              SHA1

              5169934f8d89b0dba963861dcbae55e78fc21dfc

              SHA256

              fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058

              SHA512

              82977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520

            • \Users\Admin\AppData\Local\Temp\mrtA5B6.tmp\waveflt.sft

              Filesize

              8KB

              MD5

              57ea61dd14314ef155e80c6a0be8a664

              SHA1

              963b0ef2fe976ff77044a821fe1e29be4a8cf8a7

              SHA256

              92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad

              SHA512

              cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9

            • memory/2292-41-0x0000000000AE0000-0x0000000000B30000-memory.dmp

              Filesize

              320KB

            • memory/2292-51-0x00000000003B0000-0x00000000003BB000-memory.dmp

              Filesize

              44KB

            • memory/2292-30-0x0000000000A80000-0x0000000000ABB000-memory.dmp

              Filesize

              236KB

            • memory/2292-69-0x00000000025F0000-0x0000000002702000-memory.dmp

              Filesize

              1.1MB