Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
26/03/2024, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
five-nights-at-freddy-s-2-multiplayer.exe
Resource
win10-20240221-en
General
-
Target
five-nights-at-freddy-s-2-multiplayer.exe
-
Size
304.0MB
-
MD5
d4139b6b15bd378ce7b0c7d0649616e1
-
SHA1
f21534750351411c4f157aee2628d3197cda77a9
-
SHA256
71e276cbf3b9cbfe9ced9d65cf1fddf28b00719fce9f0812332044fbcb5190ad
-
SHA512
27f76fbb4d5e96f36552c5a74e47e34bbd5e46ff3f35c6dfc2cb00e8f725d6da757e7d719f4da61a27d96d8e73c160ea8e1f88db52b5f7c4ea8ef9c2189c8dff
-
SSDEEP
6291456:IDOuivTf6+CP4exRYUNR0gtc3bBRpI6kBbu:IDOuivTf6+CP4SDc3bLpI6kRu
Malware Config
Signatures
-
Loads dropped DLL 25 IoCs
pid Process 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe 2292 five-nights-at-freddy-s-2-multiplayer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\five-nights-at-freddy-s-2-multiplayer.exe" five-nights-at-freddy-s-2-multiplayer.exe Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\shell\open\command five-nights-at-freddy-s-2-multiplayer.exe Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\shell five-nights-at-freddy-s-2-multiplayer.exe Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\shell\open five-nights-at-freddy-s-2-multiplayer.exe Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249 five-nights-at-freddy-s-2-multiplayer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\ = "URL:Run game 653769591381557249 protocol" five-nights-at-freddy-s-2-multiplayer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\URL Protocol five-nights-at-freddy-s-2-multiplayer.exe Key created \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\DefaultIcon five-nights-at-freddy-s-2-multiplayer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1104443672-3570440473-4052989528-1000_Classes\discord-653769591381557249\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\five-nights-at-freddy-s-2-multiplayer.exe" five-nights-at-freddy-s-2-multiplayer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1512 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1512 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2292 five-nights-at-freddy-s-2-multiplayer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\five-nights-at-freddy-s-2-multiplayer.exe"C:\Users\Admin\AppData\Local\Temp\five-nights-at-freddy-s-2-multiplayer.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2292
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.5.1200088394\1488728644" -childID 4 -isForBrowser -prefsHandle 4452 -prefMapHandle 4616 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79f068d3-64f9-4df6-9376-7d20a1e4713a} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4684 1d0e07faf58 tab1⤵PID:3032
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.6.2058615413\499215227" -childID 5 -isForBrowser -prefsHandle 4820 -prefMapHandle 4824 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0079a1f6-472f-4f63-b7d9-a3fed6a70918} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4808 1d0e19ce458 tab1⤵PID:1036
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.7.412699581\1546406577" -childID 6 -isForBrowser -prefsHandle 5000 -prefMapHandle 5004 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4d56e13-020f-4471-ac10-dc9fcc70c4cd} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 4992 1d0e19cfc58 tab1⤵PID:1292
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3284.8.860356206\30326531" -childID 7 -isForBrowser -prefsHandle 2600 -prefMapHandle 2604 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e76aeeb-22c0-4e3e-aa71-1a3b25e976d2} 3284 "\\.\pipe\gecko-crash-server-pipe.3284" 2492 1d0de09c858 tab1⤵PID:4424
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD5fc3c1444645529fb8750de21e882f428
SHA14b826c157e1d7e60e883d33ace1ad148f346f48f
SHA256bb293578bc77d24dea6ee52624ac7628d24607773faa681df12fe634692a3a44
SHA512a03e063a3767a96cee24609ee632bc23b5e61119c9b539aaff21dcd001c37c928cc1132f81b35221f25bc06b5a36d34b230b5f33cab4501da017b1a6846fbaff
-
Filesize
190KB
MD5a59ce74fc8cbf165fd68bc3900844637
SHA1e1a3188df779356c5fc4cb4222f125a1312108ac
SHA2560d3b16bcbf0368a6b33d782007aa124d3af1fe1969a40ba7c2d15c74560b3d90
SHA512a08154c9d12b59bae5e4b962257d8fb91009f396b269c70294a44a8eba2a5d1b88403d522cc1247d01149b066739e306db929d0b5fec1e24a83379c084a27808
-
Filesize
169KB
MD580f0fd556eec13434bdabe896e8d484d
SHA1bd21b85591a0300028fedd089f0d027891ca4dd6
SHA256326506e0818c20bbfab6accf0a2cffb1fa8ec931cae7b9740b55c417d85dd73b
SHA512b02e1e814c37b35604f5af9c12c687533991a8b26ea9f86f4b507e7db67f8754ca2752876f584aed4c8222021b8789aa4c4840aa1596cda8b7e838401ca54da0
-
Filesize
198KB
MD5d05b910622dc181bfcd148d74dcfe5da
SHA1117ae86272401427e93e0175d675da805e2f6826
SHA256b321162fcb0363c6c52e5c07b276d1c9600e3e0bb7be181436c5695faf015fc3
SHA5127518099328610a57d7942cea73c767c00f7d5a273a898f5676e3ccc1b1cfe50729f929bc04ccc48e040b2cb5ccc7678fb827e62457d7e8cc7bcdcab53e162511
-
Filesize
122KB
MD51a0c305a025feed8f11fe4be6653e82b
SHA16821aad18b33eca86e6e4e50962df22d61db0d84
SHA256b899f9c9663d8bd31d02bcae7c7e99e4188c54b1ebd7befb57ff8cef9a504e3c
SHA5120ac2e97b7d51e9151b4ec9a2ff82103b1d71d0165ac13d2ba35a420d82304eb4e645ee09aced533d91b81c815df5ecbc74e4491050623f419a2205b449198f88
-
Filesize
129KB
MD5f9ae474b1872c3a0f9b80f7e94b25590
SHA107260d14c7f78990a9070acb83a8549b42e43372
SHA256e643031cf0e0baebf12ed248b289e272c2e542ca5f6a8e94a8b09e46b8e3d7ce
SHA5122fbe6eb30b5bd7afd58dabbeaf138dcee4976327b291bbc43c81afb683b9431994eda6dd10f5e0de3e65ef71fadd352cacfd712fa43f72421afff2e6e52a95f5
-
Filesize
123KB
MD5df91e0e91ff449cc20a08600ddc59a23
SHA1d8799b97f8a51bb928ba58ae8cf86989e6ae554a
SHA256a75c44a64f49610c539f06377979d2d414e5627d700adcc359caea09b6201d11
SHA51291031549055b100d59edef68c90045c81365b6e4932c897a3d4658f70080808b0434ebbf15324b14f505d493e61500724dd92e66e58c462e610c02ec230f1a67
-
Filesize
134KB
MD58d3df9401fa959498a206abb077e86f6
SHA10f905a27a7db57b4091f5cfd446fb4f62fce6adc
SHA2560bdf3860cc31e18dc0701f952f238c21cce13a180128c32eedb45afbc2a76600
SHA51245ca41e4216ac46ce57d682fdeae2fa7a14ad4da3491834b6eeb6adef790f19e53860dac59d11765dd6dd021a0abdb73f984424174d471246f34c5f4176233b5
-
Filesize
861KB
MD566726fdf933ad94bf73ab40430abadd0
SHA177bfe6fd11acb69d9735af1fd291c496773e1249
SHA256163f8e16167f79bf88a4175af056d31256775b6c68f33e00528f26585e4d0354
SHA51283f6b4d61a5366bd6cf6b99f55a8d0681b413271fdfa8e9164b73032a9c972c7a1a1b2ecc2ded30c7a352a2895e1780facefc66f1436abd62d148a30300ce4f6
-
Filesize
305KB
MD50836ffc32147508400f557286e7574e5
SHA1402d0c938eb8982611496f388737595616516040
SHA256b339ba20b3341cf3da19301eada3370f59e193513a06c90f401f19aec774e757
SHA5124b31fdae9e1c37812cbe365ca3bbe28949cd9b34df1478b9c7834021cde9361d5fbbdfd7fa53177a13d34b2305ae31611afcc7a3a3025720e5ba805b28b36e4d
-
Filesize
40KB
MD5619af4af177ae18c098c504af34daa46
SHA19f12e2ac12aa78148d1aba4856999dd47d687562
SHA2567ad7ca933a51bcd7458cd281bb9e7e30badb85c919d25572407e5afb22750f5e
SHA512112914c83fb2fce858a38f96396fd8dd5a0d49797c7b847641d5ac21a254511059fd668943f1963b2ec2812c98fb0f9aca631407d9b80d9a7265ebcfa2cb6f5f
-
Filesize
215KB
MD58a8767b9d44ff18cc9a2986cc1efcd5c
SHA11ab46ea5c4eb66c059113b715fda146b75c0de23
SHA25650fe75b79197c5cff2d7f256ffff8d9f9d58e66c90f9fd00fd7aa4688c7d2e5a
SHA512dfbc478d9504ab6cd375e1a987223afe993777417756d9901a46dffd31ee006ffd768f1fdc8279722a94e24344bbe5f2fd8b2b9bde9f92f73bddf880aa654857
-
Filesize
15KB
MD59f064bdcb066daa428db0ed9e33e785d
SHA13c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA256090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
SHA5124a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
-
Filesize
44KB
MD5ceb8b2e522d0aaaecdf69b3bcc89a530
SHA1c1cf769a96a9612f7fd0c1965413f4a57e4907e1
SHA2563407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65
SHA5123c46743c635eb96351e6a82490cececb24e6a104433c962f263ec01cf78fa9747d4f56d05c3085c0a18eff7c180b145df5e8e74bc008fe2f617f7f4c24be0331
-
Filesize
108KB
MD53aa5cbe7b31e550511ce011457c44790
SHA193c22c4f9ddb40d72865ec5dc169cef3feb3e337
SHA25658588b5e12d0c5629ee481ad7ed9e8b4d6798cfa83004aecaa600a6924bc97e6
SHA512c29a54368badaae841eb27dfb3a9ca74571828618888021c45949d1d999242e07bf240b08f602dfacded4c82e12fb6a13f501a09efe68fd5a310541099fa4a42
-
Filesize
32KB
MD5a00acf3af0958898345fca9893cb6f57
SHA1561717e33e2877fd0db99411265186ca468041bd
SHA256b38ad01ad8a22f3f553530b000d6d061356601d308e6a79284605c30cb0674ad
SHA5129435f612a23864ac7e4d22cff927b4155463fdddd8d143b805d7233dd372e9a5975c9a4170de9bcfc3adce4ab9fffdab2937f053e48743d2791753d2dc727850
-
Filesize
330KB
MD5a6ad14845999c5aa7adf2911671a7c5b
SHA198dfd5a9584d1c1b330c2c104c1779bd55ded211
SHA2565af175ffb932fb653873dad095dd40f2ab8d3fb56f287213c21bb68652ddad2d
SHA51232bb59826b82d47ec420ac2532e1387a85422d2f0ce5370ad2c95b914a7615d3b122dbf4dd045105eb8ffea49324dac57659f0e5f2500b4d0eb75047cb36dfd8
-
Filesize
32KB
MD510a8ccacb046c0dc05adfc6964e99e95
SHA148acabc563a9c6d48eae3eda5254306127c00528
SHA25657d8f859ecf57eed8f2fdc3271ec1d57c879899a527d77a80c9f45b1377742f5
SHA512e972e0a6d4aa5c0cab99283c27038eb31f0adf2f581b4be9b58768d25a81f71e2aa5482500e4cb16bbc60d41f84ef926cd61a9cbe9fce1fce4adca564a6b147a
-
Filesize
1.5MB
MD5c85bcc9f3049b57aa8ccbb290342ff14
SHA138f5b81a540f1c995ff8d949702440b70921acc5
SHA256bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
SHA5125097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
-
Filesize
768KB
MD5200520e6e8b4d675b77971dfa9fb91b3
SHA10c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
SHA256763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
SHA5128b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
-
Filesize
24KB
MD55bebc3ae0122702b89f9262888d3a393
SHA1064731c0f1d493b5b82921fa78f06e3d1db95284
SHA25681c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
SHA512c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
-
Filesize
30KB
MD55903e2efe098dae179c07d670ff836b7
SHA193a2ce92a28c646735790d2cc9ff8959cc6e0c11
SHA2569813631f63f79fbaa741094786d4b13c34515ec4a33c0d4e88b75a20973c887c
SHA512e39bb67dc8765558274f93953de141e17de18550912bf79a94a2cc998918d07631a0251551abc080363ea52444c1511f15458232d0c656d8f62550d33756e740
-
Filesize
36KB
MD58740745e7af7926a0e7d3b194fb51fdf
SHA1d7688925efd0287334d444a9e4bd584177ed0fbc
SHA25609a214d9738946b14c4470ea95b45de41641e5d69b7559dbf336f7b4624859b0
SHA512dc52c25b588f386cceb0eef912e0ac38ffb07443011c957ca3d0fda8c2c6d41e8fbcb33dfc1b7c5ff469216cd8c233d5025b88575bd10684827c18fb5ef52bb3
-
Filesize
73KB
MD596059dbec69c3904e4d7ce734a4b38d0
SHA15169934f8d89b0dba963861dcbae55e78fc21dfc
SHA256fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058
SHA51282977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520
-
Filesize
8KB
MD557ea61dd14314ef155e80c6a0be8a664
SHA1963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
SHA25692a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
SHA512cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9