Overview

overview

7

Static

static

3

Five.Night....2.zip

windows7-x64

1

Five.Night....2.zip

windows10-2004-x64

1

Five.Night...s2.exe

windows7-x64

7

Five.Night...s2.exe

windows10-2004-x64

7

Five.Night...ll.bat

windows7-x64

7

Five.Night...ll.bat

windows10-2004-x64

7

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

7

Five.Night...86.exe

windows10-2004-x64

7

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

Five.Night...86.exe

windows10-2004-x64

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

7

Five.Night...86.exe

windows10-2004-x64

7

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

7

Five.Night...86.exe

windows10-2004-x64

7

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

7

Five.Night...86.exe

windows10-2004-x64

7

Five.Night...64.exe

windows7-x64

7

Five.Night...64.exe

windows10-2004-x64

7

Five.Night...86.exe

windows7-x64

7

Five.Night...86.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Five.Nights.at.Freddys.2.zip

  • Size

    291.9MB

  • Sample

    241011-z8g58ayhrl

  • MD5

    87ecaef83682a1c7b0af07833c700094

  • SHA1

    a690fc7ffb6d0a2dfb61fcc49cc7942af8d38295

  • SHA256

    3f504f66fad33610a0250bdc4db061cc8ff4deb7dc88446ab3424ba16b430080

  • SHA512

    12ce1b68d9aaa7df1cba23a3a626eff6736dd92e5bd9881010d6488d15d2bded70a6d88f4583f1b42621add8dbfd67c30cb645fcbecc5373878ca004340a43ae

  • SSDEEP

    6291456:VqFdG5lPPmcBDjz/+jrJ+qECNeCCXBuMRZpw7UBEOEb3n1gPV0cl6tcCfZF:VqdGfPPmcBj+jrJHelBtO6EBgPWcVCfn

Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      Five.Nights.at.Freddys.2.zip

    • Size

      291.9MB

    • MD5

      87ecaef83682a1c7b0af07833c700094

    • SHA1

      a690fc7ffb6d0a2dfb61fcc49cc7942af8d38295

    • SHA256

      3f504f66fad33610a0250bdc4db061cc8ff4deb7dc88446ab3424ba16b430080

    • SHA512

      12ce1b68d9aaa7df1cba23a3a626eff6736dd92e5bd9881010d6488d15d2bded70a6d88f4583f1b42621add8dbfd67c30cb645fcbecc5373878ca004340a43ae

    • SSDEEP

      6291456:VqFdG5lPPmcBDjz/+jrJ+qECNeCCXBuMRZpw7UBEOEb3n1gPV0cl6tcCfZF:VqdGfPPmcBj+jrJHelBtO6EBgPWcVCfn

    Score
    1/10
    behavioral1behavioral2

    • Target

      Five.Nights.at.Freddys.2/Five.Nights.at.Freddys.2/FiveNightsatFreddys2.exe

    • Size

      207.7MB

    • MD5

      799b57586e19c15e5e750677efbd04d3

    • SHA1

      902ddf1c96eed78aa470acb80713d547a4ca0d75

    • SHA256

      84db9972c70ae02ba9596e1be624f2942545ee939611e7fcd593b75a67d41ac6

    • SHA512

      3aaf896b1dca59a27e9d38ce54ecb6e44dc0981f94af78592474de03754af3363291c0937d47808b5fc9a3a8ddd0ed7c2d6ce5b7e76bf8f67dac65b9f603d9dd

    • SSDEEP

      6291456:L3O+hH2JAdy5xinMoB18pjuFwxSC+GD8e2EWr:L3O+hArRoB18E2VDXs

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery
    behavioral3behavioral4

    • Target

      Five.Nights.at.Freddys.2/_Redist/install_all.bat

    • Size

      1KB

    • MD5

      430dae8e5456ca1a46f7c3e633e53acd

    • SHA1

      cf7a361483d6a9dd34db701fc1324f8b69f34094

    • SHA256

      0caf84131587fd246071dadc0b4942ddc88bdbe42cf13677c3f832572328fbaa

    • SHA512

      315239791017d808bd3662c8591ec52e758c509a0b6be0463056700c0a67ef6de3be19d7ea960588813fb09dbd9422a26fd5486b199f2b5da40738a1227d1054

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2005_x64.exe

    • Size

      3.1MB

    • MD5

      abde5e0a22a46434bd0df652a63fff44

    • SHA1

      c5088da4be3f72b4af2f3156893bf1d2b1f6f6ec

    • SHA256

      b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1

    • SHA512

      4ebd8971dea1efb9a72fee071694da7c9d8c797b3564cec7e0044d24b01a13009013f4a43719b7e223214a6c43d50d56790751b9e91cd324d40809bf0d605d9f

    • SSDEEP

      49152:RVgGXsOTkzq69oXxerpduZ6xJftGEkU0oEBL/txTroHENHTpPE6fIr6VAVP04PLJ:R7XFcDehoLtXEBv11TqZl04P5PqE

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      6402438591b548121f54b0706a2c6423

    • SHA1

      e052789ebad7dc8d6f8505a9295b0576babd125e

    • SHA256

      d6832398e3bc9156a660745f427dc1c2392ce4e9a872e04f41f62d0c6bae07a8

    • SHA512

      c615e6337a9507bfaaff14e23043e206351d48bf7ba1d0c244c4bc8a08f411b4aa27f9a9074a87b320007b3cfca448306752fd343392bdde83b851b0e7daadef

    • SSDEEP

      49152:OW6IfKsucUSdXRc8jfi8sH9LyrgSnem02SIi7oOBX4twfDI4OzLbT3:RxucUkGwoBrSn9hFi73BV7xO33

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral15behavioral16

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral17behavioral18

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral21behavioral22

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23behavioral24

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral25behavioral26

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2015_2017_2019_x64.exe

    • Size

      14.3MB

    • MD5

      264c296cc0bf00db6ba8e7bf8cc4e706

    • SHA1

      837a49f9eaacda7c077a8bbea149a52d766b81c0

    • SHA256

      7d7105c52fcd6766beee1ae162aa81e278686122c1e44890712326634d0b055e

    • SHA512

      9f197af069535896f866d2853689c8e0243fe5c89feeaf6a027315f31bb0086bb0a6234e77a4427481fb2dbe32c3c0d748f9de82ee439086745658a825bed5e9

    • SSDEEP

      196608:bRjltflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4oDi08YfpPOx5l5xtc84s7uhzNIe:1LlptVYmfr7yBG/4oDd8DL4s7uhBqY

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral27behavioral28

    • Target

      Five.Nights.at.Freddys.2/_Redist/vcredist2015_2017_2019_x86.exe

    • Size

      13.7MB

    • MD5

      fe6eae1c34528d1ea224569dcdc35618

    • SHA1

      f722332172a4cf18cab23adc81eeaef61e5c9b35

    • SHA256

      a06aac66734a618ab33c1522920654ddfc44fc13cafaa0f0ab85b199c3d51dc0

    • SHA512

      b97d2e7bd37d30acdb41cb53426f0da4deb5569fc5d1ef1fd4b868c63f1ba1e20994ccdcda40a64d821d6761139326cfff6263541a3ec460d4b2bcd5b8ac5036

    • SSDEEP

      393216:MD/ClptVYmfr7yBG/4/09vhwXRtCk2PfjWKv91:MjKpttD7yBG/d9pwHCFKW91

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

discovery
Score
7/10

behavioral4

discovery
Score
7/10

behavioral5

discoverypersistenceprivilege_escalation
Score
7/10

behavioral6

discoverypersistenceprivilege_escalation
Score
7/10

behavioral7

discoverypersistenceprivilege_escalation
Score
7/10

behavioral8

discoverypersistenceprivilege_escalation
Score
7/10

behavioral9

discoverypersistenceprivilege_escalation
Score
7/10

behavioral10

discoverypersistenceprivilege_escalation
Score
7/10

behavioral11

discovery
Score
7/10

behavioral12

discovery
Score
7/10

behavioral13

discovery
Score
7/10

behavioral14

discovery
Score
7/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
7/10

behavioral18

discovery
Score
7/10

behavioral19

discovery
Score
7/10

behavioral20

discovery
Score
7/10

behavioral21

discovery
Score
7/10

behavioral22

discovery
Score
7/10

behavioral23

discovery
Score
7/10

behavioral24

discovery
Score
7/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
7/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
7/10

behavioral30

discovery
Score
7/10