Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/07/2026, 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FNAF7Demo.exe
Resource
win10ltsc2021-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
FNAF7Demo.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target FNAF7Demo.exe
- Size 78.6MB
- Sample260719-ajftesfy7m
- SHA256 cacba1cb4b7b6cc735c475538cd1d82d384bf06257a8acd772567f6a422f4e49
- MD5 c204066a71d094cbf1d2a6acfb31096e
- SHA1 795e2d31e04cdcfd830deb43388679e8a20756a4
- SHA512 ccd6acd134b61ec4f25953a16d1ca951d7a36669d57ddd884c2f0c75161899431f9c7bdbec55fece5e35c8d9f0658935af3adddf39f86a725698532949b41e23
- SSDEEP 1572864:G7y75TsOwvCTeGyrxu2ff7B8Sn9mLuzmQBIAbg7Q4aKRo0YSnynatKuyp:+G5Ts3CKlrI2rBxn2uDBbbg7Q2tZyJuS
- TLSH T1370833B0B9D1E062D4F6403302BBEDB56EBD2C179B2541D34BC93EA539395D22E392D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe 1704 FNAF7Demo.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNAF7Demo.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1704 FNAF7Demo.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\Perspective.mfx
- Size 15KB
- SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
- MD5 9f064bdcb066daa428db0ed9e33e785d
- SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
- SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
- SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
- TLSH T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\kcini.mfx
- Size 28KB
- SHA256 82c4f5af3c25a8daf60185833d3d61f2e8e2851ad640b59af54060eab6bc859e
- MD5 5522465eba7c81f1fb67d6ad1a5df233
- SHA1 0ec415bfaa9db6984cf922d5503d9fde67d0b3e2
- SHA512 30d0ed91bf072e7b7367a708eb6a7d92cc0f326249ffdd44a0d94c3b8feb37b38387141c88add61a578393a186e9fb379d42ab0018aa14e917705e4344233f6a
- SSDEEP 192:/sW5a6v2LSDS2F5BCI1Ml/GJpjz9vQx7wiWVgRQ:FuLoSwPyl/GJp94lGVy
- TLSH T1CBD219137774A831D51B5DB9483F053B7E39DE93D57AEE138120E0582812742A83BB77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\mmf2d3d9.dll
- Size 1.1MB
- SHA256 9eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f
- MD5 22284d6bb382967ff72363f828050e13
- SHA1 5c98e25d24aacafffded9353c9526be0128c6dbd
- SHA512 2e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2
- SSDEEP 24576:jzJoEGnUrkcp2K48nzXIA39fCRyN1MqEf:Bllp2WsiN1JO
- TLSH T1F435BF10F1928132C4A773310A67A37972BABF150AB585CB1B987D7A3F345E1973938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\mmfs2.dll
- Size 459KB
- SHA256 c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
- MD5 4cf7bb74d8104280b7e986f4df21109d
- SHA1 edc21a43136afddbf4786593e84b934d40591b74
- SHA512 2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
- SSDEEP 12288:1F4DiwTv/cRLT6BDhdI+2KPYpzGYxv1g5IQurTUckeEqvI:1F4DiwTv/I8ESAzhxvJrT1kr
- TLSH T191A4AE11F982D232E9BA12728ABCBE6A247D7A71473445E397844DBD2D701D31F327A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\mp3flt.sft
- Size 24KB
- SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
- MD5 7beafd3ec0c36a1422387c43c49f68ff
- SHA1 240e7d8534ed25dffb902a969826f4300a88dde6
- SHA512 44101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
- SSDEEP 96:24yW7bMnfxKgUEDGDaq5E9my5F3MM+YuU0UNESZpMS07oQCcw95bcPw5IqQ+5lyc:24y+MCQiaOC3j9dJlfMSkI5wPPzElt
- TLSH T18CB22C12B3E10CF5E15A5F311D9B023BAE75FB9917B862575F91C2391C33901A81B537
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrtF397.tmp\waveflt.sft
- Size 8KB
- SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
- MD5 f76739536860a0bdb4a7e3bbb0c06d08
- SHA1 b21581aa36eda87db8845caf58c668749e26b29f
- SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
- SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
- TLSH T181F11C12A7A500F5F8DD0B7134B7627BE875FA295725C14FC544DE6C0C302E2D928BA7
- MD5 SHA1 SHA512 SSDEEP TLSH