Overview
overview
7Static
static
3Five-Night...om.rar
windows10-2004-x64
1Five-Night...om.rar
windows11-ltsc_2024-x64
1Five Night...ys.exe
windows10-2004-x64
7Five Night...ys.exe
windows11-ltsc_2024-x64
7STEAMRIP ...es.url
windows10-2004-x64
1STEAMRIP ...es.url
windows11-ltsc_2024-x64
1_CommonRed...up.exe
windows10-2004-x64
7_CommonRed...up.exe
windows11-ltsc_2024-x64
7_CommonRed...st.exe
windows10-2004-x64
6_CommonRed...st.exe
windows11-ltsc_2024-x64
6_CommonRed...64.exe
windows10-2004-x64
4_CommonRed...64.exe
windows11-ltsc_2024-x64
4_CommonRed...86.exe
windows10-2004-x64
4_CommonRed...86.exe
windows11-ltsc_2024-x64
4_CommonRed...64.exe
windows10-2004-x64
7_CommonRed...64.exe
windows11-ltsc_2024-x64
7_CommonRed...86.exe
windows10-2004-x64
7_CommonRed...86.exe
windows11-ltsc_2024-x64
7_CommonRed...st.msi
windows10-2004-x64
7_CommonRed...st.msi
windows11-ltsc_2024-x64
7Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
Five-Nights-at-Freddys-SteamRIP.com.rar
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Five-Nights-at-Freddys-SteamRIP.com.rar
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Five Nights at Freddy's/FiveNightsatFreddys.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Five Nights at Freddy's/FiveNightsatFreddys.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
STEAMRIP » Free Pre-installed Steam Games.url
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
STEAMRIP » Free Pre-installed Steam Games.url
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
_CommonRedist/dxwebsetup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
_CommonRedist/dxwebsetup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
_CommonRedist/oalinst.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
_CommonRedist/oalinst.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
_CommonRedist/vcredist_2015-2019_x64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
_CommonRedist/vcredist_2015-2019_x64.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
_CommonRedist/vcredist_2015-2019_x86.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
_CommonRedist/vcredist_2015-2019_x86.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
_CommonRedist/vcredist_x64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
_CommonRedist/vcredist_x64.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
_CommonRedist/vcredist_x86.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
_CommonRedist/vcredist_x86.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
_CommonRedist/xnafx40_redist.msi
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
_CommonRedist/xnafx40_redist.msi
Resource
win11ltsc2024-20260709-en
General
- Target Five-Nights-at-Freddys-SteamRIP.com.rar
- Size 267.8MB
- Sample260730-2bv2xsgl71
- SHA256 426320ecf69772851c9305b506a7cfe3ee0bcf3d96666e68c5a457dd726c10b7
- MD5 264e5066ef1e71ed3685d6022e6a7a24
- SHA1 1b6016f3abdb4e9a3d9a64735cfaf18d8ee12531
- SHA512 3753bff2a7b1509c894381b8825eb13fb17d5a9ebedf93f9429dfa436ee3583b1e25ca7f422e7e91b7f8383cb18a58d81d06f86e14f53efc915d154cadb456ed
- SSDEEP 6291456:ofkIAc4OZIHeL0sC/qHMRfHa8TqBeDMyEqkqCTac/:ofmc4aI+LjC/JHs0MJJVb
- TLSH T1C5D8334D2C27F44292E6796A5BF7718A3EFE909A8C1944CCC738153B40FEE785E8B560
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5376 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 5376 7zFM.exe Token: 35 5376 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5376 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Five-Nights-at-Freddys-SteamRIP.com.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5376