862cd7ab7c81b20a4e848888bc2493dda0181759c39958a42cc5c3d02dfb195a

Analysis

max time kernel
102s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Five Nights at Freddy's/FiveNightsatFreddys.exe
Size 220.7MB
Sample260730-2bv2xsgl71
SHA256 862cd7ab7c81b20a4e848888bc2493dda0181759c39958a42cc5c3d02dfb195a
MD5 d926fee3666c1c854a475a9766ad7ff7
SHA1 6459df8e4ae6d8b4dd77273f6337bd77874a8276
SHA512 0e5ff32ab864651e8dc54ca9488394d619316cf6bb1678f82cee758b0a5f973f3f436abeed1eac5dfbed6c7473c0d986cc317d0c8eaa34b4f98a1539440cec25
SSDEEP 6291456:f/aRHk3y95IDXNBvbYrQOKKtE8DDY+XA+WKqg4Zn4XEboaN0yG:f/a23y95OXzMQOK2dXA+TqJn4XEboaZG
TLSH
T161B833A170D0B452E1E3A03286B5ED796B799821073344EB07D51FDB7DB5AC2EF3A482
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe
636	FiveNightsatFreddys.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4688	GameBarPresenceWriter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiveNightsatFreddys.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{CB96AF82-FBC0-4CD4-90A3-52750C3CC165}	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
636	FiveNightsatFreddys.exe
3396	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Five Nights at Freddy's\FiveNightsatFreddys.exe
"C:\Users\Admin\AppData\Local\Temp\Five Nights at Freddy's\FiveNightsatFreddys.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:636

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Perspective.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
TLSH
T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\cctrans.dll
Size 64KB
SHA256 cba1c0fa69bc6b106408d06878390a5699cd2b25adfed1a2610ee01ae2524cbe
MD5 a20165b7e7dfee46a59e48c175523af0
SHA1 6ed627806753d11e1a121689369668294d15be74
SHA512 a9295b814fe77aa4ba4dec5cbed790858852f775799fe9da01bf07d67fa294d4ca1c5a68c9255c3fb716d0dbeb8b5a5ea38b8ec72263f40957beafe7bf323cd4
SSDEEP 768:r6tSW9fPqprrtBNZZzLRkmlWNZ5jD2DpzyAcRnBQDjTpNR7:r6N9fPqp3tBNrHRkmlWNZ1oxcRcjTzt
TLSH
T131531A11B36448F0DB8E17363CAEF772157EBBA92BC4BB875D19F2ACC421160592531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcclock.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\kcclock.mfx
Size 36KB
SHA256 d320a4aeb6940a6a8589a99e5e16abb086e96c4c3376fdf4f066c0e125302247
MD5 35fa0df588606e5a382e7c155b28d0ff
SHA1 0552d9a6124b11d3ccea7ff8170b3a84c2afd0a7
SHA512 0421292d49fcf3bc87091f52fdc6def36cf7ace90123ee16289e6893c57d8ff23b72c8e9ad2261b9267c7c13f9de9d8c38246d6d68d3bad97c8967470d81ef64
SSDEEP 384:4snEwop+Pq2dUobOW1x1Fe7c8TUwMHaLE3FpY8n1nzdBu0zKBpX:nnEwo8Pq2dtagx1Fe7csbuDnn1nzRz6
TLSH
T1FCF23C81F2ED1274D8267EFA84AEA176AD3FB5916838C107D2E0DDBFA151204E930737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\kcini.mfx
Size 28KB
SHA256 82c4f5af3c25a8daf60185833d3d61f2e8e2851ad640b59af54060eab6bc859e
MD5 5522465eba7c81f1fb67d6ad1a5df233
SHA1 0ec415bfaa9db6984cf922d5503d9fde67d0b3e2
SHA512 30d0ed91bf072e7b7367a708eb6a7d92cc0f326249ffdd44a0d94c3b8feb37b38387141c88add61a578393a186e9fb379d42ab0018aa14e917705e4344233f6a
SSDEEP 192:/sW5a6v2LSDS2F5BCI1Ml/GJpjz9vQx7wiWVgRQ:FuLoSwPyl/GJp94lGVy
TLSH
T1CBD219137774A831D51B5DB9483F053B7E39DE93D57AEE138120E0582812742A83BB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 9eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f
MD5 22284d6bb382967ff72363f828050e13
SHA1 5c98e25d24aacafffded9353c9526be0128c6dbd
SHA512 2e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2
SSDEEP 24576:jzJoEGnUrkcp2K48nzXIA39fCRyN1MqEf:Bllp2WsiN1JO
TLSH
T1F435BF10F1928132C4A773310A67A37972BABF150AB585CB1B987D7A3F345E1973938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\mmfs2.dll
Size 459KB
SHA256 c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
MD5 4cf7bb74d8104280b7e986f4df21109d
SHA1 edc21a43136afddbf4786593e84b934d40591b74
SHA512 2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
SSDEEP 12288:1F4DiwTv/cRLT6BDhdI+2KPYpzGYxv1g5IQurTUckeEqvI:1F4DiwTv/I8ESAzhxvJrT1kr
TLSH
T191A4AE11F982D232E9BA12728ABCBE6A247D7A71473445E397844DBD2D701D31F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtBA71.tmp\waveflt.sft
Size 8KB
SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
MD5 f76739536860a0bdb4a7e3bbb0c06d08
SHA1 b21581aa36eda87db8845caf58c668749e26b29f
SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
TLSH
T181F11C12A7A500F5F8DD0B7134B7627BE875FA295725C14FC544DE6C0C302E2D928BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-41-0x00000000032B0000-0x00000000032C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads