84db9972c70ae02ba9596e1be624f2942545ee939611e7fcd593b75a67d41ac6

Analysis

max time kernel
153s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveNightsatFreddys2.exe
Size 207.7MB
Sample260803-1f65bacl8w
SHA256 84db9972c70ae02ba9596e1be624f2942545ee939611e7fcd593b75a67d41ac6
MD5 799b57586e19c15e5e750677efbd04d3
SHA1 902ddf1c96eed78aa470acb80713d547a4ca0d75
SHA512 3aaf896b1dca59a27e9d38ce54ecb6e44dc0981f94af78592474de03754af3363291c0937d47808b5fc9a3a8ddd0ed7c2d6ce5b7e76bf8f67dac65b9f603d9dd
SSDEEP 6291456:L3O+hH2JAdy5xinMoB18pjuFwxSC+GD8e2EWr:L3O+hArRoB18E2VDXs
TLSH
T148A833927582E586D89B4033416B5F31776C6C25872718E353F1FEEC709A7C22E36EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe
1880	FiveNightsatFreddys2.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1240	GameBarPresenceWriter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiveNightsatFreddys2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{645344C0-5F6F-44DD-B5F9-098CEAA7FACB}	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	FiveNightsatFreddys2.exe
2832	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\FiveNightsatFreddys2.exe
"C:\Users\Admin\AppData\Local\Temp\FiveNightsatFreddys2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:1240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Perspective.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
TLSH
T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\cctrans.dll
Size 150KB
SHA256 43cc81ac47386546b42a2fdd5ca52173418c8912b86ccf8618344c5b32e46d26
MD5 1f73431dd50cf5951b415e5fe4d9a662
SHA1 1b4ec1367de326ef032708f1bbc8affaf22e8e35
SHA512 36b4f583e02bd12e0317cb522fd9943bb7bd019d1cff3cb0db59d416116a47e07085b1c348de8f6f9a560cd786c5934b533f9e80327bcac4fba6d6ccb6969961
SSDEEP 3072:sWEirlmus5RLyA2VHpZ4lZw22BvTztc84qW:1rsXyA2TZTZcBb
TLSH
T154E34A1176919831EABB067D08B99B420F7FBAA4CBF08DDB6F54269E49B02C04F34717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcclock.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\kcclock.mfx
Size 108KB
SHA256 f2319a7359fbcb8860f1c468aad602383c49effb7c110de01ff13acdcf3a5ab9
MD5 991da0ff2087993bba15ed149dd71b04
SHA1 13451a755644095621baefe3a8a9db9c7c550ab1
SHA512 5ee26153f82ac5ae6845b413271942b76a8d7ec50d3e484a7fe1656ee45e34260f73f47fb003b27ce913e6e7216d99a6e8765a431330a76423fedca9db5e85aa
SSDEEP 1536:dxbZlOorghPqU0lfjH4hC0ciB2TjsWjcdcpL1D:VsneHvsB2TMcpL1D
TLSH
T157B35B00B6918374F8BF06B546BA9BD20EBDBE22477489DB1790409E4DB47D0BB31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\kcini.mfx
Size 28KB
SHA256 20bad52f883914c6fb11eec9d94173a53a67f2eb97413ba9118edb101f11abb3
MD5 4ff7be1a9bb8ede86739cee1b9b31278
SHA1 ddc780c4ac30bba8af8523c198c93b5977e7d0f6
SHA512 245d469050c6743a7e52a29252d12981a80e04937cf459f12e8706cfd46d01f06328e2beac7b9a755b7074588701a277643b2bff8fe9d608267fa1e0a0d0da4e
SSDEEP 192:ikEJMP77OKmGWyOOVqFAS5TNg/lOgSGOJtjz9zfdgQvwiWDgwkj:JEJSmGWylepe/lOgSGOJt9zVDvGD
TLSH
T1C4D2F81376795873C41A5EBE19BF123BBE39DA92C5BEEE13C120E41D1812781593A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 1a46578e8c579e366bf28b081a3c24abf7c74620950013dbf99a3da6570bf871
MD5 6b609661c2c50da042487e79f13e4f92
SHA1 5571709e3eaf58b98b6599ec95668957f4e92d00
SHA512 db02c483b7140ecde52b00b633405df36b859ea67ed0ae910b13b2a023501b492f2795e9a83ebf8d258db143ee355f2242e94a681b9dab9a58bb0c153126f987
SSDEEP 24576:xYp1fP9305CinyE+FBB5joW4pXGFps8PA+:sflinc9zs6L
TLSH
T14C35AF10F2928131C4A773350667A37972BABF2509B595CB1BC83E7A3E345E1973938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\mmfs2.dll
Size 460KB
SHA256 2026cc0c648a021d98245ab2430cdbe647cb5f312e9b212aee10ffdf08ed130b
MD5 b6e81620954dbc650ab6723d2b5fb944
SHA1 fd4026261054f38f5a6850181ee9128747357176
SHA512 173d76fc4cb1242ec035e974923faae2ca655c568c176f701ebb78459cbae9b5f84aa0e8f4bf02ebd9906a14cb8158fd148486facc7420378195c2da2bded03c
SSDEEP 12288:aF4DXwTvPcKCeT8ZGEOmKbspzGYhIVEJwzhtPTbc8kc:aF4DXwTvP7wBWEzhhIPTPTI8
TLSH
T165A4AE10F982C231E9AA02728ABDBE6A287D7A71477845E3D7845DBD1D701D31F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtB702.tmp\waveflt.sft
Size 8KB
SHA256 98134d326a09569bd5933ffcb026009575509a1bfc20384ef8eebb762aabcd38
MD5 5230a9c12b9829c9fd333cd8b0620011
SHA1 0becf7512f498c18af3b9943a4b2556a769cc8eb
SHA512 1a6a5a72fed0458152ca830941b3d07e448bb588fc61a24c97561833b882e23a529a0a78036732cca95013170a46cc5444a4d642bf05a4fa5a474d51d40789d5
SSDEEP 96:vwor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6b/8cKH+ewp:vf6Dj9t2ubTVdGJgOCGvw
TLSH
T158F10B12A7A500F5F8CD0B7134B7627BE875FA285B25C24FC584DE6C1C311E2D928BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freddy2

Path C:\Users\Admin\AppData\Roaming\MMFApplications\freddy2
Size 28B
SHA256 0cde4416d10dfa177182109ea755eb267ba84c84689a81de41821d851b516256
MD5 3aeb57bf8fe246e9bb6c2f817bbacfb5
SHA1 b7732c3774058f466eca34278b3aa2699e3af19f
SHA512 da955e97ce57f3f3f424cb61921dbee7ca1c48db8fdf3364fcda0521cd5428730822ee757bef6bc40af13ae496b55cf6b43fc80ef6b76b194361034f844b12fa
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads