Analysis
- user interaction
yes - max time kernel
151s - max time network
162s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Five Nights at Freddy's 3.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Five Nights at Freddy's 3.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target Five Nights at Freddy's 3.exe
- Size 111.2MB
- Sample260827-spjrdaaa99
- SHA256 705ebbda9704e3b3d0f4bdbae25f691abd10713191068d66ca1df6fedc5e2260
- MD5 6406b6c63b5f944c4ac90310f212a702
- SHA1 c6feb6407e01bbcf6e684abc5d5ec931a68c75ce
- SHA512 53b1d2f3276e175a8b9c02b6f3449472fd7e2cab6414c2c4c51178f6444b39127c1a48844714234f350b4a43fca2b105c5640d349c3510a65c52f7a8dad52fc5
- SSDEEP 3145728:W2qAci8Zwy7LN+COjFxL1qYqD5c9MNslAYUMCqcREB:7q/yy7LN9GlfqDSBlSHqqEB
- TLSH T11248331266D2D511D4A5003282B2FE7A2F791C13437644DB67C23F8A7AD36E96F3A6C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe 5088 Five Nights at Freddy's 3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Five Nights at Freddy's 3.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5088 Five Nights at Freddy's 3.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\Perspective.mfx
- Size 15KB
- SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
- MD5 9f064bdcb066daa428db0ed9e33e785d
- SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
- SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
- SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
- TLSH T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\cctrans.dll
- Size 150KB
- SHA256 43cc81ac47386546b42a2fdd5ca52173418c8912b86ccf8618344c5b32e46d26
- MD5 1f73431dd50cf5951b415e5fe4d9a662
- SHA1 1b4ec1367de326ef032708f1bbc8affaf22e8e35
- SHA512 36b4f583e02bd12e0317cb522fd9943bb7bd019d1cff3cb0db59d416116a47e07085b1c348de8f6f9a560cd786c5934b533f9e80327bcac4fba6d6ccb6969961
- SSDEEP 3072:sWEirlmus5RLyA2VHpZ4lZw22BvTztc84qW:1rsXyA2TZTZcBb
- TLSH T154E34A1176919831EABB067D08B99B420F7FBAA4CBF08DDB6F54269E49B02C04F34717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\kcclock.mfx
- Size 108KB
- SHA256 f2319a7359fbcb8860f1c468aad602383c49effb7c110de01ff13acdcf3a5ab9
- MD5 991da0ff2087993bba15ed149dd71b04
- SHA1 13451a755644095621baefe3a8a9db9c7c550ab1
- SHA512 5ee26153f82ac5ae6845b413271942b76a8d7ec50d3e484a7fe1656ee45e34260f73f47fb003b27ce913e6e7216d99a6e8765a431330a76423fedca9db5e85aa
- SSDEEP 1536:dxbZlOorghPqU0lfjH4hC0ciB2TjsWjcdcpL1D:VsneHvsB2TMcpL1D
- TLSH T157B35B00B6918374F8BF06B546BA9BD20EBDBE22477489DB1790409E4DB47D0BB31B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\kcini.mfx
- Size 28KB
- SHA256 20bad52f883914c6fb11eec9d94173a53a67f2eb97413ba9118edb101f11abb3
- MD5 4ff7be1a9bb8ede86739cee1b9b31278
- SHA1 ddc780c4ac30bba8af8523c198c93b5977e7d0f6
- SHA512 245d469050c6743a7e52a29252d12981a80e04937cf459f12e8706cfd46d01f06328e2beac7b9a755b7074588701a277643b2bff8fe9d608267fa1e0a0d0da4e
- SSDEEP 192:ikEJMP77OKmGWyOOVqFAS5TNg/lOgSGOJtjz9zfdgQvwiWDgwkj:JEJSmGWylepe/lOgSGOJt9zVDvGD
- TLSH T1C4D2F81376795873C41A5EBE19BF123BBE39DA92C5BEEE13C120E41D1812781593A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\mmf2d3d9.dll
- Size 1.1MB
- SHA256 1a46578e8c579e366bf28b081a3c24abf7c74620950013dbf99a3da6570bf871
- MD5 6b609661c2c50da042487e79f13e4f92
- SHA1 5571709e3eaf58b98b6599ec95668957f4e92d00
- SHA512 db02c483b7140ecde52b00b633405df36b859ea67ed0ae910b13b2a023501b492f2795e9a83ebf8d258db143ee355f2242e94a681b9dab9a58bb0c153126f987
- SSDEEP 24576:xYp1fP9305CinyE+FBB5joW4pXGFps8PA+:sflinc9zs6L
- TLSH T14C35AF10F2928131C4A773350667A37972BABF2509B595CB1BC83E7A3E345E1973938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\mmfs2.dll
- Size 460KB
- SHA256 2026cc0c648a021d98245ab2430cdbe647cb5f312e9b212aee10ffdf08ed130b
- MD5 b6e81620954dbc650ab6723d2b5fb944
- SHA1 fd4026261054f38f5a6850181ee9128747357176
- SHA512 173d76fc4cb1242ec035e974923faae2ca655c568c176f701ebb78459cbae9b5f84aa0e8f4bf02ebd9906a14cb8158fd148486facc7420378195c2da2bded03c
- SSDEEP 12288:aF4DXwTvPcKCeT8ZGEOmKbspzGYhIVEJwzhtPTbc8kc:aF4DXwTvP7wBWEzhhIPTPTI8
- TLSH T165A4AE10F982C231E9AA02728ABDBE6A287D7A71477845E3D7845DBD1D701D31F327A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt860E.tmp\waveflt.sft
- Size 8KB
- SHA256 98134d326a09569bd5933ffcb026009575509a1bfc20384ef8eebb762aabcd38
- MD5 5230a9c12b9829c9fd333cd8b0620011
- SHA1 0becf7512f498c18af3b9943a4b2556a769cc8eb
- SHA512 1a6a5a72fed0458152ca830941b3d07e448bb588fc61a24c97561833b882e23a529a0a78036732cca95013170a46cc5444a4d642bf05a4fa5a474d51d40789d5
- SSDEEP 96:vwor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6b/8cKH+ewp:vf6Dj9t2ubTVdGJgOCGvw
- TLSH T158F10B12A7A500F5F8CD0B7134B7627BE875FA285B25C24FC584DE6C1C311E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\MMFApplications\freddy3
- Size 64B
- SHA256 cf7f75c5261a01860ad3866e5d8cf6ea13db997c659888360d17dfc45399dee1
- MD5 74d01fbf2231189993ffa61da69346c2
- SHA1 3336eb75b55ca0fbe94fbb5d866ea70d484a5f26
- SHA512 16023ff24d136bb41e2fcad8382c91af6f540586dda247ba430d08d6b248f24aa8388f234df3c3b764e57ba458e5e66927860ace31e654c525efb4e2f15e426d
- TLSH T142A002A263924108A0212015F479091B05F8CA6055E575E2710105772C08449158F254
- MD5 SHA1 SHA512 TLSH