Overview

overview

7

Static

static

3

onaf2r-v1.4.1.exe

windows10-2004-x64

7

onaf2r-v1.4.1.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    41s
  • max time network
    25s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 01:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    onaf2r-v1.4.1.exe
  • Size 144.9MB
  • Sample260930-cb62ratt6n
  • SHA256 3ea6cc6e2228c2111f269b107eed0e1738a961dde3f94bed984cff0bf85d4351
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\onaf2r-v1.4.1.exe
    "C:\Users\Admin\AppData\Local\Temp\onaf2r-v1.4.1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Get.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\Get.mfx
        • Size 340KB
        • SHA256 791e717345991c4bf183c6450667498a89b59c4e8a5abb52e2751fde63d3ad43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Perspective.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\Perspective.mfx
        • Size 15KB
        • SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SunkenCamera.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\SunkenCamera.mfx
        • Size 213KB
        • SHA256 c86c46ec701f049d110cbfeacd445628650fa17899a87f58dd63204af234a9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcedit.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\kcedit.mfx
        • Size 32KB
        • SHA256 1fb56c1a5fb313c8c51fead10472566328c9260aacc72aa8dde8d345acf53203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcini.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\kcini.mfx
        • Size 114KB
        • SHA256 d1471b2685d45956c323baa2cab11dfe479eb1021f04e2949f03557527c5fc84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mmf2d3d11.dll
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\mmf2d3d11.dll
        • Size 555KB
        • SHA256 e287d76ffff3379d2271b5124788d8a884f48c1aeb933f5bf67568f548ee93e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mmf2d3d9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\mmf2d3d9.dll
        • Size 1.1MB
        • SHA256 4971b2294b825196a628a0a6855a14db99b491c66f39b046055f39b6dfbfc110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mmfs2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\mmfs2.dll
        • Size 510KB
        • SHA256 987a24a65778ab670d4b5eafed78b7daef7a9d8c83e1899b2356601de900ede9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mp3flt.sft
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\mp3flt.sft
        • Size 24KB
        • SHA256 ddeafda7b28bf7545e3ba164aa4a74219eb961c36bb974e0f5085a07daf18f44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oggflt.sft
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\oggflt.sft
        • Size 130KB
        • SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        parser.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\parser.mfx
        • Size 30KB
        • SHA256 9813631f63f79fbaa741094786d4b13c34515ec4a33c0d4e88b75a20973c887c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        waveFlt.sft
        • Path C:\Users\Admin\AppData\Local\Temp\e49dda5c-4c29-44bc-be27-37ec8ccd8831.FusionApp\waveFlt.sft
        • Size 8KB
        • SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ONaF2R
        • Path C:\Users\Admin\AppData\Roaming\MMFApplications\ONaF2R
        • Size 112B
        • SHA256 992cb385f535f8f2cecba27480a8c4d5a7718938b4b2c2a0369870f086868289
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ONaF2R
        • Path C:\Users\Admin\AppData\Roaming\MMFApplications\ONaF2R
        • Size 126B
        • SHA256 4f4f5aa9f739e07ce324ad40bd6dc51619bc4759059fa21cf48e10ca04a394e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ONaF2R
        • Path C:\Users\Admin\AppData\Roaming\MMFApplications\ONaF2R
        • Size 18B
        • SHA256 1852e4100d72638923a5e5b0931f01343a1a64cb9871f513a624a3b08b067fcd
        • MD5 SHA1 SHA512
        Submit Download

        memory/5260-36-0x0000000002840000-0x0000000002899000-memory.dmp
        Download

        memory/5260-30-0x0000000001060000-0x000000000106B000-memory.dmp
        Download

        memory/5260-60-0x0000000002A50000-0x0000000002A74000-memory.dmp
        Download