82ecda74ebd7a8aea20ba115d86b601f5b7e946db5ba07e02d0cadb03faa36f1

Analysis

user interaction
yes
max time kernel
153s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FNAF 1/Five Nights at Freddy's.exe
Size 220.4MB
Sample261014-3cqn9sbs8p
SHA256 82ecda74ebd7a8aea20ba115d86b601f5b7e946db5ba07e02d0cadb03faa36f1
MD5 191fc2b5f031a6397dd5f0327beefed4
SHA1 bed0497721ed3021a7609f66f9ec50044092c07d
SHA512 7bf93b7ce76c4f18f3a6332297b9bbaa46cf6a0d9cf08e443023ae6a79b1bd6b93ade566f3015adab98cd6e6244bdd8dde080ca0c7d5c45391fdd2939aa5c5d3
SSDEEP 6291456:2/UBRk9d1kRH8X+TaR9ryLlss8IHO3NV1WKWkxhp4W53o6mjxL:2/UM9d1kN8uqryLanNV1TWMp4W53o6kL
TLSH
T1B5B833A160D0B462E1E3B4328770EDB96B79A820173344E707D51FDB7DA5AC1EF7A482
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
1588	Five Nights at Freddy's.exe
1588	Five Nights at Freddy's.exe
1588	Five Nights at Freddy's.exe
1588	Five Nights at Freddy's.exe
1588	Five Nights at Freddy's.exe
1588	Five Nights at Freddy's.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Five Nights at Freddy's.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	Five Nights at Freddy's.exe

C:\Users\Admin\AppData\Local\Temp\FNAF 1\Five Nights at Freddy's.exe
"C:\Users\Admin\AppData\Local\Temp\FNAF 1\Five Nights at Freddy's.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Perspective.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4339.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
TLSH
T15762E652EBF00468F0B7AA778CB6072B5671FD526EBADB4E8740040C9EB2B51DD25732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt4339.tmp\kcini.mfx
Size 28KB
SHA256 a5618b90999455b6f8abe3b2849c96175427d27680a46c4386c94bebfb7727cc
MD5 8d086569a8b80fb85db3c9c93af299b5
SHA1 143ec5000967c64b994b4ff7eab9e429bff2d109
SHA512 3eeff9e820a8f87493b7748c48197655be9a4a0fef1854dd2dba2cf04427bd15e927efb79a6dd2c9c9eb665c1e716d85c1fcd5b032aab17a175d8da601fda1e9
SSDEEP 192:89sWBaBU2LSDS2F5BFs1MdD/GJpjz9MiiWFg4U5CM:xDLoSw2y1/GJp9MkFE5C
TLSH
T166D208177BB58C70C41B5DBA5C7E123B7E35DB92D57AEE178120E0582822343987EB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4339.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 1c0ec3ce3eacdcff742ed0fa88f8f942acec23383f13e5a049d83bd54a30cd07
MD5 216edca5011d2de83e3ab5e01bbbdbda
SHA1 49291814036dd68c81cb3479f6fd1b976b1ca30d
SHA512 649905476ac60ebc29466d95a2835313afc708a0fec1715b62e1fc9fd643c8dc6d8a1c5bc44e74e546be7cf28547c0e03f4364ef780c546f04b8cd71fcd55335
SSDEEP 12288:Jeg94AUYY4HnuI1DfSq1GIKTdWdqnh4/TRfT9tCXm+DrA40rX/0MH8r8865kQAW:d42HnTf9AgIh4/TNT9oWKP0rX/B1Bn
TLSH
T1BA35BF11B2928132C4A773310667A37972BABF150AB585CB1BC87D7A3F345E1973938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4339.tmp\mmfs2.dll
Size 459KB
SHA256 0ce3a723492b37f10d3e142feff4b10396c8955b5365a3afbafd75a473a6af35
MD5 3d377182bf625d57d50df332db8a09fa
SHA1 0fdb0f6c3c5d90e395ecd65f204e39a5a98ab19e
SHA512 625b43ba5f96fd31e387a2dedd67599ef340da9b77279f18ae0a0fbf9aa9640f428fd442c0fe9edc465b2310b004d7015953e762405e54a354224d4f5f35cc8e
SSDEEP 12288:zFDDZwGvE6KfuXQBy1VsPzZQYP2dPJ8gK8u3p8VaTBci:zFDDZwGvEKXUHzbWJnWkaTW
TLSH
T18AA4AE10F982D231E9BA11729ABCBE6E297D7A60077855E387844D7E2D701D32F32763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt4339.tmp\waveflt.sft
Size 8KB
SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
MD5 f76739536860a0bdb4a7e3bbb0c06d08
SHA1 b21581aa36eda87db8845caf58c668749e26b29f
SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
TLSH
T181F11C12A7A500F5F8DD0B7134B7627BE875FA295725C14FC544DE6C0C302E2D928BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads