fakeav | 192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440

Target

192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Size

711KB
MD5

c11c38a2dc17558e70902eeb958ffdca
SHA1

dd16882a61da57e21389e0f856740e6d3c8e2b49
SHA256

192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440
SHA512

5483a32cc11c9d1de4859ab859c41e163480e8b98390afe106fab76734a85a983630f20d6572e088d7845cd2cc6944e685344725fe9798c20cc579ed237fef9f

Score

10^/10

fakeav fakeav persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE"	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE"	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CSRLT.EXE	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
File opened for modification	C:\Windows\SysWOW64\CSRLT.EXE	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MSBLT.EXE	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
File opened for modification	C:\Windows\MSBLT.EXE	192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe

C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe
"C:\Users\Admin\AppData\Local\Temp\192a70a765957bf9e5ded98fe147e6e0e437d30080b572216174a4e94a0a1440.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:3984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads