fakeav | 430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465

Analysis

max time kernel
5s
max time network
143s
platform
windows7_x64
resource
win7v20210408
submitted
05-05-2021 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
Size

812KB
MD5

e6263add2635d2294062e183322af35f
SHA1

66b1a75e948c7b52651d7ad5a14396536e4216c3
SHA256

430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465
SHA512

40d4425e36d6ea3c5e668e884e6339b554639fca0c9ce0a449f26fc0aa81356600583d51ca335e542bb23f7464167e5d6cc8ab4a19af0d217125a8181357c0fa

Score

10^/10

fakeav fakeav persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE"	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE"	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CSRLT.EXE	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
File opened for modification	C:\Windows\SysWOW64\CSRLT.EXE	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MSBLT.EXE	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
File opened for modification	C:\Windows\MSBLT.EXE	430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe

C:\Users\Admin\AppData\Local\Temp\430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe
"C:\Users\Admin\AppData\Local\Temp\430e2a25bb7e5d9a2d5605d77982874d95e152b38afc46862c3cfdf55fca3465.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-60-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1840-61-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download