fakeav | 2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6

Analysis

max time kernel
4s
max time network
13s
platform
windows7_x64
resource
win7v20210408
submitted
11-05-2021 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
Size

1.6MB
MD5

f036e250698183a8892e8e5fa8b63eea
SHA1

62b5b862f7bba08a306527c7e5f591f635f7984f
SHA256

2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6
SHA512

2bfddbc869b29d7f4911c153053383a34ec9d3d6fa0329ffe17fdf8c32948c50d49e705f9ba6e149aad9e19f708a25e934d9fbc60332eca8679201ecfdc29d93

Score

10^/10

fakeav fakeav persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE"	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE"	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CSRLT.EXE	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
File opened for modification	C:\Windows\SysWOW64\CSRLT.EXE	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MSBLT.EXE	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
File opened for modification	C:\Windows\MSBLT.EXE	2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe

C:\Users\Admin\AppData\Local\Temp\2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe
"C:\Users\Admin\AppData\Local\Temp\2647cf8b586a61f74e7eba0160541330e8bde138b1c59d709e0b63c4d37cbcd6.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-60-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1840-61-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download