fakeav | 8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
30-03-2022 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
Size

2.8MB
MD5

02328b220f0ddb2d94289cbb57f93684
SHA1

f642ea04257c1eb1a82f9814a40e1f0ce0142858
SHA256

8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a
SHA512

545c42755b4b2ba8dd864edd2f8ba074d1a8be1d84861efd0638325725489202f947b007cfe53a97e1dea928055f21b0ca53ec064a5688033185137f283f0d6b

Score

10^/10

fakeav fakeav persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE"	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE"	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CSRLT.EXE	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
File opened for modification	C:\Windows\SysWOW64\CSRLT.EXE	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MSBLT.EXE	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
File opened for modification	C:\Windows\MSBLT.EXE	8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe

C:\Users\Admin\AppData\Local\Temp\8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe
"C:\Users\Admin\AppData\Local\Temp\8ea357a096356061f5aa79011c824f0cb4133c2a6ae0e01c2e1e99f29b312a8a.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads