fakeav | 02674442c7fefaca79082eff7c720f85c32864267160eb2c61175e24f7df4812

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
02/06/2022, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679102251e03106105cfd79d5e791304.exe
Size

711KB
MD5

679102251e03106105cfd79d5e791304
SHA1

d5410c091a25bda569381a0a6dd01811e62ef0cb
SHA256

02674442c7fefaca79082eff7c720f85c32864267160eb2c61175e24f7df4812
SHA512

d816c4639ec99c3e8286887cdecb6e97acc70df870cc6e8a93c9d1dea1b984ed0ebc55369171ff75795cd064a218e044cda87676fe1be2c6babaafaad6c2a96f

Score

10^/10

fakeav fakeav persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE"	679102251e03106105cfd79d5e791304.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	679102251e03106105cfd79d5e791304.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE"	679102251e03106105cfd79d5e791304.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	679102251e03106105cfd79d5e791304.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CSRLT.EXE	679102251e03106105cfd79d5e791304.exe
File opened for modification	C:\Windows\SysWOW64\CSRLT.EXE	679102251e03106105cfd79d5e791304.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\MSBLT.EXE	679102251e03106105cfd79d5e791304.exe
File opened for modification	C:\Windows\MSBLT.EXE	679102251e03106105cfd79d5e791304.exe

C:\Users\Admin\AppData\Local\Temp\679102251e03106105cfd79d5e791304.exe
"C:\Users\Admin\AppData\Local\Temp\679102251e03106105cfd79d5e791304.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download