Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-03-2024 06:42

General

  • Target

    c7f2c28a5bcffb9d4ddcb0b0084a66bb.exe

  • Size

    711KB

  • MD5

    c7f2c28a5bcffb9d4ddcb0b0084a66bb

  • SHA1

    eb47ed49b8f3922d694283dc0854f4f53e291fe1

  • SHA256

    544f2380e2d8c03f765bca1bc2e42a23fb884e433246154a6a48c8ea9ad73c00

  • SHA512

    5a1215054a8a54ede75971a728926c16616b7fdca62b0223a8f250cb701359bb752d68e152471d930957f98de4493e4835a217d7b74b3f56557566a6747dee0a

  • SSDEEP

    12288:yoxejOONAM7GUC1Jr+4o628gx2Jw+tP3Jzm8JOiHXC3X+pd167QhEQO:hxY3NtGUmJr+4Obxd+tPZSZCiE6EhE

Malware Config

Signatures

  • FakeAV, RogueAntivirus

    FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

  • FakeAV payload 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7f2c28a5bcffb9d4ddcb0b0084a66bb.exe
    "C:\Users\Admin\AppData\Local\Temp\c7f2c28a5bcffb9d4ddcb0b0084a66bb.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1048-0-0x0000000000170000-0x0000000000171000-memory.dmp
    Filesize

    4KB

  • memory/1048-5-0x0000000000400000-0x00000000004BD000-memory.dmp
    Filesize

    756KB

  • memory/1048-7-0x0000000000170000-0x0000000000171000-memory.dmp
    Filesize

    4KB