fakeav | 59a6eb8c43091110344325fa1ade46533930732c90e60cecdf55dc4719453eab | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

dfa803a298...18.exe

windows7-x64

dfa803a298...18.exe

windows10-2004-x64

Sharing

General

Target

dfa803a29834487e105f930fad10c23d_JaffaCakes118
Size

3.4MB
Sample

241211-dm86xstlft
MD5

dfa803a29834487e105f930fad10c23d
SHA1

1fa51145720a89bb99376526f028b17403bbfbfd
SHA256

59a6eb8c43091110344325fa1ade46533930732c90e60cecdf55dc4719453eab
SHA512

78cd701a44e19074ce2a6eff0af5b247b2a990bfaa14f2ca600ac153f45ee1078c23d27b6a3fb7d12f49737b14f38ebb4419235144674ffcb9bea3553c153805
SSDEEP

49152:67N1ahCX0V7N1ahC60V7N1ahCJ0V7N1ahCm0V7N1ahCV:67a7H787z7V

Score

10^/10

fakeav discovery fakeav persistence spyware

Static task

static1

fakeav spyware fakeav

3 signatures

Behavioral task

behavioral1

Sample

dfa803a29834487e105f930fad10c23d_JaffaCakes118.exe

Resource

win7-20241010-en

fakeav discovery fakeav persistence spyware

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

dfa803a29834487e105f930fad10c23d_JaffaCakes118.exe

Resource

win10v2004-20241007-en

fakeav discovery fakeav persistence spyware

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  dfa803a29834487e105f930fad10c23d_JaffaCakes118
- Size
  
  3.4MB
- MD5
  
  dfa803a29834487e105f930fad10c23d
- SHA1
  
  1fa51145720a89bb99376526f028b17403bbfbfd
- SHA256
  
  59a6eb8c43091110344325fa1ade46533930732c90e60cecdf55dc4719453eab
- SHA512
  
  78cd701a44e19074ce2a6eff0af5b247b2a990bfaa14f2ca600ac153f45ee1078c23d27b6a3fb7d12f49737b14f38ebb4419235144674ffcb9bea3553c153805
- SSDEEP
  
  49152:67N1ahCX0V7N1ahC60V7N1ahCJ0V7N1ahCm0V7N1ahCV:67a7H787z7V
Score

10^/10

fakeav discovery fakeav persistence spyware
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- Fakeav family
  fakeav
- FakeAV payload
  fakeav spyware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavdiscoveryfakeavpersistencespyware

behavioral2

fakeavdiscoveryfakeavpersistencespyware

© 2018-2025

Terms | Privacy