fakeav | 28120bf835ecf2fbd9f30e5281ad7ba0c7bdfd85a5c95d7fd4db73f718fbb21c | Triage

Submit
Reports

Overview

overview

Static

static

fce916fd22...18.exe

windows7-x64

fce916fd22...18.exe

windows10-2004-x64

Sharing

General

Target

fce916fd22304adba9632f06ffd82a0e_JaffaCakes118
Size

5.7MB
Sample

241218-ypf85szley
MD5

fce916fd22304adba9632f06ffd82a0e
SHA1

a9266bb2dd5df32a61eb9fc9e4e59bb257996d1a
SHA256

28120bf835ecf2fbd9f30e5281ad7ba0c7bdfd85a5c95d7fd4db73f718fbb21c
SHA512

c8402d53ea9aaa3959be1b725c0e6e6e7db1ff69cb055f1af1a1e41fe753b4d59e15402d4c0beeee225e0bc0684e1a90f423228fec6d2b66a80245b273afd5c4
SSDEEP

49152:67N1ahCK0V7N1ahCD0V7N1ahCW0V7N1ahCY0V7N1ahCX0V7N1ahC50V7N1ahCI05:67X727j7l7a7s7V7

Score

10^/10

fakeav discovery fakeav persistence spyware

Static task

static1

fakeav spyware fakeav

3 signatures

Behavioral task

behavioral1

Sample

fce916fd22304adba9632f06ffd82a0e_JaffaCakes118.exe

Resource

win7-20241023-en

fakeav discovery fakeav persistence spyware

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

fce916fd22304adba9632f06ffd82a0e_JaffaCakes118.exe

Resource

win10v2004-20241007-en

fakeav discovery fakeav persistence spyware

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  fce916fd22304adba9632f06ffd82a0e_JaffaCakes118
- Size
  
  5.7MB
- MD5
  
  fce916fd22304adba9632f06ffd82a0e
- SHA1
  
  a9266bb2dd5df32a61eb9fc9e4e59bb257996d1a
- SHA256
  
  28120bf835ecf2fbd9f30e5281ad7ba0c7bdfd85a5c95d7fd4db73f718fbb21c
- SHA512
  
  c8402d53ea9aaa3959be1b725c0e6e6e7db1ff69cb055f1af1a1e41fe753b4d59e15402d4c0beeee225e0bc0684e1a90f423228fec6d2b66a80245b273afd5c4
- SSDEEP
  
  49152:67N1ahCK0V7N1ahCD0V7N1ahCW0V7N1ahCY0V7N1ahCX0V7N1ahC50V7N1ahCI05:67X727j7l7a7s7V7
Score

10^/10

fakeav discovery fakeav persistence spyware
- FakeAV, RogueAntivirus
  FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
  fakeav spyware fakeav
- Fakeav family
  fakeav
- FakeAV payload
  fakeav spyware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

fakeavspywarefakeav

behavioral1

fakeavdiscoveryfakeavpersistencespyware

behavioral2

fakeavdiscoveryfakeavpersistencespyware

© 2018-2024

Terms | Privacy