FakeAPP 3X

hsks

https://cowtransfer.com/s/71cab55dc7b246
https://share.weiyun.com/kBvrjp4m
https://f.ws59.cn/f/cxy1447523c
https://cloud.rhinelab.io/s/G7tp
https://www.123pan.com/s/FJUmjv-AaLN.html
https://pan.huang1111.cn/s/vXXKTE

嘿嘿不能说

MID01.msi：



SMS1.2.exe：杀2衍生物

GDHJDSYDH

EIS扫描kill 1x，剩下的EIS+KFA扫描均miss；沙箱内运行安装，EIS kill其中1x所释放的衍生物，另外1x成功安装并且EIS+KFA均无反应

GreatMOLA

Check Point 执行

自动响应，处置后系统中已无相关进程。（由于条件所限，仅能放出部分截图。）



自动处置（部分截图）


XDR出现多条告警，IOC指向FakeAPP安装包。


XDR告警（节选）: Possible threat classified as "SoftcnApp" reaching stage "Execution"

Check Point AI Copilot 分析

On December 19, 2023, the Extended Detection and Response (XDR) system identified and neutralized two threats on the 'VMPC-1218-10LTS' virtual machine during 'User1211's' session. The threats, namely 'lnnloader.exe' and 'bor32-update-flase.exe', were linked to the 'SoftcnApp' and 'Gen.Rep.' attacks respectively, and initiated via the suspicious process: '2b29be4108708df1sdl.exe'. Utilizing Threat Emulation technology, XDR employed internet-connected sandboxes for early multi-stage attack prevention and file analysis for proactive threat identification and mitigation. This approach not only curbs false alarms but also strengthens defense against malware and security breaches.
The incidents align with the Mitre technique "User Execution", indicating an adversary's dependence on user actions to execute their plans. Such actions often involve users falling prey to social engineering tactics that lead them to activate malicious code by opening harmful documents or links. This technique is typically a subsequent behavior observed after "Phishing" or occasionally post "Internal Spearphishing".

kuroandsan

fs 扫描miss

骨灰级小白

系统拦截第一第三个，毛豆自动入沙第二个

UNknownOoo

火绒
扫描：2x

1. 扫描文件：3
   
2. 发现风险：2
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\F3X\SMS1.2.exe, 病毒名：HVM:Backdoor/Farfli.i, 病毒ID：fc56f24e4fb42aa7, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\F3X\W-P-S64.102aOffice.exe, 病毒名：TrojanDropper/Agent.pk, 病毒ID：a7d877fca24f595d, 处理结果：暂不处理

复制代码

运行：
MID01.msi -> 捉衍生物

1. 病毒名称：HVM:TrojanDownloader/Maloader.t
   
2. 病毒ID：A456DEFD96738281
   
3. 病毒路径：C:\updot\onliawaz.exe
   

复制代码

Renascence

SEP扫描均不报，双击SMS1.2程序报错退出，双击W-P-S64.102aOffice全程未见拦截，双击MID01杀衍生物

784696777

biue