5b2b154547329285f51e3dcdc97e806d617f9192c2aec0720f271a444224a578

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Legalizator XP v2/2-AntiWPA_3.3.exe
Size

284KB
MD5

6293a4e240c1d52ef813a3b7abd34e8d
SHA1

001ec1210f9c5a1d38d703d2b5ad07ca53946b55
SHA256

acda604c84837e2f617f3fcf9fdd0a6ff3def770ccdf58b44450f81ef0c1e783
SHA512

683dded60b05e0c7403908a5f635d1fd10d6c45a98f3dfff170bf157ffb5cdc73b4491896ee4a55c05410093cf3665b585b324407f7e6e4c254f18ec38fe12cd
SSDEEP

6144:qZuuObR8sVImcyYQlFe79XmxYM0N7BDNdSy+2chT8b1A:5V+mzDFeZXLMAHM9M+

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	2-AntiWPA_3.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3692	2020	2-AntiWPA_3.3.exe	86
PID 2020 wrote to memory of 3692	2020	2-AntiWPA_3.3.exe	86
PID 2020 wrote to memory of 3692	2020	2-AntiWPA_3.3.exe	86

C:\Users\Admin\AppData\Local\Temp\Legalizator XP v2\2-AntiWPA_3.3.exe
"C:\Users\Admin\AppData\Local\Temp\Legalizator XP v2\2-AntiWPA_3.3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\AntiWPA3.cmd" "
  2⤵
  PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\AntiWPA3.cmd

Filesize
1KB

MD5
6e155d6a010b5a7f968fbcf79b3d9724

SHA1
133510e02ca42b440aaa456ff9bca6a04ebad4b6

SHA256
b5fbbd1af5533af115ca6c123e8c9ec9e61a36e3bc12e504667d16465dae9c1c

SHA512
51234b40119b44972d5ac313a432c746347c1952848efec1e4e4a8691ecc1e63ac147520510f2738b0e1aaf14bf69261532e947f7e4f81d6d7261f4f2f998b9d

Download Submit
memory/2020-9-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download